{ "Event": { "published": true, "date": "2026-05-25", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-05-25", "timestamp": 1779753782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d39de490-f3ba-4182-9389-ffcb938a5fa6", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822b1829-587c-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779742720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742720, "uuid": "88472c85-e047-485b-a9e7-94310b11a15c", "comment": "Malware payload (Efimer)", "value": "b33d6f3399715e700a7ffe78c90ac484", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742720, "uuid": "2c7e59b4-c669-4326-8789-7c7fafcb433e", "comment": "Malware payload (Efimer)", "value": "00b9f44d51b242ae47bafbe693921938f563c631af3fc4af8fe1e7aad65c1043", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742720, "uuid": "fad858a0-bcf4-4181-ad6b-58c6a010ee4f", "comment": "Malware payload (Efimer)", "value": "b505a1dbd4458e627857a56535fbc5877ab42227", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742720, "uuid": "c5ffaa99-521b-4f10-b484-383b0b0e7510", "comment": "Malware payload (Efimer)", "value": "64e0a244b26e31350e624855e0cfad61151d66931422b9a12870fd951c3e4ce346a92defded2154aaf1b19108c7d05a5", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742720, "uuid": "1762a602-c1f0-48a0-92e9-ed5ddbfe889e", "value": "T148D6330BEAD222EDCA3B807477B129F0F46C743516B1D226DAACC3715C974B5487E89B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742720, "uuid": "35fd0acd-ffcb-4769-a135-9551c3ab4f7b", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742720, "uuid": "0b1602d8-df7a-4ff3-85e3-cc83ad482888", "value": "393216:Jy68Y5WVVbpifa+In1XMCHWUjXfcuI3/PGTAI:JoYg4fjeXMb8X0H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779742720, "uuid": "08712173-eaa1-4fb1-ac48-5d109445f89b", "value": 13841383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779742720, "uuid": "0161b742-8510-48e8-b199-0643c000645d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742720, "uuid": "75bdbec1-a6a3-4575-98b4-734de45b27c8", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb08d44-587c-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779742661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742661, "uuid": "63e29117-271b-4981-b1a8-32a786254348", "comment": "Malware payload (Efimer)", "value": "2605b5f37ab2f2d98c2f29087a339f0a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742661, "uuid": "465b6e5a-f5e3-4236-bfaa-e5154f77c03f", "comment": "Malware payload (Efimer)", "value": "01447331a3d8ced03ac2c633aa4a9fb787c9edaf2bc3dcfdbe7f64a44d2f48ee", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742661, "uuid": "a46880a0-55dc-4466-95d3-fe9c2abcdb16", "comment": "Malware payload (Efimer)", "value": "4a491fc28e33e1350b54de8e2262faf83f91157b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742661, "uuid": "488cd742-c2e1-4160-950c-f1ea00e55f3d", "comment": "Malware payload (Efimer)", "value": "633f86c929877b9f7ddac72b118d8828e268e2fdeadf4c0127539a1f6e4969b4fd3efc25f6514db1614d9e2801c541a3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742661, "uuid": "12556fa7-359e-4bd8-b6e4-46e058ad2d06", "value": "T17ED6331DFCD7508CDAAB85709EE112F5F4A8F4B11A719AAB9888CB716D1B810DE3CC47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742661, "uuid": "08751fd8-eeb8-40bf-b99c-ec8bb43ebfd3", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742661, "uuid": "d6987e23-2693-4e0c-b6b6-4e92226ba4c5", "value": "393216:IQOP6In2LyWitWFjIDIZaKrnCij3XMCHWUjXwcuI3/PGTAI:INP6InB8F8DItrCij3XMb8XlH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779742661, "uuid": "b7c77eed-7988-4403-8124-b6b9ba19c7ad", "value": 13861946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779742661, "uuid": "777a8150-2101-41b2-a517-b6484f4bc0a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742661, "uuid": "054d2c9c-7a9f-43ca-b642-343e575d2854", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c6059be-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747274, "uuid": "ee625ac5-11a1-465d-a458-dbc852e3fee8", "comment": "Malware payload (Mirai)", "value": "2e69fe515eaec1120535b69e948c17e6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747274, "uuid": "ddf07e6e-3244-4db7-a7ba-4a479c33b53e", "comment": "Malware payload (Mirai)", "value": "03530317daf063147818fbc620998b63efb93d25824745a1e53a2684a66993cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747274, "uuid": "e1ed3d9b-511a-44d5-befc-6ffcac2e8469", "comment": "Malware payload (Mirai)", "value": "5ce419b95c434bde8a55875d9dfd9b30c04cc753", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747274, "uuid": "e589eff6-ec11-4ed8-8251-25ccb43c3241", "comment": "Malware payload (Mirai)", "value": "3eb5c7c24c1fdbb143c3dc1c0d84b58199219a099ffa2b9535d50d9a8fb4e09821788705a0d83fc3c231b4bdeb3bd128", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747274, "uuid": "829b9e23-08f9-4ce2-86e2-9a9c6c2c712c", "value": "T19FF2E114F24CBDA7F66A5CB46E53CAF2BBD00EBCA79F966030859E064242837054DEE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747274, "uuid": "07b18962-d245-48d7-9fee-8b062a1b85ce", "value": "768:sk9hrdmlHUGsSSQwIFiKOwwYp8f+e2wt5Sjxqy4uVcqgw09i:sk9Nd6HPUQiAaf+Zwt5Iqy4u+qgw09i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747274, "uuid": "981cd178-6335-4d4b-b4cf-c3b94781604a", "value": 34324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747274, "uuid": "cabb8a04-0bb0-46a8-85b9-8e5f0ea4bd7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747274, "uuid": "ae2ef354-fa0f-4b9c-bae6-f666f3ccdef1", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbdc83f3-5885-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779746790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746790, "uuid": "d09b8d3f-a0eb-4cdd-866d-58234ad16750", "comment": "Malware payload (Mirai)", "value": "a17c3b61dd85f1911230bc1f17111c55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746790, "uuid": "d64c8c5a-e3eb-41a5-a658-12b0b0c5f045", "comment": "Malware payload (Mirai)", "value": "03d2b96fb4ef4d45244443c26eaf4eb91e4f2ee3a466c82e93524dd37c57e5b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746790, "uuid": "df66256b-ffcc-416c-ab59-3a1cbb40fa99", "comment": "Malware payload (Mirai)", "value": "5afd4d53a7942e100476dcc8a8d97618e98ebd40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746790, "uuid": "c0a03f50-0497-482f-8cf2-6b1a91e6f150", "comment": "Malware payload (Mirai)", "value": "eb79732f5be4251301c4ae6542d8c485a6ca691dd428556176a09cca180348e128997d36e403b6229bb6895fd3e063b0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746790, "uuid": "ed1639f1-b5da-4b84-8c47-b073032ff97b", "value": "T1D0F31806BF650FF7D85BCE3706FA171929CC590A61B87B3A7930D858B58E20B25E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746790, "uuid": "5f3a46ad-de44-4691-ad7d-6bc8ff643bab", "value": "3072:vdLSpyqR1mHYQVN6RWL+rzjDLT7juuBXRGAYtGjmTV:vdLqNR16HVN68Li+GjAV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779746790, "uuid": "5edb9658-3086-488a-ba02-ebeeac03f68d", "value": 163492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779746790, "uuid": "0a338bc0-2885-4c39-b499-9bd22a1baa6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746790, "uuid": "a10a5eea-6b07-4427-a913-079a5bd3274f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b282a5a-5867-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779733555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733555, "uuid": "daf18406-ff32-4dd5-866f-e394cb7dc3c3", "comment": "Malware payload (RemcosRAT)", "value": "005b50a3443dff0e8c8809efa474769c", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733555, "uuid": "9946115d-ed66-4d8e-96fd-287b53604ff0", "comment": "Malware payload (RemcosRAT)", "value": "0409bda380f83c7110d4eba0f6df787d56fd99d6cf196a26e0dbf610e4b226f0", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733555, "uuid": "d79081df-0282-44cf-a3f5-9913d2b0e3da", "comment": "Malware payload (RemcosRAT)", "value": "7ec3ea43deebde4361ea542017134d3b78c23d0b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733555, "uuid": "00fadfc1-30a4-40bf-ab1e-e48d0c92e76d", "comment": "Malware payload (RemcosRAT)", "value": "36a8bc2e1f4a1d4de32e9834acd2c8149a51d3d1cd52f9034b360ec2b9b117e8a21cbb29671191ad2dad4c63911f2e6b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733555, "uuid": "1006e04a-ce61-426e-8681-af22a2f7fe8f", "value": "T1922523006041BE5FC012A6B1AB6BF65B236EBCB5B6C54903312DF36E1374F76E143A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733555, "uuid": "a55dfcef-1799-44dc-a827-cc71c6661c64", "value": "24576:QX9rUoadQdOHX6ud05NOtce4vDs1zCIRefrSXyj6I8B:QXNUZdQM3HOD+zCIKuXQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779733555, "uuid": "cfa3f0b7-5c8b-4dfa-a114-6676a795d94b", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779733555, "uuid": "e142426f-22d2-4b9b-9fce-54e2fe40c1b5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733555, "uuid": "11c1e545-bf16-439e-b02e-c0c4699ae719", "value": "SecuriteInfo.com.X97M.DownLoader.2343.15148.15629", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca1b241-5867-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779733772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733772, "uuid": "6a25be04-4ef5-4ce3-b2a5-b2cd0d55ff64", "comment": "Malware payload", "value": "0d96b1aa7f2eda0cf9cb615ed7a95d9a", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733772, "uuid": "69b6acf6-b3df-4d88-9f37-ba72e745ebfe", "comment": "Malware payload", "value": "0492b2bc8b7abffd4c3017299bd9ff3c1d687bb558f25a1975e66f683ffbabea", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733772, "uuid": "11ca6bfb-cacc-4f30-9929-4ec533d2f482", "comment": "Malware payload", "value": "54a0905e1b8937cdeefcb6d08d6a42e4de8c9a2d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733772, "uuid": "ff452c49-dc90-4d42-b3c9-0ec777eb9c32", "comment": "Malware payload", "value": "b4c9225643251f93b705923ed45b91b2f9227bc7f166d57cde6204bf9616b7981825e2cefb7c2c3925d055ca50a7eb46", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733772, "uuid": "603532f3-6aa4-43de-afd8-9e4f864c2bce", "value": "T1A4D57C96144D40E309F9DBB2F825AD8A7B9E02FF5012959C35C0DCA85B6E18B46FF0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733772, "uuid": "d29d6b4c-2575-4073-9cb2-ace4031a3ae6", "value": "49152:JGx9xfGEbGKVy99WYo5kmmCnv9JtxFn8nemUxvN3l:ra9Jtx5mUxvN3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779733772, "uuid": "9ec5ea15-af0f-4b74-af7a-1a9cdc1a423b", "value": 2775441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779733772, "uuid": "9eaa0fe4-0af9-4866-8400-d904ef49a9af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733772, "uuid": "10ba3e32-30ca-4730-b87b-159554c31972", "value": "aM8KVQygJ.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66508130-5870-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779737520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737520, "uuid": "3dbcd777-aeb1-4caf-a9ea-aa0173d3597a", "comment": "Malware payload (Mirai)", "value": "edde57e996778861281fb2ac7b73cac9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737520, "uuid": "6c93537b-0584-4d60-94a9-a13f0d59b414", "comment": "Malware payload (Mirai)", "value": "04c9ca48157bdcc23cf19ebb9bd1aaaac0a5c1132dee7e0ee9c95939149302ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737520, "uuid": "580e2633-3e9d-4cbe-86c3-fe4bc7f966da", "comment": "Malware payload (Mirai)", "value": "72dd180f0b926d3f03e1a2a46e60646b63d1a187", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737520, "uuid": "baf75187-ff1e-4811-9225-a69a3fc7b137", "comment": "Malware payload (Mirai)", "value": "6aa00c3157e3f34f2d3e4d97633e1ccf9c0863d9be62c0d3979f359e933124974071a10fe71c46f278afa6a8dd643061", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737520, "uuid": "d58e4cfd-69ec-4133-bfb5-1233aaaa9f8f", "value": "T1B356189BB9D24942C4E43677B9BE80C433630EBA9B9756565D04FE383EBE1D90E38314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737520, "uuid": "ae0c47cc-442a-4b16-9886-594f7724018f", "value": "49152:BRWmiDyFbBmaU9utmQeg04wOpynZYFGFjvv5Er:fRFNm19umX2wBCFGvEr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779737520, "uuid": "68371c58-30af-4ede-a069-3999a1056dde", "value": 6029474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779737520, "uuid": "b606843f-827b-458a-8ada-633ac0bbcdb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737520, "uuid": "4ffd4c7d-744f-49d1-ad1d-e73f18d90307", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fbb0ab-57e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779678034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678034, "uuid": "a443cda6-0f6a-4073-a195-bec4e2749d70", "comment": "Malware payload (Mirai)", "value": "9e0368644e458484ce8e47d0c8303358", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678034, "uuid": "6803a19c-9d8b-424c-87ea-80b8d46bd118", "comment": "Malware payload (Mirai)", "value": "04d790700473ce62324514814d76c3d5c7b17e7bae70db18b295bb31001045de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678034, "uuid": "955123bc-93d0-4a94-80a3-d3721ff5161f", "comment": "Malware payload (Mirai)", "value": "52cf6612cc31fa11ee08f01dcf095d7b79659047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678034, "uuid": "07e9bf3d-5fd2-4e13-9cd9-4b637e5caa02", "comment": "Malware payload (Mirai)", "value": "680a9d1c605eec21cfbad7e961a636b021b5a660cea7fc6c84237c6740be777e0cd5b08c580e5a8bc50d2a62534fae54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678034, "uuid": "74ffc84a-3a1c-4ad9-a306-c51cbcf33075", "value": "T128246D736546BF7CD87200F4EA8363DA292316083F9EE1E37887663DAA712CD9411F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678034, "uuid": "a79b89d6-200b-4336-8247-df36056c2587", "value": "3072:2Jp21SrUJo3M3Lujpy44fARCqWJ5aAfeP0axZlRElFgHCEO9DCsNnSq:2J4MrUJnu9MfBJ5HeMeB4YCEO9FQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779678034, "uuid": "a14f6668-097a-495d-86cc-f6a691cddb3c", "value": 223212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779678034, "uuid": "ac7a2694-3982-4c6c-8c55-821a979fcaff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678034, "uuid": "525b11ee-5277-4583-a60f-0a78690d8ac2", "value": "nuclear.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02091053-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779746800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746800, "uuid": "045a0a36-cc9e-43e8-a4ea-48165edc549b", "comment": "Malware payload (Mirai)", "value": "08192f8cc574d7d86c816c19c412511a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746800, "uuid": "45ca2924-8ebc-4edc-9a66-78f9342849c6", "comment": "Malware payload (Mirai)", "value": "05a87d6e569595c973ba07f95a97c729285c5ac4ea03cdffadeea8be8887a4f6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746800, "uuid": "f8081d89-43ad-44f2-b4a8-e41b3e05142d", "comment": "Malware payload (Mirai)", "value": "7813bcefa43475c4fe4080101da36022c06b9ef2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746800, "uuid": "4561708e-eba0-4c9c-ab82-ff19c1017acf", "comment": "Malware payload (Mirai)", "value": "fc1295d6e4e999d3430e4fef363667f42d313f8f9499fae9bb62e1558ac9116052d36d1e39bea3db83bd5e09b9d7b96a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746800, "uuid": "de204a67-bcd7-4b34-a86d-75bee243d511", "value": "T100341A04F8544F67C6C22BBBF79E42CD37365B5897EB7301AE246EB42BC6B881D29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746800, "uuid": "1a0c1283-9c3e-4c20-b636-03fe6000dc6c", "value": "6144:hNZ23AxZX4FRBNycrqn0lfyWyofvZbpnqbyTgo61:g3Ar4F9nvfyWyofvVpnqbyTgo61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779746800, "uuid": "9c79ca02-36c7-49c2-9ab3-652fe61c4f3d", "value": 232730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779746800, "uuid": "7ceb6751-ecb4-446c-aace-593eef4aac56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746800, "uuid": "e7b62ea7-0200-4491-96e1-f3a36fa10f21", "value": "bot-bf9c9361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eeb08b0-5804-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1779691095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691095, "uuid": "8ac9d547-7d09-4416-bd67-a8835334e85d", "comment": "Malware payload (PhantomStealer)", "value": "f93d172f71665edc8dd107bc249570c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691095, "uuid": "f5d2666d-8060-47be-b84d-7048184cba39", "comment": "Malware payload (PhantomStealer)", "value": "069fe3ee8f7fa8877cf01478f42b51c0ad071abb7a79e267eb332cb7f066924e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691095, "uuid": "74c754a0-5620-45d2-afd4-c2640590add6", "comment": "Malware payload (PhantomStealer)", "value": "0067109e17b6148984da5266d8161d40c626a7d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691095, "uuid": "da92f244-103f-4334-af6c-b022cdfff153", "comment": "Malware payload (PhantomStealer)", "value": "65cb81b2176871b22ecad0166e8abd6561fbb7fa3fb114c2e42ccc596c89649f97817da03edf3701c5051fc080f1f44d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691095, "uuid": "da7aceea-1df4-44f5-aae9-b3c5b37b5ac9", "value": "T1E49502147256DA3BE441ACB4EC3BC1F21BA56C981620523635FA7F1F34BB23245EE35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691095, "uuid": "a7e11488-ae54-4a03-bb80-acd1117ac155", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691095, "uuid": "963b1df0-5392-4854-a55f-37ec797debe4", "value": "49152:F3wLs8AEZOq1Z2OLQEwjsawK+bM53R4i+VxGQ:r8AQOQL2jsaF8VxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779691095, "uuid": "963cc435-d6db-42a1-8cbf-1e7e28a69d92", "value": 1948160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779691095, "uuid": "3264036d-0fe5-48e9-9e80-eab503f5b589", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691095, "uuid": "76672d10-8d54-40e1-a78b-96abf57b2750", "value": "New Order & Shipping Detail to deliver in ETA- 220526.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ee2025-5819-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779700233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700233, "uuid": "8d6fa2f6-7294-4e60-8edb-e26f8224bc69", "comment": "Malware payload (AgentTesla)", "value": "201293d17180dc0e5608057e11019216", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-cyberflor-co", "colour": "#EB825A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700233, "uuid": "d1c72680-ea1a-4110-943b-9ddb56073784", "comment": "Malware payload (AgentTesla)", "value": "077cf7e960538d149805bbdd671b81ade5df12e58b66c1bcacdd4380a1711b98", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-cyberflor-co", "colour": "#EB825A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700233, "uuid": "adb39672-f6db-4cc9-a451-8c987bc9c633", "comment": "Malware payload (AgentTesla)", "value": "8a71169d192699cc0408d3db3bfd9aa83610b3aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-cyberflor-co", "colour": "#EB825A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700233, "uuid": "a22a36e3-0f6b-4aa1-b2e5-197b8388ca4f", "comment": "Malware payload (AgentTesla)", "value": "33db5a06008b6ef1d2461cfd382d5f1307880838c5a6bb5e88b26d4a78a7ea205a9137e43cce7a53992c64d08f45f68e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-cyberflor-co", "colour": "#EB825A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700233, "uuid": "37704fca-85f7-4681-847a-d4f49b90bf0a", "value": "T1E0340F037E88EB15E1A83E3B82EF6D2413B2B0C71633D20B6F49AF6614516525D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700233, "uuid": "bd5940f6-6774-4879-8b49-51bb24dd7204", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700233, "uuid": "4a85594f-5bcf-4790-b5f0-f2651daf6e25", "value": "3072:p0XtOyGpw5PJcrF5t0i/bMqOub254SskodZ:GXtOyGpw5PJcrfN/oqOub9/kc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779700233, "uuid": "919e8f0b-315d-4f6e-beea-ffe34e0854b6", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779700233, "uuid": "bcf1cf23-cd03-4ca8-bbbe-1badefed75de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700233, "uuid": "c696bd1e-aab8-4d22-8d56-1d80a639c4ae", "value": "077cf7e960538d149805bbdd671b81ade5df12e58b66c1bcacdd4380a1711b98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817fd17c-586a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779734988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779734988, "uuid": "aee42e16-4d55-4bd4-ac24-d5b211a6a80d", "comment": "Malware payload", "value": "e7a575cb9a0c3e90ba1839bae9afec59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779734988, "uuid": "93831dee-2b58-4a0f-b74c-b4b06352238f", "comment": "Malware payload", "value": "09501e8ffdec1bb8bab3a7bd4198452b6f183cd4e5523844bc4d1fdb83fd021f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779734988, "uuid": "c405de2b-0317-4d76-8428-a58aa9ac245f", "comment": "Malware payload", "value": "54119917a9f98e22627c87fbdfa9304139969dbc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779734988, "uuid": "f10056e4-c773-4a92-9dbf-c4167b80c581", "comment": "Malware payload", "value": "841404dc09673d30ef6127e9e811fbd150f69279f6f2c93f31ede6d058065f7cb4a43945891944a9b85e12bac9c3132f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779734988, "uuid": "742f5bdf-5497-49bf-b4e1-3338d9ebac5e", "value": "T1E617BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779734988, "uuid": "7b587926-56b3-4a08-8cf4-3e3715cf1ce5", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ1:cqYUQuVDt0TZEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779734988, "uuid": "62475385-dc0a-48b5-b9e6-654ca493860c", "value": 19791872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779734988, "uuid": "2fc0aa5b-d5c7-4051-919b-7c793de88ddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779734988, "uuid": "de3fc3b6-998f-43ab-93e3-1fd006936076", "value": "09501e8ffdec1bb8bab3a7bd4198452b6f183cd4e5523844bc4d1fdb83fd021f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9456aab-5864-11f1-a769-42010a9c0008", "comment": "Malware payload (Lazarus)", "timestamp": 1779732612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732612, "uuid": "222ebc2f-7866-47b7-9a84-6b21a99fbd39", "comment": "Malware payload (Lazarus)", "value": "aef67f5fa937282139975b13fe9211d7", "object_relation": "md5", "Tag": [ { "name": "BANKSHOT", "colour": "#B5341B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HiddenCobra", "colour": "#CFF9B9", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732612, "uuid": "91c3b4c1-96da-49ef-84c6-b144ca35e189", "comment": "Malware payload (Lazarus)", "value": "0a0bd696ec0d98b6dc7cb655ae58370d4d13f08b91a92eef52a0ed1efbb8577e", "object_relation": "sha256", "Tag": [ { "name": "BANKSHOT", "colour": "#B5341B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HiddenCobra", "colour": "#CFF9B9", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732612, "uuid": "a358b7e7-3e4c-4755-b7fd-ac2f163d47cf", "comment": "Malware payload (Lazarus)", "value": "186f448b56678a3ca845bb204c2cf92a881af607", "object_relation": "sha1", "Tag": [ { "name": "BANKSHOT", "colour": "#B5341B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HiddenCobra", "colour": "#CFF9B9", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732612, "uuid": "ce6382f2-185d-412f-b0a0-c380a2d8f055", "comment": "Malware payload (Lazarus)", "value": "da02bc95f9ad279114da5f252113d8e0b0bc7adc74c0a7bf9a8c0bf9f4b220d871f6c7fdf05ecef57df23acbb3377977", "object_relation": "sha3-384", "Tag": [ { "name": "BANKSHOT", "colour": "#B5341B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "HiddenCobra", "colour": "#CFF9B9", "exportable": true, "hide_tag": false }, { "name": "Lazarus", "colour": "#77B51B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732612, "uuid": "231eed44-f7cb-4867-9802-a3072defe23f", "value": "T1D8F37C01F180C075D4BA243C16BD93A1297C7A301B955ACFB7E51E6A2FB81C1B73AE67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732612, "uuid": "8aeb2750-749e-4df8-907a-ac4f579143f8", "value": "f5fcb94000f27252fbd5a80e8c920956", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732612, "uuid": "57270e70-4b50-443c-8f5c-1b82bd8281f7", "value": "3072:Hi+55tjGsE4vj1WyICl5XLD9rhlszmHqCRciHaApJY:Hi8y61WyICJD9dJ6Apq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779732612, "uuid": "37ba60cf-0207-47e2-9e5a-36a189215887", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779732612, "uuid": "51a7709e-af97-465f-a2e9-cf884e9d5c98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732612, "uuid": "c84019a3-6318-4b38-a171-62900081b646", "value": "0a0bd696ec0d98b6dc7cb655ae58370d4d13f08b91a92eef52a0ed1efbb8577e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4652e8-584a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779721262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721262, "uuid": "d47d1091-cb4c-444e-88a9-2f7f36c211de", "comment": "Malware payload (Mirai)", "value": "b25c193611d2ad5d82fa8d9835ba3ad2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721262, "uuid": "edd75623-2e7d-471d-b446-42feb74fda66", "comment": "Malware payload (Mirai)", "value": "0a95c9749bc643d65035da39927e884c3d2613742bd7fd4c85d15393136eeb0c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721262, "uuid": "db09ec07-84b3-4e5f-bd92-3f49a37fba95", "comment": "Malware payload (Mirai)", "value": "252bedd8f3d5c4d08975d150611107fd7bbc8f7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721262, "uuid": "fd599c39-dff0-4d0f-a50c-0367ca4f3491", "comment": "Malware payload (Mirai)", "value": "b04e06e174892e3e5f124280e1b26af5cce1ab64b9974f0b911370596c46006e906db2db1827743c99ec3a0a9ad6a7c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779721262, "uuid": "d57207c4-c649-40b1-9941-ff0f2073907e", "value": "T18A34B81A3A12DFFBF56C863047F38A2056D976952AE09746F25CD71C1F2028E681FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779721262, "uuid": "f29f9f74-3244-4a50-bf34-b6f458e766d8", "value": "3072:GLDpksY1jwfEBqbTj+tSPhEpFwPsbFkx9DOsyfhxNNyAxYM9LkwZOvjO:4DjPomEIPsxkx4hxNNyAxYM9LkwZOvjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779721262, "uuid": "18c14123-01f9-4479-bc68-deba3af1b097", "value": 236096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779721262, "uuid": "f05f948b-6fb0-431b-a1e0-0a42770289d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779721262, "uuid": "d41f458a-0b80-467b-a950-d7a6c9d9975c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9dca87-5882-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779745318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745318, "uuid": "ea1af5cc-8e27-4bdc-b7ee-13d13cc19560", "comment": "Malware payload", "value": "2e59d8ee8c7971148dc7fba28cb4cb84", "object_relation": "md5", "Tag": [ { "name": "208-94-246-53", "colour": "#0DB514", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745318, "uuid": "60db1e27-d3e2-4d9c-b4fd-94ae83d6a4e5", "comment": "Malware payload", "value": "0b6a849a68a48f7301c3459a7771378e458e2d5debce9376be350784c61b72b7", "object_relation": "sha256", "Tag": [ { "name": "208-94-246-53", "colour": "#0DB514", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745318, "uuid": "d3ec36a0-df3b-47b9-bf5d-5f9079bf6c73", "comment": "Malware payload", "value": "8ff4d0124a6f95c026c42805964cca18c523444d", "object_relation": "sha1", "Tag": [ { "name": "208-94-246-53", "colour": "#0DB514", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745318, "uuid": "02ac3735-2454-45a8-87e6-45f6c7661c29", "comment": "Malware payload", "value": "b4294d0d3a60fcf5f42b7866711658c2b084c5694957c172b2a802d2b260130e8c19b6aaa865c83b3e6986fa5f1c9c4d", "object_relation": "sha3-384", "Tag": [ { "name": "208-94-246-53", "colour": "#0DB514", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745318, "uuid": "a43650c9-caa9-4c8e-af7b-c5a7e171b819", "value": "T1F55619263B2C7A2CC055D53D86AA4441D2FBBF8D4371CF8BCB22DE491F4BA15496BA1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745318, "uuid": "0450a216-ce66-4ed0-b3f4-1b40a4f1da6a", "value": "1af82a9ceedcad5813903fac7a668cd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745318, "uuid": "e10d5f7c-34fd-475c-9026-80dc6496283b", "value": "49152:VK5CV+gMIxoIxVSkLAQLA2HOx2+CX+ClCGIxSIxmDXiVVt:07CoCVSdvoCSC7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779745318, "uuid": "0b6af389-d5d0-4980-97d7-e23c55f35970", "value": 5889536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779745318, "uuid": "4ece808e-2cc8-465d-85e6-6f0e35451ed1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745318, "uuid": "8ada6c7c-fcaa-4c3d-bb40-81a641e9bb42", "value": "s_folder.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef28a4a-587f-11f1-a769-42010a9c0008", "comment": "Malware payload (GCleaner)", "timestamp": 1779743923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779743923, "uuid": "72220460-2b7d-4354-a0a4-ae39a60d6bf7", "comment": "Malware payload (GCleaner)", "value": "8b31b582577141b0c60979413e905897", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "EUONE", "colour": "#CC7E30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779743923, "uuid": "ac0fea9c-e853-49e7-8e31-a468d02d186c", "comment": "Malware payload (GCleaner)", "value": "0c9236cfdf676b4b62e409fbf08b7dd39905d641e54e4e66d3d705ec274be337", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "EUONE", "colour": "#CC7E30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779743923, "uuid": "9e029f8f-5207-4ef5-bd75-00eef28f4fe3", "comment": "Malware payload (GCleaner)", "value": "6cd7f8f1a25fc4903519ea74f0f528130eae6c91", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "EUONE", "colour": "#CC7E30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779743923, "uuid": "cae97f67-acd9-466c-984e-b4fbb7885ea5", "comment": "Malware payload (GCleaner)", "value": "59b47d08a60e4f65f868f53953622dbe0d0f6e89695c1196183c63c16c882bd07e4d30fa94ee3e8a85357ddc7979df79", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "EUONE", "colour": "#CC7E30", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779743923, "uuid": "c7497c80-1c17-44c2-9dfa-b804a35e15c0", "value": "T128357D23B2A1C833D472077C9D5BB6989C757E105D2CA44A7FE44F4C2E3EA913B252A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779743923, "uuid": "80fad566-ed80-4820-9522-1fe42a07daf9", "value": "c180e5dda1f3233433bcef8e535156f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779743923, "uuid": "3f50f8e3-8ea2-41bf-abaf-96d0fe750673", "value": "24576:mAsVsxTfXxOh9vgJGSkBSXvJXNWSvX39:RdhG9Wvpnvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779743923, "uuid": "b78c754a-192c-432d-a566-b0dd6e57b757", "value": 1111552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779743923, "uuid": "a7760c74-14b9-4508-af21-7a561a76f3e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779743923, "uuid": "56bd2830-d051-4488-8696-1d6bacbf60d5", "value": "setup_euone.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae704a31-5881-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779744942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744942, "uuid": "57104e3c-bbe6-40ba-abe2-a170fc9a72ae", "comment": "Malware payload", "value": "f351df6796ba968e79a8b66e76e3e1a7", "object_relation": "md5", "Tag": [ { "name": "208-94-246-53", "colour": "#0DB514", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744942, "uuid": "88d2edfb-dafa-40ca-b921-a0ece545adaf", "comment": "Malware payload", "value": "0c9e772d8730204dd850797827745a27bde599983d1ee070d0b61ea5faeaf535", "object_relation": "sha256", "Tag": [ { "name": "208-94-246-53", "colour": "#0DB514", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744942, "uuid": "d908f070-311f-4a26-a177-dc9a85b8889b", "comment": "Malware payload", "value": "48c301a649e49cc3022cef18f471f74e9fa3237f", "object_relation": "sha1", "Tag": [ { "name": "208-94-246-53", "colour": "#0DB514", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744942, "uuid": "9e1290e5-0700-446e-bc56-2ba0516149c4", "comment": "Malware payload", "value": "93d08724ec04565f90821844ceb38002453086edb2ee03c804469f33ee4f74c447ece330689ccc44b49beab9f1649e1a", "object_relation": "sha3-384", "Tag": [ { "name": "208-94-246-53", "colour": "#0DB514", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779744942, "uuid": "8ca48464-a212-46aa-a13b-a06ef358e869", "value": "T182D44F8F906444D1D47472F2C0A9BB4EAA29FFAB94D151DF2A527310FD3C4088DEA67B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779744942, "uuid": "e72cbc8a-49ef-4962-810b-1c64f08cf1cd", "value": "12288:mctr9atJqwa9FpetvoHCDPWMUkcc5TodNJ+HaFshjo352c43SkVi+ANdA6J4Z0jQ:mctr9atJ3a9FpetvoHCDPWMUkcc5Tod4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779744942, "uuid": "0831cc29-ab42-4f24-a687-bc852ce95a1b", "value": 647368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779744942, "uuid": "ea542fd3-0cf6-493c-a07b-4c7dec1831dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779744942, "uuid": "ffc0d7bb-12c3-4665-8c9d-4f4f5acf78ad", "value": "Bright.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "233186d5-57ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779679854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679854, "uuid": "846aa002-094d-4249-b7d4-1615ef2ca65e", "comment": "Malware payload (Phorpiex)", "value": "3744e711b324f9384b91a8d042ee0a1d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679854, "uuid": "c4f3b12a-d102-49bc-be67-36c39d01718b", "comment": "Malware payload (Phorpiex)", "value": "0d8748a987fb0daed81fab33fa2b1975ab58680b76c53710107feee63fee1379", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679854, "uuid": "5b8aef5a-fc88-41f1-8e4c-c39c4506be01", "comment": "Malware payload (Phorpiex)", "value": "847939891db38ddc4c0015d8fb348d22359163ca", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679854, "uuid": "91149062-c9e0-4d03-9744-14687961a64d", "comment": "Malware payload (Phorpiex)", "value": "c572de5ecd2d50e066faac9a6a36e2f0bdd7dd8f1d75c2a4adbaaf36dd4002d05ad9a9f7bced7a63ebffcecc676ae986", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679854, "uuid": "19cb69f5-9802-4a54-baa8-e8609a8e5f40", "value": "T1B6824B0FF9814216D1E110B05675863BDAB99C72338854EFF7D48A9D0BA86E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679854, "uuid": "443d4266-dd52-48a7-b5d9-be6804206806", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679854, "uuid": "b56b7e96-8251-4dd0-8c14-70173b73ea6f", "value": "384:6ZIJlVYeryskwAd0ZHu9JgiL7QWav8U9cK:7w0w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779679854, "uuid": "0254e8b3-08fe-470f-8c7f-7cdb4ac46d1c", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779679854, "uuid": "b1e0c980-ed9e-4d73-8f25-89ed3cc77af5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679854, "uuid": "7656a9d6-3570-497a-bfe6-f4f545b57023", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007213c8-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779746798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746798, "uuid": "53f0456f-77e5-445f-b712-0936e899e8e2", "comment": "Malware payload (Mirai)", "value": "f6822f84d4abdd31e6a84dcaa4ec819a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746798, "uuid": "f31a84b5-dc37-4aff-9ca2-b2eb855d8bd3", "comment": "Malware payload (Mirai)", "value": "10063977bad5661e71d92025c2e58a310319a74675b6df395a278013e1eeb72b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746798, "uuid": "37309fa7-97d2-4223-83c8-77a2ef3d98d8", "comment": "Malware payload (Mirai)", "value": "dc7bdb40a0fa09102b98d2cc7a5609e1a2890876", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746798, "uuid": "52474ebf-701a-487d-873d-f2932662beee", "comment": "Malware payload (Mirai)", "value": "b2f8faf9bf7789e94ca7fda415be3295055ae1e4a797db63354b3b01695382a88500a5e4e13eea24a754568fb828b9b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746798, "uuid": "82174399-c9c5-4cce-8132-16a4955c798a", "value": "T15364A62A7E12AF7FF568873007F38BB0879921D636E1D386E1ACC7181E7128D585E794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746798, "uuid": "8e0bec38-3399-4fb5-b9c1-26e16b4b402f", "value": "6144:JA931NOxjtRZwYBjQucCCVhumPDbmyuigRbm3o:G12wYG3CCVhumPDbmyuigRbm3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779746798, "uuid": "3a89790c-7950-4581-811e-628d9a703644", "value": 311677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779746798, "uuid": "896b685b-1df5-4c2f-8dc0-81bfe0b4fc87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746798, "uuid": "c0545f0d-c848-4c68-8245-9fd6cfdaa840", "value": "bot-64d64f06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2469ab3e-581b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779700902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700902, "uuid": "8a62e94b-52f1-4a01-be66-04076063c98e", "comment": "Malware payload", "value": "3f6d8cb54f6ccc7583fdce5db7d0f146", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700902, "uuid": "f3ee7561-312c-4c32-99a6-f3763292cc8c", "comment": "Malware payload", "value": "10fa1382874ca4d7cea9b87d2180fbe01b2d57275d230fbbd882bac04c8da3ad", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700902, "uuid": "fdf02a2b-2068-4c76-9f54-6372257fe9e6", "comment": "Malware payload", "value": "135c454193d00b605cf82e773ac135f064f56ccd", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700902, "uuid": "126b431a-aa92-4ebe-8f71-ec107dd993c0", "comment": "Malware payload", "value": "313cbe1d61d0ec104a0f850e17f71fcfa6e810f7551e62f997c81690c28dea565e60b1dd839d145aea29f9f1c967a1f2", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700902, "uuid": "37e4a57a-2470-4e52-afb2-ec0e5e9413e8", "value": "T15DA3BE2867D8CA5CE607C933305CC892E5B90707FA86B81F509062A25DDCDEBE7726F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700902, "uuid": "ed13353f-5cad-4805-8282-ccb1935794ca", "value": "1536:XvRKdajgAUWVHcjXoE+QYBxW7wL2iCsNOx9kufkwmTI3ctMSU:fR4a9JRBxawqTsNOx9s3s36U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779700902, "uuid": "30ee8632-2fd5-4d25-a147-651da92be835", "value": 103165, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779700902, "uuid": "bee6408a-0cd4-4446-9e08-6d3333825e23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700902, "uuid": "f2cfe3ce-4db4-4772-b157-2c6583d602ea", "value": "DONUT-SMP-DUPE-1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a6fb081-5819-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779700241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700241, "uuid": "0ff764f0-74bd-4a1b-8260-f8b147abc37a", "comment": "Malware payload (AgentTesla)", "value": "7a6e1f72127803df7ac870e1f95b95d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-cyberflor-co", "colour": "#EB825A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700241, "uuid": "6974228f-22fc-4073-99a4-be05dc0237ea", "comment": "Malware payload (AgentTesla)", "value": "110753d68aee76f03897dbf55014fe5f7af90fca0b0110ba4139ca6b4185ec2a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-cyberflor-co", "colour": "#EB825A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700241, "uuid": "3f2afa03-2a9e-431f-87a9-2ea6945170f6", "comment": "Malware payload (AgentTesla)", "value": "a859bb10a8826c53875eaf9c45594a4af5511ef1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-cyberflor-co", "colour": "#EB825A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700241, "uuid": "d0d20518-126d-4684-9b52-f1053b0adb89", "comment": "Malware payload (AgentTesla)", "value": "fb33e9c57cf0f96f47852492570cad37808a0322323d642064ea4116a5a9bc6ba22f0978f3fdd16b87d0ac12b3bca086", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-cyberflor-co", "colour": "#EB825A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700241, "uuid": "3ebb06cf-0985-4023-8cd9-2fe58b4066ce", "value": "T1A5340E037E88EB15E1A83E3B92EF6C2413B2B0C71633D20B6F49AF6614516525D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700241, "uuid": "eee2be86-c48d-4abc-81c2-c7e1f2fce8d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700241, "uuid": "86412a15-ded9-4b53-bbea-85edc3747135", "value": "3072:kCppimSVMrdtm6/d7Uz5t0i/bMqOub254Ssko2F:hppimSVMrPXd7UFN/oqOub9/k/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779700241, "uuid": "8791e632-6488-49bb-b96e-6db570ea539b", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779700241, "uuid": "a4eba96b-c4f2-41ac-8d50-9e3665ef8685", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700241, "uuid": "365fdc17-40a4-45f6-acda-8e44a6cfad73", "value": "110753d68aee76f03897dbf55014fe5f7af90fca0b0110ba4139ca6b4185ec2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f5edf9-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747396, "uuid": "6797849a-da05-462b-a6e9-f5dd160f4517", "comment": "Malware payload (Mirai)", "value": "7142e4abead8128e01586b58ea817d24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747396, "uuid": "1ff91538-be55-4bc9-b7e5-b33ff296dca7", "comment": "Malware payload (Mirai)", "value": "115a5319c81422a0402557a5c0f52b86915a380aa3a4b869647b4e55aa664a62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747396, "uuid": "9d315f96-2524-4e7c-8d0f-1ba01bb1cd03", "comment": "Malware payload (Mirai)", "value": "7e0964db2b66151983b1de48d5a32aa8d178a596", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747396, "uuid": "23996392-2b0d-40e1-a964-a8ce5381ee26", "comment": "Malware payload (Mirai)", "value": "098aac2739cc188b6129edc6f0097eb4f1d864c8d944dbc9226c47a3ea8bcb03082999bda33d8d3f97d4015870a0e3bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747396, "uuid": "75fad800-ecb6-4e16-8e36-6f2f8d031837", "value": "T1B3243A42EA408F13C0D717BAF6DF4245333397A593E7B306A924ABB43F8679E4E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747396, "uuid": "8920a40f-5208-4c22-866a-9d4c82971b75", "value": "6144:tvERpNp86wShWU3NmaDTsOZWuv7wKesxrkQ9M/RBGnwmH2WBLB5n:iRpNp86Z3NmaDTsOZWwMOyQG/enwmH1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747396, "uuid": "0718ff91-aa15-4423-80f1-f359c3b294b1", "value": 225035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747396, "uuid": "bbe3144d-333c-4b20-9096-00c1c382a143", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747396, "uuid": "6faa9398-462e-4d65-b559-d2329dcaa0ed", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30bd7630-57e1-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779676012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779676012, "uuid": "0bdaf37f-4e44-4b21-916c-68d9c4d5d810", "comment": "Malware payload (Phorpiex)", "value": "ef23e5166a9659932ca0e999fef51b3e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779676012, "uuid": "5705e607-b6c2-4e10-894e-05d329e964fb", "comment": "Malware payload (Phorpiex)", "value": "11b97d02085db9fa4e29718dc44944feff1076bbd65b45dc3a65907b8933aed3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779676012, "uuid": "4818f1e5-50fa-40dc-9200-b040f39b154b", "comment": "Malware payload (Phorpiex)", "value": "5adabdd8dba19152bf59c0f2077a9c92c663a343", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779676012, "uuid": "eafa220e-670a-47a2-b718-aa0cf7e4c3f2", "comment": "Malware payload (Phorpiex)", "value": "f754fa1407d69338cbfb373534571fe891e14fe3d7bcaa779d61a7293057222a6cf59f57dc4122d9a212dbdc767bb4ed", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779676012, "uuid": "1cce553b-d305-45a2-a21b-d9b81a6e9f74", "value": "T1A4824B0FF995421AD1E100705276867BDAB99C72338414EFFBD48A990BB86E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779676012, "uuid": "6864e6f0-56a8-4cff-b9c6-b7a62d1d8146", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779676012, "uuid": "e7e1a33e-207d-4fd9-be32-65fb4693e163", "value": "384:5nIJ1V4+bSsEwsNSZ5Hu9JgiG7gWav8U9cZ:eUUQ9Aa0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779676012, "uuid": "644d5a7c-8e43-4b74-b7af-4663e81386dd", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779676012, "uuid": "e85ec971-2ad5-4d8e-bec4-85deb46c7897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779676012, "uuid": "e215ce81-5216-4a05-bd66-c46eb72c691e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786c126c-5827-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779706197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706197, "uuid": "ded6eac9-5441-4b30-94ba-1480e731855f", "comment": "Malware payload", "value": "c72ae23dd3cd16fbf37797cea4d2c92d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706197, "uuid": "53be0364-2c57-4f0c-a448-95356337447e", "comment": "Malware payload", "value": "11df0219e24f141aa3361b9cde85fc8f5722b27bd45f2f7f6c1e8825fc158807", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706197, "uuid": "ca268bee-eee2-4317-b57b-d1eb9220d4e9", "comment": "Malware payload", "value": "c7a109758f7f49fedacb3686a8c9cbd0672d7dd3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706197, "uuid": "b6f5bd4d-6898-4600-8dc3-1a76a38ffb23", "comment": "Malware payload", "value": "cb6607c5930320ad5e2f16836405e23b3f80b39b3a2e26a9fa16ed810f40839a1d972bada9d4265d9c4ca649de5fb3e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706197, "uuid": "68d61414-6a09-49d6-a6e6-35ceb5d60f16", "value": "T105557D56F2B374BDC057C030839BDB62A835F47511322E7B6184DA392DA2EA41B1AF67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706197, "uuid": "5d9599e9-f71f-4792-8461-dda534000716", "value": "24576:beikjXPVpvznhrR0fcvYiuayF+UiAB9AOlu5:b5kr9pvznhd0fcvY2xU9AO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779706197, "uuid": "151c57e3-0812-44f9-8f8a-85d5cc8b98d1", "value": 1290288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779706197, "uuid": "d75d2f2e-af10-4676-b03a-ffcb467ab23e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706197, "uuid": "72eeb7b9-236d-493b-b4b2-1d937e6e3624", "value": "nig.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1dbd49-587e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779743755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779743755, "uuid": "856262c0-751a-4204-8021-3aa64c38c33d", "comment": "Malware payload", "value": "3d5c56b187e53cb1052db3bc3eb5f724", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779743755, "uuid": "ed50ad4d-2b12-401b-b95f-7c58b32889b6", "comment": "Malware payload", "value": "129ef9250b91767463dc5d219be2db7f389a5bb7e72dc2d41cbd9fdbeca20941", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779743755, "uuid": "675ae099-c95f-468e-8e13-933149277b91", "comment": "Malware payload", "value": "3e922febaf0fe5974663d1f4361d64c5fcfbc0c5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779743755, "uuid": "1955d5d6-33a0-466a-bced-98a2d51d838c", "comment": "Malware payload", "value": "bf253e1f27404cfb71bf98618d54d6a661401b25ef1501f415eb3ac14a1fd2c676c774dbfc50cc4fb9035fb57dabcfe9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779743755, "uuid": "d075870d-14a6-450b-a571-45d771e2a55b", "value": "T1E3E56C17D66F974E280D3B51006A5D9AFE89CAFCEF72BBC4E0CF90B614EA1100B455A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779743755, "uuid": "42635f46-efff-4bae-be91-5be73903e31e", "value": "49152:RnQ2zcPyEAMnAt6Xnr4rL1ZdS4D2xZ13h2CDBb83oB5tLfRHdkUW+NTdm:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779743755, "uuid": "8055830d-1380-4803-ac58-4d9239c556c7", "value": 3110767, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779743755, "uuid": "656873b1-ef2f-4a81-9fcd-3cd34db5589f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779743755, "uuid": "ebd7db03-022d-49d8-8f61-15c5519c42ed", "value": "Invio proforma.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "561620ec-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747371, "uuid": "b80852e7-fe94-4687-90b0-28da93efaf53", "comment": "Malware payload (Mirai)", "value": "8d9087c27793c644242db2189c0962ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747371, "uuid": "9f8c0040-24e1-413b-add5-2555a2601b35", "comment": "Malware payload (Mirai)", "value": "138bf86810d92a1a94c04d473c0c99c863915a4f457beda901a4c579641b53fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747371, "uuid": "fabe1aa1-d723-4dda-b6ca-dc4c111ac030", "comment": "Malware payload (Mirai)", "value": "e0e5718777176b457975ce91c404dce3dd03543b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747371, "uuid": "2748c8ba-614b-4a54-8b8e-a7be1fa56d0f", "comment": "Malware payload (Mirai)", "value": "9be8613ef1e03687a136437e26aa1046dff3f39bff1d1951aa74f408477238b504129db66e5172801358c4af854ce150", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747371, "uuid": "4c2bacd2-8e81-47c6-8b47-a89f09fb2c11", "value": "T14AA3F506BB650FF7DC6FCD3706A9070225CCA51B22B83B367674C928B50B65B4AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747371, "uuid": "f4c35b0e-298e-45bf-8077-3951362ac641", "value": "1536:LvGefaZSdtFP4/xl4ExO29zyN0ZNhdZp54crFCZeLs/h5J:LOefaZSdU59zm0Hr6eoJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747371, "uuid": "3aa685fc-f45d-4d31-86c1-848523e721be", "value": 97736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747371, "uuid": "f14263a5-8af1-451e-afc8-b614dd5b1deb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747371, "uuid": "46b663d3-f36f-40fb-a707-4227cab5756c", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc49afb-581d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779702018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779702018, "uuid": "a9be75c1-4edd-495a-b42e-b9f847e6c6b6", "comment": "Malware payload", "value": "6799a792d2300b35bfc489147492df29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779702018, "uuid": "83622241-52a8-40d5-a01a-f6d72f34b43a", "comment": "Malware payload", "value": "145f510530196c995cbf79bd7d778560c5e24fd2d15a73d17506e94a480b23bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779702018, "uuid": "bbf4dd5a-109d-49a7-b5c5-06e1f7844947", "comment": "Malware payload", "value": "4a23d48dee34fc58b0494b777f877205b77fa7f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779702018, "uuid": "9d3d61cd-c6e2-4d38-be42-fcee9e61d820", "comment": "Malware payload", "value": "1d615be315bc555cb82775997fcf2f46a2ee77811a5d2f9c02a41c3da4bc5cc7ed0fcf6bc50d107cdda094bf8c19a4e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779702018, "uuid": "80b18477-fef6-46e3-a2b8-65383f1651df", "value": "T19234D057B7E434F8D57B4278C8216A06E777B43607609BAF036083662F236E15D3EBA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779702018, "uuid": "725ca183-850f-4335-94f4-ee6ec6397dbe", "value": "3026ee54c6af015fafd94f2b564c4ba9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779702018, "uuid": "725e43ad-b7fa-4b4c-9aa9-5a53db1a8478", "value": "6144:k0WoKA+vzDrCzthMC0u6qe9+TYqqJzLBixFBheYc:XyzDr5qE+TYp5LBN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779702018, "uuid": "1245fcd1-7896-4a57-bc20-745c5bd1a383", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779702018, "uuid": "5fbf9421-8b45-4cc0-8840-7b898516ce4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779702018, "uuid": "31572f90-b0e6-4173-bdd9-820985abe9de", "value": "62.60.226_3.159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17a798f0-57ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779679835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679835, "uuid": "7a9a3799-4000-4232-a02b-cbae3afc2c6f", "comment": "Malware payload (Phorpiex)", "value": "e226ed83241ebe6d2dabd850a1c43b4e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679835, "uuid": "4094721d-9fa9-4535-b6ea-6061a4a95ef1", "comment": "Malware payload (Phorpiex)", "value": "1468a1401704b34473e56524b1a41e3dbfc1e60390480e34ec32d923d0e4838f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679835, "uuid": "aad4802d-bc6e-4ee1-9340-323366da7b6d", "comment": "Malware payload (Phorpiex)", "value": "dd88838d3de449c2704abef1bb79e3fb7208cc3c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679835, "uuid": "d22403a3-fe51-4f75-83ea-f90d7743a75e", "comment": "Malware payload (Phorpiex)", "value": "68e23e3264a55a0c5e350dfacac473ff8075e4bd0b8b9a27787826828b9613f824826d0d190a4a8e457874876ccd1a59", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679835, "uuid": "0d32a7d5-d2f8-4847-a75f-cc03c1efa6ed", "value": "T1E0824B0FB985421AD1E100705276867BDAB99C72338454EFFBD48A990BBC6E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679835, "uuid": "52fc5c80-cf94-439b-8f6f-53d895f9a390", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679835, "uuid": "6b143295-1396-463d-8fc2-728372a1bbb1", "value": "384:h+IJ1V4+bSsEwoNSZ5Hu9JgiL7gWav8U9c2:fIUQ91a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779679835, "uuid": "d3cab1d6-b01a-459b-92e4-4e5afa43f125", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779679835, "uuid": "d644ad45-c989-447c-a6b8-28494055422d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679835, "uuid": "7f8224f7-ffd3-4c86-a459-02ffc1daefb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867b788b-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747023, "uuid": "f20d327b-f9b2-4743-b150-8f5e7dd9e5cd", "comment": "Malware payload (Mirai)", "value": "87e6eae1f69e593e48383b52d11c0b62", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747023, "uuid": "98d49976-468f-4929-b529-6a63e8fa7fc6", "comment": "Malware payload (Mirai)", "value": "15065c53af8301a1094d1ed4d7f8ad049057e76d217bdca50d2ac114a2156567", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747023, "uuid": "9a1a417d-6e98-46b5-abf5-334d080a3902", "comment": "Malware payload (Mirai)", "value": "47efa24bbbbacb91c9c00022fa07f707fdf5a099", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747023, "uuid": "edbcabb9-11f8-46f7-83c3-72d561b73730", "comment": "Malware payload (Mirai)", "value": "d0a6d566646e6a77087b3dc486e2d56bf7fcf2bb2bea2e7966039abde50fd669691f9771367f0ae909932cde2954b65a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747023, "uuid": "4a31b2c3-7c9f-463a-91c1-fd907ede9dd0", "value": "T19234C61AAF610FFBD86FCD3302E90B0625CC641722A53B763674D928F54A54F5AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747023, "uuid": "212ced19-2692-46cf-98f3-850ce96b8fe9", "value": "1536:i9Ni8NuN7kvdlfQem1/9kIEGh9QS2ZB5f53RYuGMoiuB4GH3EWcZyMtMJqNB1J65:WLforkZGX3i24GJcIe99xdgXHSyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747023, "uuid": "8ba99e23-ef38-4ea1-9d3e-52685470279b", "value": 232536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747023, "uuid": "434f169f-360f-4d0c-ad43-561b9868849b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747023, "uuid": "ed975465-5482-4379-ab2c-224305252f42", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f7b644-5824-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779704877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704877, "uuid": "cd393737-8253-4ed4-82fa-7454ff2cfca9", "comment": "Malware payload", "value": "ff7a8da617e8492b4a95caffc82004b7", "object_relation": "md5", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704877, "uuid": "61da28a4-5657-4154-97df-b9f3226342ee", "comment": "Malware payload", "value": "166e853a84048f8dc3af89a8183966e3a9e1cd4c6a0c5a27fefdc7dac52acdd1", "object_relation": "sha256", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704877, "uuid": "3b1c0fc7-9409-437c-9d8e-90e0627f8e0d", "comment": "Malware payload", "value": "6319f75217fc7e5db0316add84c205759e2aed11", "object_relation": "sha1", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704877, "uuid": "21ae031f-efc1-4c7e-9627-d8ea48d0451b", "comment": "Malware payload", "value": "d17993fde4bb5ca47b0109b245325032daf38a416853d28292b8270b6c84352d6be01c536101e39ad00c0870eb2f4362", "object_relation": "sha3-384", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704877, "uuid": "86ff8929-18bd-457e-9a03-942bd235fc36", "value": "T1C3F7339C9287CA32CA4E61790950723AEFB97CFA4AE3A5D90D33BF3CE5352015631359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704877, "uuid": "b08dbfeb-0206-40cf-bd0b-5f8831d410f4", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704877, "uuid": "f0ac25f1-f8b0-45fb-83ea-0087814c0b4d", "value": "1572864:K81quE0Nr8d4Xxc+U0nU/oEknkxqhGr5IxSd85GjF:K81ZEI4mBc+NnQxeG9ke85mF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779704877, "uuid": "0fdd80db-bf2b-426c-8288-8d4d9b8cbed7", "value": 77109080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779704877, "uuid": "51379cc7-38b6-40fa-be5b-e4e20932a377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704877, "uuid": "cf50047f-efeb-4ca3-aa15-4b5cd6f7d3e9", "value": "Chat-GPT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb91fa3f-5881-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1779745045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745045, "uuid": "8d3c503f-2551-4e4d-b031-8f0dcfbfc7ba", "comment": "Malware payload (NetSupport)", "value": "99a5b14f92cd85e89ce8ff2061390caa", "object_relation": "md5", "Tag": [ { "name": "65-109-104-71", "colour": "#BBD6B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745045, "uuid": "8d27c3b3-3607-4e53-9f14-089db2d70799", "comment": "Malware payload (NetSupport)", "value": "177bfc846a77617931f7e6651a26df92511c7f60c0170001d67b982c09a677d1", "object_relation": "sha256", "Tag": [ { "name": "65-109-104-71", "colour": "#BBD6B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745045, "uuid": "f29b4e83-f40c-444b-9559-673aaefa54b3", "comment": "Malware payload (NetSupport)", "value": "7326e82d1fc1fcfa808189ad2dcb8b2b0686325e", "object_relation": "sha1", "Tag": [ { "name": "65-109-104-71", "colour": "#BBD6B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745045, "uuid": "f3004031-a220-4c5c-9ea3-f1bdcad95f9c", "comment": "Malware payload (NetSupport)", "value": "6564828ae9ce0d953925bf12f579932544dc7c25849b52267646d15dd9c878a3ae5cd1f47007ea7e588ec4803711e759", "object_relation": "sha3-384", "Tag": [ { "name": "65-109-104-71", "colour": "#BBD6B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745045, "uuid": "ac47e550-f296-408a-a71d-ee258c520a54", "value": "T1C716023BF28BA53EE06A1A3979B2D110583B7A6165164C1396ECF88CCF651701E3F787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745045, "uuid": "3379ecb1-03e5-49c0-a614-a5a5faedd029", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745045, "uuid": "ce79eb21-7c66-4c5b-9e9f-e3cea92b4db8", "value": "98304:R5OFzPwkh/JPLeoU+5YgywX/gL7kBO5WIw0XDR6Pktp:LOJhxZ5r1XI3kG9t6Pktp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779745045, "uuid": "704ff8c8-681c-45e1-bd42-59f9bbf4c49d", "value": 4117379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779745045, "uuid": "bfed932b-ce4b-4519-8ad2-0748d246596f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745045, "uuid": "844e97f7-d865-4c86-9555-98de39150591", "value": "IntelGraphicsHelper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7031912-5819-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1779700369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700369, "uuid": "784435b4-0157-4855-bce6-874c5fb0cfce", "comment": "Malware payload (SilentNet)", "value": "2305703c60d90240c89ad650c312fead", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700369, "uuid": "1c8af8c9-1702-4618-9e82-63ebe8a4de72", "comment": "Malware payload (SilentNet)", "value": "17e49ea6813743faf9398fff3b3ce8f3b688aff5ab2d142d5f9125f625a54e0f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700369, "uuid": "964470d8-6712-407b-9cf1-22867568267e", "comment": "Malware payload (SilentNet)", "value": "6867ee6f8d224d2ae69c9e0e7437813bfd1310c6", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700369, "uuid": "e4d934c5-0a32-42d1-b644-e0d8a4d99caf", "comment": "Malware payload (SilentNet)", "value": "7d9ebeff8f5f26469f7667a4edf7f23e03da23811ecb67757dd62f6f8a9a72c3f67757accee41f57d48c053515444245", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700369, "uuid": "7d0b0e3b-d295-4fe8-95c7-b60512a557d5", "value": "T19CD423E2B09F4934EB7D0774633917FBDFB144147964096C06EA29EA4E632ADF720398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700369, "uuid": "c6bec6ce-9759-4338-8774-87af11666eb2", "value": "12288:jUVIQ050IWWtuhkLMmU1FuK7S0Q3NKbLLVzulleTNRgNZ:jVQ0z5tuhkLBK7S0wKb/Vzu+TgNZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779700369, "uuid": "b841129b-8318-4fd9-86b1-53caaaf65ec5", "value": 638324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779700369, "uuid": "5a34bd98-a08f-479d-b335-abd88023d1a3", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700369, "uuid": "da3e2b03-eb4c-41fc-8b16-758b89c859ef", "value": "Dupe.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6151103-5827-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779706300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706300, "uuid": "a798d75f-93b1-4b7d-b6b0-33534f52c519", "comment": "Malware payload (CoinMiner)", "value": "e55f2d3a5aece2f2c6b7a20d0518ef94", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706300, "uuid": "95a2a7f1-4af0-400c-b4c9-1353758b643b", "comment": "Malware payload (CoinMiner)", "value": "18905f26968cceda8c5e765a88212c80c279f716a4c80620596a2779ca3425d8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706300, "uuid": "5541a85c-3204-46fa-9e2d-b8becde639c0", "comment": "Malware payload (CoinMiner)", "value": "15b3c41ba68f9d1aa473402464b704b133c9da21", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706300, "uuid": "63489c45-d8d0-4101-bf49-5efa4a39c19a", "comment": "Malware payload (CoinMiner)", "value": "aa39bf51dab4d8990570fbb708438237cf887a0b34faa9b98f74da7be164f7f2bab36234c7a219535ef3191443b85445", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706300, "uuid": "b2604697-4f52-4589-bb1b-3351ad8327db", "value": "T18A266D1BF2F294BCC19FC4340B9BC562AA7174B80635397B36C4AA312EB7D60576DB21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706300, "uuid": "d4426c45-5860-49f9-b7b0-a6ab5bd99828", "value": "98304:6I6GV9JUXTk9pTdnDBwq/LVsBBcx9nRs/8oZ:Lt5G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779706300, "uuid": "9bb02ec1-b5db-4a93-b7f0-4fbf7b173cc5", "value": 4458376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779706300, "uuid": "6be56480-3e02-48a4-8aad-fd336d79524e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706300, "uuid": "0de880cd-835a-4c9a-9ee5-65f7f1be1237", "value": "bluefix.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82c32d26-5894-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779753029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753029, "uuid": "3a51d459-673b-46f4-b278-e4f155389d3a", "comment": "Malware payload (Efimer)", "value": "0465faf127d2e6e75b4ff469361ad08a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753029, "uuid": "d2489e7f-97a6-4b91-89f9-66a6d86ec68a", "comment": "Malware payload (Efimer)", "value": "18f72e9a060900f7ff195794f00e7912cfaefc7e8eb47b2e7fcd81a99da853b3", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753029, "uuid": "b6d1f08b-9fc3-4144-9170-d0deb2272f70", "comment": "Malware payload (Efimer)", "value": "88f8623bfc650fe91ca03af08b1e5907f113ef3d", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753029, "uuid": "82803618-7f78-4c8c-a420-f8009aa2623d", "comment": "Malware payload (Efimer)", "value": "f88602bdc9a46c43301fb9d76861c0aff8a460d1346af808e99c464197406b589e51549c6685ee7d274d95b635bbaa91", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753029, "uuid": "42bce9fd-7c13-43ed-aeca-acfca407c1fd", "value": "T1E2D6331CE4EA24FDD7A7C038BBF116B0B079B1640A345D6A9BA8D372BC1B050DA2D45F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753029, "uuid": "6cbb8d83-fb7b-4a02-a3ca-ab6817878210", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753029, "uuid": "3880b806-fbd9-40a6-9d60-aa28453ebfea", "value": "393216:Yc7kL3kAAxYKes9YVOWH0t+hPXMCHWUjXicuI3/PGTAI:Yc7kIResELZXMb8XfH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779753029, "uuid": "1e37f5e9-7f4c-4793-86a5-812bbeccd731", "value": 13862342, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779753029, "uuid": "21d23ec4-ae18-4054-85b5-7cf6c79037d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753029, "uuid": "cc66f925-5cf7-462c-9776-a3cbebb9f393", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b47142c-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747380, "uuid": "959cd340-f532-49a2-9abb-8a8f9805e3f8", "comment": "Malware payload (Mirai)", "value": "9eb646b11bf6a6e018b478ffb61375ef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747380, "uuid": "dd93679c-9255-4af2-b493-32a4b7150a39", "comment": "Malware payload (Mirai)", "value": "1940e13e1a52b4586769b4b5f8c544bedfabdb1f28a159b6601a030cdf5de192", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747380, "uuid": "266bed2b-2213-4e43-afca-15c98947e5cb", "comment": "Malware payload (Mirai)", "value": "3d4668fc1599d6e4b8ec0e8382f833e8a6c9fd1a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747380, "uuid": "ca727961-fa17-4164-98d5-f46c8d59286a", "comment": "Malware payload (Mirai)", "value": "6d0e64be7711e01976cfcd54c50f543d34547db2b61bc8e564f1458e7f3a8e0d1ad6089dc4b59f9276a6799e7e145ae1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747380, "uuid": "c737c7a3-d964-4a8e-9474-39217884d4f3", "value": "T11E831895B8818B12D5D512BAFE1E118E3313177CE3DE73129D206F20778B96B0E7BA16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747380, "uuid": "e8ef5c53-db45-4cfb-861a-b59f360cf9c8", "value": "1536:ijna/CzPC7fG7TnmhsUrrar1FtQtMEig+wG3if7z7ueY52Y0s/hG:rwP0Mm+Urrar8+wG3if7zKeYw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747380, "uuid": "9f91eae0-e3f8-400a-abdb-3b9e3881204c", "value": 83572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747380, "uuid": "49c8362c-2d25-4e5b-b656-9bfb735e3d0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747380, "uuid": "50d5a2c5-58b7-48d2-b16c-09255422cbdb", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c389a87-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747408, "uuid": "8f8db595-bb98-4aee-a9db-36589cb73407", "comment": "Malware payload (Mirai)", "value": "867917c624122bc2f9e70f3e65c94700", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747408, "uuid": "9636b5d7-47d2-4e15-9d26-2cda1b417ad3", "comment": "Malware payload (Mirai)", "value": "1b3dbb6b415da9276a148973c2537939b6c68f5cf6448cde27bf5ea9534b7041", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747408, "uuid": "f9975518-b672-4eda-9962-5d980326d378", "comment": "Malware payload (Mirai)", "value": "756e88c822a21baabd54ce2ae05418cf6690954d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747408, "uuid": "07b0e9f9-bf1d-4bc5-9eea-1cbe9bb02a1d", "comment": "Malware payload (Mirai)", "value": "36e127e3054614434527b6d78aaf31c5af74bd927f1e022908779563fccc2d51b4f3c708990d4034dc2045daa3520125", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747408, "uuid": "e148cd62-c237-42f3-aa99-c82d36ba5f4a", "value": "T1B7C36CD5FA43D4F6DD5305B12037BB378F32D07A1125EA83E3B959229CB1A01D61ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747408, "uuid": "6d3e8104-b43b-4667-8fb6-88745249acc3", "value": "3072:7W2WA4KfsQDNSHjiz2FBOeF5Bts4ceGM5UQ30hAB1EN:Zr4KEKcHmz2F4eMeOQ3GN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747408, "uuid": "6500d829-427d-49ac-8481-27ad25f18702", "value": 123208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747408, "uuid": "f9274381-dfd0-481c-b5cf-a31a9a026cae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747408, "uuid": "c8fddd7f-5b5f-4948-804c-2f58e94d03f1", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1b0417-57ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779679868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679868, "uuid": "e763b668-a640-404a-94a4-79a6a89544be", "comment": "Malware payload (Phorpiex)", "value": "6d8de8d9bfee61cf984ab8d1cfd04b9b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679868, "uuid": "b9ab7870-d8e9-40d5-bbe9-f0eeff5e3969", "comment": "Malware payload (Phorpiex)", "value": "1b47eaa564ad3accec1b164f1613b6af675eb02c1217f8652b5e7863b64cbd12", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679868, "uuid": "e175e035-9fc7-4a8d-9bd9-238b47555a9b", "comment": "Malware payload (Phorpiex)", "value": "ac94f255b97a6697f09fb2e1281e03e78fe2b124", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679868, "uuid": "7e87aed9-daee-409a-b922-7f7b80032d52", "comment": "Malware payload (Phorpiex)", "value": "095d0e8d541cc58d6aa4e6eb94891825571a3f6d481ffa30b22aa5bb4a64e19957147b8f313ed9bab1cbd3f873336bc7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679868, "uuid": "eea00383-4d37-4a97-a7a5-6a3b2ba763de", "value": "T1A1824B0FB995421AD1E100705276867BDAB99C72338414EFFBD48A990BBC6E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679868, "uuid": "a460aa90-f1f1-4801-9e9b-6e3cbd49629c", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679868, "uuid": "4d4033d0-32f3-458a-986c-6b737449430e", "value": "384:fBIJ1V4+bSsEwsNSZ5Hu9JgiL7gWav8U9c8:iUUQ91a0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779679868, "uuid": "b911606e-727e-4e5e-816b-6054d83f6ec0", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779679868, "uuid": "763160e1-64b2-422a-9f6b-c16694de7093", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679868, "uuid": "fed4779a-d401-4d38-b929-7905a5082383", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc71ad2-584b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779721691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721691, "uuid": "fd547792-4836-446b-9ad6-6bcaec67caea", "comment": "Malware payload", "value": "847edb7717607e94fe6ae122850c6f02", "object_relation": "md5", "Tag": [ { "name": "central-da-logistica-com", "colour": "#EE2E31", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721691, "uuid": "0a981670-ab1c-49c7-803c-b0f46ad421b8", "comment": "Malware payload", "value": "1cb8233f4c68dd834487acf1df256b5967f89722f588d60fd90c345d91ae0a8e", "object_relation": "sha256", "Tag": [ { "name": "central-da-logistica-com", "colour": "#EE2E31", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721691, "uuid": "5ed679f2-6e45-4344-b998-5184d34b1f0d", "comment": "Malware payload", "value": "2e8a9bd5e6dde75a23a1a5e8be64c5afa036f83f", "object_relation": "sha1", "Tag": [ { "name": "central-da-logistica-com", "colour": "#EE2E31", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721691, "uuid": "d8f49b19-2d3b-406c-b5e2-5745840e0f2d", "comment": "Malware payload", "value": "c2ed3d9e45be61e47bd16085b07c265c6164926e00bd1ecffe4050f0d5be7780c9b30c3eb103ce2aa2a9220582b27e84", "object_relation": "sha3-384", "Tag": [ { "name": "central-da-logistica-com", "colour": "#EE2E31", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779721691, "uuid": "a9975a11-aa76-4a33-9de3-dde9d816d935", "value": "T1252168456A6383D97DB12A64C27D9106A0D68127A5D0FD54F7DCE002BF21653EF0A2F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779721691, "uuid": "3dde1a2d-fe3e-4b57-836f-5275ae81f6be", "value": "24:k42cLLhJwYgTjMTGqoLldp6XlH0RY5lTlqh9TAKUZFBKG4+cyUClESjLBKuYjxf3:k4lL7wbTzBMXva4ZPc7o9y8hNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779721691, "uuid": "777991d4-e5b1-4801-96b5-d9a351d7f4c2", "value": 1327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779721691, "uuid": "1dffe7c2-34a7-43a7-a89c-816dcfad2777", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779721691, "uuid": "2fa3ece3-2333-4a05-9275-ef898807b6e9", "value": "1cb8233f4c68dd834487acf1df256b5967f89722f588d60fd90c345d91ae0a8e.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921bdaba-5849-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779720843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779720843, "uuid": "4f93f22c-d761-4428-8ebe-f4655b3936ec", "comment": "Malware payload", "value": "c2da27b901d875dc086d7a036cf931b3", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779720843, "uuid": "7dc8fdd3-95ea-49e5-8fa9-8566940c3637", "comment": "Malware payload", "value": "1cbfb13e4e4b1cedacf4792fce485ef152251d8103ac922ec29001ced99f19fe", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779720843, "uuid": "370db2ef-2ee3-4b9b-9b19-f4c11831ae4a", "comment": "Malware payload", "value": "4a61168df5bbbb8d96f7c95a58f09a634c61faa0", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779720843, "uuid": "f78e7db0-a095-4ddd-a4a9-a8b1a7aa8293", "comment": "Malware payload", "value": "24303f616b474c35b54e33bc0bec5c9dd6982a04fb6c6230165cb731f2c3b2b5a13a4c61f8e5c789a224e98108be9385", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779720843, "uuid": "a36a3c5e-0ce5-4144-83e2-b1cf3e328977", "value": "T15E04390BF39390FCC066D17455E76632B632BC584230AAAA17D0FE313E75E21AA7DE15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779720843, "uuid": "69b8ffae-14b2-46ce-b1e9-021c9f0d39a8", "value": "0e6c6394746962246877a7641bda7640", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779720843, "uuid": "bb2eed0d-77fc-430d-a7e5-c93e1612ec7a", "value": "3072:6EvDyuGw1GS4cMXCLaoCgw4c6pIgkJgWUlu8Yyg265s3Gs/:66xGw1X4XXhjti5kallNZB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779720843, "uuid": "215ae8f6-5e7a-4bca-b1f9-b93e23e01276", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779720843, "uuid": "81296c8e-e3c3-4c6b-a7a6-9d69b69e22a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779720843, "uuid": "cbc0d038-abb2-436d-bbc7-df014df76ced", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26780705-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747291, "uuid": "2ae7431f-6482-4fd3-adf1-5494bc60b722", "comment": "Malware payload (Mirai)", "value": "8b70904cf5d0cb638fbdeea8b8e5af84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747291, "uuid": "9cd6daca-2421-48cd-87b9-012e3d623134", "comment": "Malware payload (Mirai)", "value": "1face8fa47baaa28eb4c70ffa3700df23c5e21a140949da4984778ca197b3893", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747291, "uuid": "d7bc15ce-854a-4d05-852e-75390d5d8ed8", "comment": "Malware payload (Mirai)", "value": "6f2c058576afd6da74be9af9afac7d0f64a6e334", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747291, "uuid": "96fe7e61-19cb-490e-8b48-3dbda1034bb8", "comment": "Malware payload (Mirai)", "value": "e493a167d2e84eee3da9300f1c06c14028378f1ac2f37b36a2f962431d177020466bba74567c5568e99d2c8aaebb9e98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747291, "uuid": "558dca69-00e2-403a-8d06-27c156e70b4d", "value": "T1F9E2F26A51ECB12CE45E903BC32FA98E31E65D11FE17C6A424C476DADF611F910B6833", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747291, "uuid": "7221e7d6-1e45-42ca-81a3-b56aa9405f67", "value": "768:g32bRAqg2gQzSPMjFY8AFOEPB6ZSq7xnwNQBUX:DbRAp2g4ECF+FvB6ZSonwN2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747291, "uuid": "df04393a-7a5f-4eae-b7f3-3607104f55b5", "value": 33900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747291, "uuid": "d1f06024-74cb-49b0-9908-d5e3348f845c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747291, "uuid": "cbac8e4c-6810-4ad1-8eb9-9413e53efa4e", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aef49a6-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747272, "uuid": "d51d8cc3-1753-4a8d-9feb-0b0ef8a29399", "comment": "Malware payload (Mirai)", "value": "2fa7b7e6f584ce545ef77d13b1b6ceb5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747272, "uuid": "724436fb-d534-45df-8b56-bb2e82681342", "comment": "Malware payload (Mirai)", "value": "22815bb629f201e64f7cd18db7a6e4f4824abc8da2f958d713f47a2ff177886d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747272, "uuid": "a801c64b-0fb5-4a4c-b7f1-a2644d8bbe9f", "comment": "Malware payload (Mirai)", "value": "650650af2045bd69f7b9c3b22f30ae2555964e86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747272, "uuid": "157f4c1f-85cd-4161-9d0d-541f0011ae42", "comment": "Malware payload (Mirai)", "value": "ca50896120a4abaffc00373c18a77ea9382ed2db8e3253b9551c8e84cb8a708fa0f952ab88c497d9faf84a6a822d5124", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747272, "uuid": "a2f88b71-c7b4-4c09-ae86-8e77074b7f81", "value": "T156F2F1B379523A60CEB68439DF684AC5BB0257ADE2F13736242C0168471CD9616BA58E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747272, "uuid": "598f6fab-fc9d-4cb4-b92b-d0de99cd334e", "value": "768:IZAb2jdTWDPtuRl/GZDmJaB6xLwiXCj0HZoZAhzLZFjN5F0p2s3Uozu:IZAKjBWDPtuTymQoo+Zvh5dN5Slzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747272, "uuid": "653513f1-94cd-4106-a687-0715429c7bb9", "value": 35508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747272, "uuid": "e4b22425-15bf-4a31-b269-26f25cc3ab09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747272, "uuid": "18ff46df-ac19-46bf-85a8-74deea67205b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3337cf32-57f4-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779684176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779684176, "uuid": "c3d97da9-105d-4d4e-b0fa-f5359cb42efe", "comment": "Malware payload (ValleyRAT)", "value": "e6b8a23f6b489af5bc61607586702d6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779684176, "uuid": "6aabb42c-f1e4-4b28-ad70-97e343242abc", "comment": "Malware payload (ValleyRAT)", "value": "22ade12878633414f83462f1a579225b1fd6e0afa43141758fbf23dce0aedd68", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779684176, "uuid": "03d657fe-0b32-4d30-94c2-36d935dfd5d0", "comment": "Malware payload (ValleyRAT)", "value": "8650ac3076a028028caada2b8aeb1061298d50db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779684176, "uuid": "0f7ca7cd-21da-42a8-bddf-ac334bef1d49", "comment": "Malware payload (ValleyRAT)", "value": "ef532a06ff1f5b8a1fbcda7c8e81b7a16730eb8201a958288069db9df7b6fce15545aee793c7f3a0da2b2e5a5a34e89a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.ct", "colour": "#043A7B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779684176, "uuid": "1008fbe4-e004-48ec-b44c-c5eb95587a24", "value": "T1F2B733E59BAC2E8BC06CB03E7DD4E12750D1C6AC6984CC9C2E1145AB49DEF85DF19CE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779684176, "uuid": "a26d4609-e680-49fe-b7b4-96acb5f4d5c8", "value": "a24e57cfb1e35030a9b4252bf1fa8b4b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779684176, "uuid": "724e6726-5a8d-4513-b61f-0b7f9972827b", "value": "786432:wX392l0pug/WQ4tjPRYCA8wH+3yBDtIrUb89rhV+BNEXO3H78r7eJEA6Ndg94Nsx:3l+ug/W1RKCA8w0yHiH9rCBNEe367exp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779684176, "uuid": "c76aa7fa-72ac-4010-9668-24980c8b7427", "value": 48873727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779684176, "uuid": "4f64a9fd-950f-45f5-abac-df5537dcf429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779684176, "uuid": "a55a4ec8-4dc3-420a-9bea-2c31061e186b", "value": "DingTsnsetup64x_0524.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdc241c-5892-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779752241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752241, "uuid": "a821077b-2cd1-481e-834e-1077e60da34b", "comment": "Malware payload", "value": "889b6f585da8eb5abd3aca50c43680f8", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ht-overpassheader-surf", "colour": "#AB553A", "exportable": true, "hide_tag": false }, { "name": "pw-9209", "colour": "#1FCA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752241, "uuid": "44f40f4e-24dd-4ec4-8138-5ce6c8bb6a19", "comment": "Malware payload", "value": "242e4daecc7542339f97a0f411866ff910233f4bcc7079d98b1b6c649bec5d72", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ht-overpassheader-surf", "colour": "#AB553A", "exportable": true, "hide_tag": false }, { "name": "pw-9209", "colour": "#1FCA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752241, "uuid": "92bcbb65-85e8-42ef-bc1d-a8058be0a1de", "comment": "Malware payload", "value": "43e2b31ff7aa21c21aefb3fc4bf69a09b9f84c43", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ht-overpassheader-surf", "colour": "#AB553A", "exportable": true, "hide_tag": false }, { "name": "pw-9209", "colour": "#1FCA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752241, "uuid": "915f63a9-f870-4880-91b5-5346dc3016c7", "comment": "Malware payload", "value": "394abe508aa0148140129b7dc9d63d02bec81a61e994bf04f95a970fe6f8e5a862aeff650d85b07e3cc7263a0444ed10", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "ht-overpassheader-surf", "colour": "#AB553A", "exportable": true, "hide_tag": false }, { "name": "pw-9209", "colour": "#1FCA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752241, "uuid": "1d08089b-b968-4cd4-9f2a-66f615677b7b", "value": "T1470733FFA2F2ED4770A9587D28592E4C35B6A54D6A31AFE00178CBF2C49F11A07F8542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752241, "uuid": "7f265b32-5582-4025-8176-64e2898a4099", "value": "393216:yEWnZ9VqsDs13n/VOB/F720/eWXfDch3afrzEts/+gRyS9gx5Lq6M:r0Z9VqsQnNc2Op7KKfXygvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779752241, "uuid": "99826991-e547-4ab1-900f-68c74d2b9f6c", "value": 18149491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779752241, "uuid": "59a2b80f-b7db-4a97-b54a-018bf820ac95", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752241, "uuid": "a1ede626-c7a6-49c5-a10f-23196f0efac4", "value": "cx-programmer 9.1 free download full.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "546285df-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747368, "uuid": "3f5b2c12-ecc6-4296-a8ac-2088ce89ec9c", "comment": "Malware payload (Mirai)", "value": "252abcbe9f4b0c219703b6002a2c8a77", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747368, "uuid": "852d0f3e-cc97-4c78-8b44-1c5c90e56414", "comment": "Malware payload (Mirai)", "value": "249bbf8943d03eaeb5e0d45d408cae733327d46d7e9c417ae8ddb8d12d515f74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747368, "uuid": "3fdb8d19-d0c7-489a-a979-7a85ba3891c5", "comment": "Malware payload (Mirai)", "value": "7a53f522f7a497771eb2ea30107d3c795ebed074", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747368, "uuid": "4d47da95-b903-46e5-85a1-291d96409ded", "comment": "Malware payload (Mirai)", "value": "7d10303ecea616d87ed9c6f4bfc79369861efa45567709f5f5d23ce58319f45c3c997c268582c5e84b12b78f22fecb6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747368, "uuid": "a1fbfe4c-a95e-40bf-9d8e-194ca09b923a", "value": "T1E0633B02B31C0E47D16359B02A3F27E183BFA99121F4F689651EDB869276E325186FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747368, "uuid": "719fc289-9d27-4a69-8b3a-a269a79854c8", "value": "1536:9yJWBrmSTKrFPTKGwITdHQ7+uLxWDeIQS5A16BH17Qs/nXB/:04OxPTKK1vDeIL5xrB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747368, "uuid": "34fb99cd-5b0b-431f-98c1-9e20f1527063", "value": 72700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747368, "uuid": "626cc054-ff65-4454-8499-588c1634911a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747368, "uuid": "b77afdd3-e45b-4580-803e-5a7e0e037047", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "566bc539-57de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779674786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779674786, "uuid": "4a5827b7-28f7-4405-9e8f-f8806b37ae5e", "comment": "Malware payload (Mirai)", "value": "cbc438b34ad1bd6361c1e8bf68d6ddd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779674786, "uuid": "4b8d5dda-d7f9-41bc-b73c-35e933b7b171", "comment": "Malware payload (Mirai)", "value": "2569762a61079a9c4ef5afaa49804788faae56c8ea3c26fc5eb16c2f482c3b91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779674786, "uuid": "c4cf55fd-5af3-4dff-93bb-bfe2d5421f51", "comment": "Malware payload (Mirai)", "value": "7728eae45184758f0cf8a32e110392d3ec40880e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779674786, "uuid": "27da0beb-5010-400d-a518-f6ba4bc9ee1d", "comment": "Malware payload (Mirai)", "value": "3b09f4a56c9e47f51a4430b5b5082deb44aa585b496f11ec16f643f6bca8600e3b4354ec17b3dbdd4ba86fc2c7a2e81d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779674786, "uuid": "b0007c1f-c950-4877-a168-b3ff47131bdb", "value": "T17F243B41F8818F16D5D012B9BD7D518E33132BBCE3DA72269D246F70778A87B0E3AA05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779674786, "uuid": "dd9fd039-a85a-43a1-80ad-3383da17d48e", "value": "3072:Zuqu2l4meHOUHh2WnRsvQlz9tmsOnxK9qpYmbAU0f3QFXukiMnaLpi7Nms4b+5EY:oWAoORK8unxK9+kToFXpiGaQH4b+5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779674786, "uuid": "07725783-3910-4a32-a503-cf956e9bd896", "value": 220572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779674786, "uuid": "ab5c7835-a26d-498b-8f6d-5d6b023a5314", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779674786, "uuid": "1779f240-e85d-400c-8abb-62ab3db1a18b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856e6c6c-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747021, "uuid": "0838cdd6-c3f4-45b8-8f3c-6e7ac1a9a41e", "comment": "Malware payload (Mirai)", "value": "7e705d202a0b17ef38abd109789d7593", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747021, "uuid": "2c0ddc53-45bd-4225-93cc-7461fafdf6a4", "comment": "Malware payload (Mirai)", "value": "262a9c1a91556fe0ee51da79d2e7f82098a30517b1f8b25ec99da163e80b1f95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747021, "uuid": "f0864d05-294f-49c9-b7f3-eb388f778e05", "comment": "Malware payload (Mirai)", "value": "8d7b974d627423805c8ee33a32fd4378d63ca930", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747021, "uuid": "ee30c098-2481-4ac1-ba04-de098c52582b", "comment": "Malware payload (Mirai)", "value": "29bc55bb15e19369e1256ae71ffdb4ea7a259c1289d5b3738aeb34a295a758d746afef44d5dc53e4d0c5c874016850cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747021, "uuid": "eb4a79d7-d176-463c-b43e-3bd393e36933", "value": "T130F31A45FC919B22C6D726B7FB4E428D372A1768D3EE3203D9255F20379A85B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747021, "uuid": "1046e27e-9416-4189-b2d9-2b6474bf255a", "value": "1536:BzVaCn0qEb40WOEkDGbWCMejeoRGZ/LKbAlyLPobBAD0ml1Tq7JV70xkiG4lOSHL:Bz0cHC4yB3rlkeApl1+370xwL9UQFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747021, "uuid": "8a915fdf-3a00-4837-879b-3fc93c329f5d", "value": 168640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747021, "uuid": "70f0327a-eb4f-4e0e-96e8-9ca1c1940caf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747021, "uuid": "5be02ee8-fd75-42c9-8719-62c7afde0459", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae75f7b0-5893-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779752673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752673, "uuid": "4756a48f-a9c3-44cc-9ab6-adfe271bc3be", "comment": "Malware payload", "value": "df0b2e93892baecc4182f9e327ed2078", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lopp-hitnoop-cc", "colour": "#6F6205", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752673, "uuid": "a0a202df-9d06-4b9e-8a1f-d65fbc6f7061", "comment": "Malware payload", "value": "26a1deb56681f33971280c33c5ca49d74b76faf2b3018e3c1d05d1835346e78f", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lopp-hitnoop-cc", "colour": "#6F6205", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752673, "uuid": "390b5d4f-c16d-493d-9c09-e905a27f7b72", "comment": "Malware payload", "value": "eb69bb4d2740be65f00deb186d0e66cff5523f9d", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lopp-hitnoop-cc", "colour": "#6F6205", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752673, "uuid": "f8a27a7d-0330-4302-aa8d-d96ffc7f8a52", "comment": "Malware payload", "value": "1684b3cc3fcedbbba53a2f7f7386a672159c2857f10268def3526f074751cec7cce9a62831bd6c1fcb837a0e46e2362f", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "lopp-hitnoop-cc", "colour": "#6F6205", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752673, "uuid": "a0ae461d-6ce7-4f13-a362-2aa8ef658bc5", "value": "T1F4D7336AE92C306BEDC44BFD01AA39DD12A339C848641A435F6F00B4F6B37597D77892", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752673, "uuid": "79e2b33c-719a-4274-95d4-2581c295a378", "value": "1572864:1uzGFsB+5tSNDSX7BDjGSSNDSX7BDjGbZrDvXHyiLQ:frBLB2SBLB29v7Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779752673, "uuid": "efd6d2e2-87a6-47fc-a2c8-3f55c3560d8d", "value": 58112597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779752673, "uuid": "4b7a61ed-973b-43d5-9646-dea6ccbd9e4b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752673, "uuid": "e3556f9c-8f51-44d9-b5d2-3996e54c63cd", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67801dce-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747400, "uuid": "8a607118-8188-47a6-9699-060713e622db", "comment": "Malware payload (Mirai)", "value": "eacc22217fa8960ca0896e3ed94ef16c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747400, "uuid": "44327d93-ee7c-4dd9-845f-a8fc29410e8b", "comment": "Malware payload (Mirai)", "value": "2925ebf52b313a83b5e3c8edd6472ab8d9a1cbfd83cb23bef76f457f886498f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747400, "uuid": "907ccfac-4a42-4030-a58f-5b860f085792", "comment": "Malware payload (Mirai)", "value": "8bb8c2a477d7cb9b43ca46ad097b10a9d7fd819c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747400, "uuid": "702369b4-4bad-422f-a479-334d611ceda6", "comment": "Malware payload (Mirai)", "value": "93fa21005872c686846a969dd7df49aa4c408002196cc935eeb0bbd19f13206f50646d953ac0c6b6717217719b767b56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747400, "uuid": "5e49bf0e-a399-461b-a51c-70d99cd2f812", "value": "T12B531A92FC424A2BC1D402B6B5BE5A8D376213F9D1CB7227DD614B407BC5A1F0D6AEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747400, "uuid": "7e8db04a-b1dd-428a-9c59-ff0b8c3e6453", "value": "1536:AkvvADrAJ9yAPw4+x60GgxDkRucdHHmo1IEwhg9y2IymQY2AUm6hh1Z/C/C:AooDrU9zo4lXC6hh1ZKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747400, "uuid": "4a8d071e-e853-4875-b5df-ee8f507de0a6", "value": 63820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747400, "uuid": "a4df21b3-25e6-4f9c-8096-7f6ad8f226a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747400, "uuid": "dd3228c2-3ab7-46b3-8e64-cc49b187f0e7", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e36c16-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747099, "uuid": "7adf444e-81cc-4c70-bdbb-99c49bd7d9ed", "comment": "Malware payload (Mirai)", "value": "518bc569bcb2a2d94db8257ae815a261", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747099, "uuid": "c3a32451-48b7-4a7e-bff7-0c69323f0c39", "comment": "Malware payload (Mirai)", "value": "293306a7bb754a92c28343184eb0d1ab587d10c50d56bacb47d0746d94c7c0bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747099, "uuid": "aaf7e6b4-80e7-40ea-8c5b-9d970a57f645", "comment": "Malware payload (Mirai)", "value": "c1193413aff0e34154839aafaa3820fd193e57e4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747099, "uuid": "cec752dd-2140-4d9b-9ef2-2a22e966a75c", "comment": "Malware payload (Mirai)", "value": "eb56295968d92b277b1f10c47772640588a2a57a1a5e97623775a03546d97efce6211f49deb3279bb864f0d7db99d8de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747099, "uuid": "02899a95-a10d-46ba-9a7a-c4f547ea4c03", "value": "T1B6B339C1B643D4F5EC1641302277F73B9A32F0791239DA97E7A49E327C92A51DD0A2AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747099, "uuid": "82986a03-b22d-470c-a0fe-5f43f976a90c", "value": "3072:tbcWYdCLFaGFhu3/45g1jcV2wwNS+AMFfp0:tbBYdoYGFh0/45g9iup0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747099, "uuid": "87998b8c-5f96-45f5-939d-ed5ee8d6308d", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747099, "uuid": "92849a16-bf17-469a-a1c9-572acd3f9135", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747099, "uuid": "5641cdc8-b85f-4ea8-b918-07c247bc5989", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6314bc4-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747103, "uuid": "de688544-cd0a-46d2-9b91-0deb696ee9df", "comment": "Malware payload (Mirai)", "value": "8e165abc15b5a393db6854bb4e30f32c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747103, "uuid": "35004e30-3e19-4113-8267-2b5278aaa0e6", "comment": "Malware payload (Mirai)", "value": "2a0edf14be486e422257b760d9ec81d475c23493920f0dc514980ecfd9669c27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747103, "uuid": "dddc5633-4e70-4a58-90e6-48a10d39d577", "comment": "Malware payload (Mirai)", "value": "4fd513f80805490d9496e84d79179d09472b09eb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747103, "uuid": "8c25c67c-fe7d-4ed2-9013-1adabdb3b5b3", "comment": "Malware payload (Mirai)", "value": "97a4edf0c4daf5e77d9dbcd56c729b92ca0f0392c64da3ed2534cf631f473ab1ef81c7679fbcfb017d5ca3b4426bbde2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747103, "uuid": "421f1fe2-1075-4e46-8261-ed6264cb440e", "value": "T1F8343C45EA414A13C4D117BAF9AF428A3332A795D3DB7306D9246FB43B837AF0D67602", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747103, "uuid": "d47db007-634e-46ec-827d-4e052c3f6f43", "value": "6144:yjCiZsR36LScaFskxWjKwRe9kCgbMiMM/9oUexT:yDa32ScaFskxWjBYlCN/Czd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747103, "uuid": "1e9ef9e3-dc5f-4f5e-b843-dc65cf56dd03", "value": 230868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747103, "uuid": "9c1766f7-6100-4991-a91f-6c03f00aa5dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747103, "uuid": "3d0f621e-edc9-4cb6-83fb-a4ae16852e97", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b015aa-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747295, "uuid": "f7695242-dcb0-45e8-8cd1-12bf9fd405bd", "comment": "Malware payload (Mirai)", "value": "88982c2121146e57d2d4600cb7179dcf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747295, "uuid": "ac5621db-87e1-469b-88ec-7ea4c233e640", "comment": "Malware payload (Mirai)", "value": "2adf135e52d92a7cf37438af511c5d495557566e3c71f9850254a981177880c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747295, "uuid": "0aaf21d6-2049-4867-bc31-d990d485282b", "comment": "Malware payload (Mirai)", "value": "efd9a6336a2c0f30682edc4efeb5e09359484f82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747295, "uuid": "711a7c72-e2b5-4797-bc07-8730508c09e2", "comment": "Malware payload (Mirai)", "value": "016caa271cd10ffa654374e22d1fe42ce432ea8c45e61e2e87e86955676d0f5f4a4be5efc84a74275ccd91e88b5efeab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747295, "uuid": "055b9c99-6211-4ce2-a03e-c4098fdd5778", "value": "T1A3E39FB3F30B1091C82306F417CB6B9C2E2315425F6B86D3BCAA313A2A765DE5915BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747295, "uuid": "f7681b0e-ca94-469e-8f8c-b03fc0b0ea9d", "value": "3072:X/1HeTDitCaG9y+y0+Xk+cdLfSFztgQg5CvugQt5SPub01yBq:P0mGvy/aKFztgjCvattBq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747295, "uuid": "551a8807-7dc3-4639-bca7-da2e1a173276", "value": 157136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747295, "uuid": "d315d7f1-30b0-4881-9d06-bab123613a5c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747295, "uuid": "c6a01ab8-cde6-4e0a-a090-c99dd6d2b107", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec110514-5863-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779732161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732161, "uuid": "e2b64bad-d26d-45f3-b686-4d552a95f95d", "comment": "Malware payload", "value": "9bc2e4c35aa3d281545ccc8b754c3923", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732161, "uuid": "2000762c-6cf0-4dea-8dd2-b15ca25be680", "comment": "Malware payload", "value": "2c253d8131cf8a948115884467aeeba28f43a85a289b730b5e490fb59ad4c921", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732161, "uuid": "23a20f07-92c8-4656-9492-5284711511e3", "comment": "Malware payload", "value": "3abe7ceb20cbf16dd7c9c64d7139d7ee53653264", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732161, "uuid": "e3b1a239-4c8c-4942-b77a-87f5ef59b27c", "comment": "Malware payload", "value": "737e86be62c7151e3949a95d374df166d7936c058aa176d74996111862a7592a3e7d316bca1784bd969f11b049388ceb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732161, "uuid": "3c5a7afb-5986-4536-950d-3f3de1428dd6", "value": "T108E76C42ED9705F7EF4669B2C69A560F23384C44B7A5DAC7D6217B26FC621C21A3F302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732161, "uuid": "0af59116-b193-4618-ba89-f79bb7269c6d", "value": "dc0052bfb9ce9d93ac0bcb08af60c744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732161, "uuid": "7a0be954-4969-4efa-9237-5941f22f2de0", "value": "393216:adnGfwLLVudiRN5/ZyGZSGV4CDt2rAr2VGfgjGHCHPHDspHYKW16Gy7Jhm:QVdRNGGZWr3KCHPHDwYKW16Gy7Jhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779732161, "uuid": "6f67cda6-f8d9-4736-ba55-d80b6870278b", "value": 68127944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779732161, "uuid": "605341df-a37d-4504-88bb-d88cb8656ac2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732161, "uuid": "7d4d84fd-0627-4990-ac40-c70ae630cee3", "value": "client.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cddb9b-57df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779675326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779675326, "uuid": "511773dd-e47d-48c6-a935-390e5642c8ee", "comment": "Malware payload (Mirai)", "value": "a88d1e0057c67548702bbabd03d88eda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779675326, "uuid": "aa1b42f6-0855-4699-8f92-253d711b9f64", "comment": "Malware payload (Mirai)", "value": "2d795b1737ff06a1401f2fb2459299a6b46b2fbb38ebf635d85707229e034246", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779675326, "uuid": "c30e153c-35ca-46b0-bfcf-7b1c9a3d6775", "comment": "Malware payload (Mirai)", "value": "d11d4840f1ded225177580f3043c126a728c950e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779675326, "uuid": "1e303948-2806-41f1-a157-f47e94fe5316", "comment": "Malware payload (Mirai)", "value": "0258ce4f11365904961830bc378519fcb583365c71c16899b4e886996b96fd13989450974745ea5afe5288cd71ae9f05", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779675326, "uuid": "c09c83a9-f6fb-4431-bb16-7e6ed64da52f", "value": "T12A931986BCC1C612C5E1A1B2FB1F91CD371643A8E3E67107DD19AF29674B8A70E3B251", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779675326, "uuid": "54f5f1ab-1479-40fd-9bf0-5701c8a26c74", "value": "1536:X+0hMsdERtCvjvq9BLABeuTGrVtdKWkFTui7QxKbtvPV:X+0rmtqjSbxuTAVtiui0K1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779675326, "uuid": "cae9cb47-6910-49a0-af57-527373bc891d", "value": 96036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779675326, "uuid": "fbb2a928-f756-4fe3-a5be-3a1615983eb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779675326, "uuid": "161fede5-2391-4229-97d5-22420ae4f19b", "value": "jklarm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a6ef9e-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747100, "uuid": "9129f391-e0de-489d-9440-2d5d8e517625", "comment": "Malware payload (Mirai)", "value": "bd43410687d22f07d443640f22595b72", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747100, "uuid": "bc463dd9-d031-41b1-810d-5e544bb59e0a", "comment": "Malware payload (Mirai)", "value": "2f54a837c2d1b1daf5b44fab9f527b4b04c6ad394aa6213d79ef8add6f572bc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747100, "uuid": "375564db-9e42-44fe-ac99-361cb36b70a7", "comment": "Malware payload (Mirai)", "value": "edf04d279c187ae6956b83d049afc36c88590e98", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747100, "uuid": "4ee8e0df-50ee-40c3-92e6-05d0ce832b43", "comment": "Malware payload (Mirai)", "value": "621ae745be8f98fa8cf5de9d50fc3104188c815afb3a870bd39b3a6b8882c32d00a9c37921588adac1d65b258b9e4aa9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747100, "uuid": "d6f1a9be-7d34-4a9f-83a0-50cc5e938fe4", "value": "T10DE34D86F802DE7EFC0BD57E44670E19FA30A7613243172E569BFDA3AC321651D16E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747100, "uuid": "ab11d398-bcf3-4590-9a25-e58c05a213d3", "value": "3072:3owRJaJQMUmfh6VETA7gSsusWdjpMMXqrTCuji:10QMUmfUGSBRpMMGCuji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747100, "uuid": "4c9ccb00-fc64-47f5-9b43-f1002372f3ad", "value": 146888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747100, "uuid": "b2ce0d1e-554a-45d4-86a5-c0e56b7aeb60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747100, "uuid": "8edd7b95-f497-447b-8edb-9e817c4007b1", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5222895-57e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779678032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678032, "uuid": "96ed1587-1844-41c1-a5b0-186475088ea4", "comment": "Malware payload (Mirai)", "value": "3a6c04e1d7337e5893a7f68888ca8b08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678032, "uuid": "2eefe146-bc78-4817-922d-44e27e7768d8", "comment": "Malware payload (Mirai)", "value": "2f579fdce3cc0460424f92d3a42873078cd9ea1905f2bb77870e0aaf31a329c8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678032, "uuid": "55490330-187d-46e3-ae21-71316a9b03ad", "comment": "Malware payload (Mirai)", "value": "a6d93384fe9a1e3d5dad744583e5d4864a55ea23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678032, "uuid": "a4a6749d-ee4f-4cd2-96fa-c103b5a148ed", "comment": "Malware payload (Mirai)", "value": "7bce33905bbab2a73a0d37db3b91bd6f7fe104a1e27708318e08fdb52daed634e6f8e763439f4e389d92abe22a2e9c0f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678032, "uuid": "16f7cc3d-0d61-434e-83e4-45f7ca549510", "value": "T1D0049D62E829AF98C264C174B5F1EE781B53E690424B5FBF28B3C2754043D89F605BF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678032, "uuid": "2c95ecf3-42be-4338-9996-304934e17b2b", "value": "3072:viKM6cMPEQb4itXU5Q151kKQ/tlefwzozWpJgaVcHnx:xMdMPEQb/tXUuGKQ/C1ipq2cR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779678032, "uuid": "57948e35-09a9-4573-a567-26341589b5b7", "value": 178980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779678032, "uuid": "915db3d0-d1d2-449c-9e0d-5dfa72b89704", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678032, "uuid": "c59eedc4-f760-4736-b99b-a22c5c37d7c1", "value": "nuclear.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9b8d75-5870-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779737529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737529, "uuid": "9acf23b5-1326-4e58-8d82-f3b59739fc6f", "comment": "Malware payload (Mirai)", "value": "58e592d26bc56aa1aa633bb212ca6080", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737529, "uuid": "f743aa1c-f595-414d-8142-5e294c38e455", "comment": "Malware payload (Mirai)", "value": "312f3d83585828bcf530bdb7c4920e0a19d1676792b6c6cda1840a2edb81f26c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737529, "uuid": "1c2dfd3b-5791-457a-a53f-d387ac596adf", "comment": "Malware payload (Mirai)", "value": "964d625da5bb7500f09ef890f9ffa9c5d5cc8801", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737529, "uuid": "ffe196a1-06af-45c6-8bd0-27bbc2e86ea5", "comment": "Malware payload (Mirai)", "value": "8cf956778829e1320a08ef2aa09c20630825e8c8d42e3ebc6c803313bbc2b7993e00f0d37b0952387e313dac8ad1c621", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737529, "uuid": "6b6e1af0-7117-40f6-a9d6-f9788af63837", "value": "T1ED6619177B28EB0EE114323448F2DA946B292C9641D69927B391F318F9F30AD5D6EDF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737529, "uuid": "4b788d81-9ede-4a94-8187-c9042cbdec00", "value": "49152:1nWeerVDJtlUF/ZiY91h6ebGimWHBeOEWgEf2QcUcdbyZmopiA+ro+02em9yhSfg:AKgKdUmn4jEku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779737529, "uuid": "9b850632-2ff6-4b82-bfc3-b086294af86d", "value": 6750401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779737529, "uuid": "5dc44a0c-296b-4280-a99f-4e3d538881da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737529, "uuid": "a6d68f67-9214-4f4b-ab8a-4b0e77c14e88", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeffd9d6-57d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779669888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779669888, "uuid": "d5f04a26-cf68-405e-9174-deb50836cbbd", "comment": "Malware payload (Mirai)", "value": "028eba1900341ede3b8d5307999431c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779669888, "uuid": "a79ee8b5-b488-42f8-b5b8-693bb0f1c8e4", "comment": "Malware payload (Mirai)", "value": "31980faf1134363b5c628481581088492c7e7496df4d6ea1c2f1025757c5cee8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779669888, "uuid": "75d5c44a-ef2e-4cec-8c72-39add1594637", "comment": "Malware payload (Mirai)", "value": "0cd2fbfe8922228ded7d28560a568d802d212999", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779669888, "uuid": "a0459165-cfe7-4399-a2df-6bbeee56b65e", "comment": "Malware payload (Mirai)", "value": "5e4604e166dec2ebfe150fad0bcf0d37964e1269d2f04a2d0eae1525ab412cb9733302aa7e07b20f492ad69e4eba6a7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779669888, "uuid": "cb33c650-5af7-4f6e-b2ec-33a13b02b8d0", "value": "T1AD243B41FD805E53C6D216BAFBBD818D372B17F8D3EA31179D216F60368A42B0E76A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779669888, "uuid": "0dcee2b2-2467-416a-b624-e79a69ce2670", "value": "3072:ldjZ007P4tgeF3gNYxW2zdM9xMhKSdFdGr4X9BuoKS8trAGlFx:ldjf72geFu2+TMhZb64X7uhttrAG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779669888, "uuid": "aa008048-41a3-4ba3-99e7-794a8f877119", "value": 211680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779669888, "uuid": "37a49d53-111a-45b0-a023-a9d7559e37aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779669888, "uuid": "9edef833-b61f-4217-9b96-426ae658bdd0", "value": "nuclear.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbfc3fd1-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747112, "uuid": "ad6c02d3-cfe0-4a77-89c5-acae09f675ae", "comment": "Malware payload (Mirai)", "value": "716e4aa0dec2dab6598462a9224a14cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747112, "uuid": "9fc2bf34-086b-4208-9db3-beea983c69b8", "comment": "Malware payload (Mirai)", "value": "32b300c7514109c9cd53aa808498904052ed87e8874ae11e6fe4fe625043c1c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747112, "uuid": "17ac91e6-73ff-438d-9ad1-6bfb6b00ecbc", "comment": "Malware payload (Mirai)", "value": "e51ea8f4311bf6921e4100010bf9d5ed0c6e6747", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747112, "uuid": "703e18be-6525-413d-8aae-71a97a758205", "comment": "Malware payload (Mirai)", "value": "63ea9dda2978028e4a8fbbc58cdde5a6f0a62d4c29de57270186659ed3ace030341e8fb4495897f31ff81198bdc75f60", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747112, "uuid": "88c1a1bc-a0e6-47e4-8b53-9cfabcd6a626", "value": "T151C3AE36D42A79C4C0914534F4F09E751BB1A1C44257AEBB2AD9D5B900C3DA8FA0EFFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747112, "uuid": "b143dd0c-8bc6-42dc-a410-11a1c9c27ff2", "value": "3072:wwYYZdqZqMYn8wUjqbbD3Pr9pvlEkYMEW:wEZaTw93Prb6MEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747112, "uuid": "ad75be74-2079-4280-a1ee-ff5382687be3", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747112, "uuid": "4f06fcca-d703-4cb9-9d27-f53292f36393", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747112, "uuid": "c439509b-8dfe-48af-8e50-e74c0f9b49b7", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0122a8d-583c-11f1-a769-42010a9c0008", "comment": "Malware payload (GoStealer)", "timestamp": 1779715310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779715310, "uuid": "9f3e1208-8d1f-4449-9e73-7bb7cf274f2d", "comment": "Malware payload (GoStealer)", "value": "6bb1c3eb6b17735744079536f57cf98d", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779715310, "uuid": "b4a14665-e08b-4d4d-85bf-ca8020b401ad", "comment": "Malware payload (GoStealer)", "value": "335dabe699c9546e422cf0b39834cf62ef3edfccf1818a8407932db61fb0c0e1", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779715310, "uuid": "20a6476f-1df5-4bf8-af14-0946abe25221", "comment": "Malware payload (GoStealer)", "value": "b5b21d341b2de93db9335dabee3cabdf6cc95d4a", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779715310, "uuid": "892837b2-d6ba-4278-8252-ec3573eafe2e", "comment": "Malware payload (GoStealer)", "value": "e78f3fef01ccf025cde09328c97b6047222a10f817699bc3739a183cc52c1377233798ef0f3ad31d9b38c16db3ebef37", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779715310, "uuid": "8bbac92b-65c3-44f4-8dbc-bed7e86297b0", "value": "T1F8956A0ABCD508E6C0AA63368DB762827BB1BC490F3223D72E90B6782F736D55D75750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779715310, "uuid": "7082bc6a-7392-4bfb-8ab0-2bd84b900a3c", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779715310, "uuid": "2dae5e59-fd35-43ad-a297-0f969be0209d", "value": "24576:6YDSuJkc9ZbLv1QfnLpH9KRPBquM7VbcsvDqAv2rMtPV5lj7h:6YDx6c9ZbLvynrKBBVM7Vos7qA+r25/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779715310, "uuid": "b866ce3e-8d2c-4f7a-8efa-cb654d9af715", "value": 1993856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779715310, "uuid": "beafdb28-919d-4a10-a4b8-335083bc8169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779715310, "uuid": "12488309-c319-4f36-a93a-e4281590eb67", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10898c88-5883-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779745536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745536, "uuid": "c30e15e1-f34e-4486-9dfe-868a90ff7882", "comment": "Malware payload", "value": "4ffab9f6b123144aa62e4a6938b67f20", "object_relation": "md5", "Tag": [ { "name": "208-94-246-53", "colour": "#0DB514", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745536, "uuid": "91146172-7895-4cb8-969a-e4cbed7c56db", "comment": "Malware payload", "value": "341165a42115d7aec4fbff23f6ada1273fd55902721a005ac4b88575baa97a4a", "object_relation": "sha256", "Tag": [ { "name": "208-94-246-53", "colour": "#0DB514", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745536, "uuid": "4adac790-badb-4530-adaa-aca249e15e2f", "comment": "Malware payload", "value": "52349b520af76a83613df5c8305df6b47c8e2dc5", "object_relation": "sha1", "Tag": [ { "name": "208-94-246-53", "colour": "#0DB514", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745536, "uuid": "9292a9a2-83e4-4fc1-a392-c93f9fb30f51", "comment": "Malware payload", "value": "2c6045119bac2a5bf90e2de49d933a1954162e4a89cf7f2e78cd5872d8adf31ea2b4f96d112cbd8c2fca4b35a2e1a13e", "object_relation": "sha3-384", "Tag": [ { "name": "208-94-246-53", "colour": "#0DB514", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745536, "uuid": "78e4abf0-c84d-4b6b-824a-ed1cf9af869e", "value": "T1DCD4218E40E514D5D475EEF2A039BBCE5A26AC9D10B159CF2A9E3730F93940B8C27736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745536, "uuid": "75ae3771-ad7b-4c99-af5a-70936e798438", "value": "12288:17f+Ckfv8pOkxyUSMT9aSp1BnyWli8wdfQ4AWiW1Ipx+lPwDUDLDamTsYVpP3anr:17f+Ckfv8pOkxyUSMT9aSp1BnyWli8wq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779745536, "uuid": "db863719-b4d1-4cfe-b978-440e00810ba7", "value": 603912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779745536, "uuid": "64a496af-dc79-4900-b634-79290fb4bff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745536, "uuid": "558c47fd-c494-4dfc-aaa8-409b318ea8f7", "value": "WaBi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04469f6c-57eb-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779680232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779680232, "uuid": "9d48f1f8-6cb2-4ff4-8b57-24bb84025e9e", "comment": "Malware payload (CoinMiner)", "value": "edcea2441d814e82d2fcaf7e681864d3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779680232, "uuid": "8e734528-773a-4f0c-9ca5-00b8000ef722", "comment": "Malware payload (CoinMiner)", "value": "346ffdd37a74f5ff26a5b8ab2c3b2b497fd887cc525031b510fdc319093b67d8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779680232, "uuid": "ecbe5058-c1d4-4f1d-89a8-8a609db01d88", "comment": "Malware payload (CoinMiner)", "value": "7d30cfa8595145100a873d416a1df0b1aac3db10", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779680232, "uuid": "f7d7f092-c446-4e66-8b54-2a6f3f0e4b02", "comment": "Malware payload (CoinMiner)", "value": "408b665efd5fd8feac57d42983a8cda0e737cf61c307bbab772187d1898b297ce149126dc4f5f870f3ddc48543fa76d7", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779680232, "uuid": "e28ed629-2b8e-4b2c-a684-550820717801", "value": "T10322E6297E850331E3A449B854798347653D2263F783E3EFF773968E19A63498840D6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779680232, "uuid": "33d2c007-28a4-4105-bdaf-28d0cb6cecb7", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779680232, "uuid": "a654f2e9-0546-43c9-b74e-b97852e41e76", "value": "192:m0UoFryMB9tZx+ef6ptPFJxTEZmFhSu0GFf:mToly4wJptPFwZUFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779680232, "uuid": "d03bcd92-7689-4cf2-9889-4041d73a5cb7", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779680232, "uuid": "372f98b0-044a-4bb0-84e6-f025ce093b77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779680232, "uuid": "2e74a929-9818-4e34-9da2-5034bae17424", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19db32b1-57ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779679839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679839, "uuid": "49dbbeaa-08c1-480c-936c-78a361be6d46", "comment": "Malware payload (Phorpiex)", "value": "58486b85455e9aca9f812c1cf14430f3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679839, "uuid": "e1406a29-87cc-4ffb-8dc3-4d823b22e16e", "comment": "Malware payload (Phorpiex)", "value": "3492c560c1e3a88976a6a79d949741a7958e6662b58a0f3a09d3e1537b37f568", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679839, "uuid": "1c366425-0a11-4f97-a554-289c189bd590", "comment": "Malware payload (Phorpiex)", "value": "82cb16c753db1f37c8fa44c1d9bc391ef4b97e07", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679839, "uuid": "c8e0b41e-1804-431d-88e0-30af694aa628", "comment": "Malware payload (Phorpiex)", "value": "51ceacbd01534de1808ea32442d67ac8aa22bd9fe3736113bdf79c3d60f839145f5e41b41c6d3d8a2d940bfeaab44ab7", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679839, "uuid": "dc1c0668-d424-4955-97bd-e614bac1e1ef", "value": "T15E824B0FF9914216D1E110B05675863BDAB99C72338454EFF7D48A9D0BA86E6FC3211F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679839, "uuid": "943ca031-b607-470e-b0be-936988a41ca2", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679839, "uuid": "be599b41-636b-4a8b-894c-963fbc41c5a5", "value": "384:lzfIJlVYeryskwEd0ZHu9JgiL7QWav8U9cY:lw80w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779679839, "uuid": "edc04790-903c-4f3b-82a2-0eb4f33e30e8", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779679839, "uuid": "235fe299-6193-4198-838f-d153f0466a88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679839, "uuid": "19c2bb09-e6b0-43aa-a4ca-24f91931af73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb530866-5874-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779739407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779739407, "uuid": "b192e820-9164-4a4c-a863-b6d1ecfdd6aa", "comment": "Malware payload", "value": "7dcf4909bb4370146c5c4b40f566b832", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779739407, "uuid": "3b028b67-39f3-43ae-83d5-d7a37ea29e76", "comment": "Malware payload", "value": "35e27a16b4d0e872790b11561347171b2c5d22a29dd96947285703b746003aa0", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779739407, "uuid": "85cd10e7-8490-4e18-bb9c-302c697eab7f", "comment": "Malware payload", "value": "db62d5374ccafc5e54b1dab972406774163474db", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779739407, "uuid": "fda5d5e7-9af5-45d4-b91e-a1db8ae9d868", "comment": "Malware payload", "value": "f71acfe4e8e2eb8ca828ce80ff6243a2659cd16946223952b6393a97c9fb6d5b7fbf889140f4fac3db4b9e44661f987c", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "VantaRAT", "colour": "#84CA9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779739407, "uuid": "b2b527f5-55d0-4343-9060-83b466fa9203", "value": "T1C8C3126E7DE78D65F8ABD53900B5CD3E8520C104BEDCA169F4F116587EA0A52A730CBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779739407, "uuid": "d60629c8-2094-4c8c-8288-c78cbe00fa7c", "value": "3072:5qbvTus64Esy5Ro41L8nj4aVISU7JclhM28iX:kruP4Esyanj4L7Jclhd8S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779739407, "uuid": "a7cebc97-77e4-4308-9956-5acd6cbf0cf5", "value": 122373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779739407, "uuid": "7ae4980c-9998-4dad-8a02-9393c30cfa30", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779739407, "uuid": "60818f18-6759-4f6b-a495-c0f052c622aa", "value": "WizzyAddon1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4314b51e-5817-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779699235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699235, "uuid": "6506440b-d770-41c5-a87d-73055e627f37", "comment": "Malware payload (Prometei)", "value": "d3b3d6d7652e44cf78b668f9ec60a9b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699235, "uuid": "e9936290-88d4-4970-ad39-f4fe27dc45d8", "comment": "Malware payload (Prometei)", "value": "3793418bafa71fe158bd2adf36b2a6c2709c9075196aeb39aadd0fb6abbc4064", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699235, "uuid": "bf0d3051-500f-40d5-884d-3d67ef000468", "comment": "Malware payload (Prometei)", "value": "4f1b10cb95abd20f91277ff9a37613fdb26f00e8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699235, "uuid": "5a2af27f-96c7-4225-ad49-282f5423e63a", "comment": "Malware payload (Prometei)", "value": "03dea366eeba3d47481b95825d4cba933b7532bbf815f1745d8c77a598289d7da567429f566fe54de2e1bfdd18fc6744", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699235, "uuid": "ce3e175e-b75a-42bc-be82-4d7007a4ba07", "value": "T1D1F433D36F8517B885ACB0EA5B98FC5669EC903C4FB25D08CE9144CA7A22E75CC891F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699235, "uuid": "90ed2739-6842-4ec9-836b-d16a8bb17a32", "value": "12288:j+ajEJnjwVvPZ9YqLbWq6258q1ilZT8pTUUa6qgOJuWByGFgwGt7u8nIFZE:yaOwVvvYm3CwpbTqfb2tEZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779699235, "uuid": "4e2f44ff-561d-4353-8f25-e290dcca2e0e", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779699235, "uuid": "f56cedc6-21c2-408d-8579-f12ee41cd623", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699235, "uuid": "a9876158-bcfd-4938-b09f-14a61a92543c", "value": "3793418bafa71fe158bd2adf36b2a6c2709c9075196aeb39aadd0fb6abbc4064", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02be5d84-57ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779679800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679800, "uuid": "4519b66e-471e-49ad-8bf2-24eeaae0ebd4", "comment": "Malware payload (Phorpiex)", "value": "d2b77b0744857ab4ec2224d4aba619e0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679800, "uuid": "e8975e14-8ced-448d-9eb1-21792f19b060", "comment": "Malware payload (Phorpiex)", "value": "37e85a9feba3b4ea8a13076f16a7747286525a715b88c52ef5ac86ca677a2bf6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679800, "uuid": "7feae6b7-4b32-4fa6-8c15-ff00395c9e1b", "comment": "Malware payload (Phorpiex)", "value": "161455d9eac0450f33de176ea995adc501ded557", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679800, "uuid": "21edeeda-4817-4c12-84aa-ba475290c77a", "comment": "Malware payload (Phorpiex)", "value": "7f55c1f0896439e236fc17de87edd42bc71777400bea56c81455d654152ba6bbb5eded8ab1f994c5d5f2966aebdba06d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679800, "uuid": "dda583c2-316e-423e-bda2-77807442089f", "value": "T1B4824B0FF9814216D1E100B05675863BDAB99C72338454EFF7D48A9D0BA86E6FC3211F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679800, "uuid": "a85dfdbe-1003-423c-98ca-96c0927e4388", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679800, "uuid": "d1235e5a-afae-4433-953a-18d003d6b736", "value": "384:NTIJlVYeryskwAd0ZHu9JgiL7QWav8U9cl:Gw0w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779679800, "uuid": "964c1c5d-fe5e-47e3-8df2-b9339f614898", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779679800, "uuid": "a7013a62-ee6f-4fd0-8284-2bb06cba8c37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679800, "uuid": "fcaf5c43-bba8-4655-8cdb-55ad063d0888", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b861cf7c-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747106, "uuid": "2ea82bb6-fec5-476b-a2ab-71da3c3edb58", "comment": "Malware payload (Mirai)", "value": "542d89c80f22918b39fe379cd4fc1faa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747106, "uuid": "1c5782ce-c976-4c25-8554-e3ed79694067", "comment": "Malware payload (Mirai)", "value": "38c1f8116cc716d42250a6a5c7a349c75e02ccc58974af11b54ba4bae26c0911", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747106, "uuid": "76dbcf47-86d9-4055-af14-f423ce17c098", "comment": "Malware payload (Mirai)", "value": "52bc3c1b0c60121b18ba3c16357eda9c23a3b106", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747106, "uuid": "9e91ece2-1d14-438a-ae5b-12b00eea66f3", "comment": "Malware payload (Mirai)", "value": "f6eb0ea3abaf9ab949bacb8af6f8b5a334cc4b29c34b8fd494bc927264e77d24f9d52b1eea6fcc272c50c9e2048a6f1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747106, "uuid": "aefd860b-6436-425a-b8f5-0b5c49ccecb2", "value": "T178D34A2275391E2BC4D0A87E22F74761F1F167DA25A8C90E7EB30D4FEF252206517AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747106, "uuid": "619bae73-e777-4491-9750-bf7df6359854", "value": "3072:cBldhO3+cB9BT+iLgXBm/4b30p0U8bl8Dwn0S:aldh2FB9AbmonbmDW0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747106, "uuid": "28597cac-ac2b-42bc-bdca-9a400a54794c", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747106, "uuid": "d6ad8bbd-2e59-419a-8908-a3a38e395edb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747106, "uuid": "fbc7db8d-19ee-4007-9ed5-294dc302dacd", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af57a9c5-587f-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779744085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744085, "uuid": "1193997c-182b-4547-bfee-31a2267ace7a", "comment": "Malware payload (RemusStealer)", "value": "264fdc8c6953b9fc069d74707b3839cd", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "menomou-shop", "colour": "#E9C1BA", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744085, "uuid": "1399d201-5ab2-4aba-b956-e208569d0dda", "comment": "Malware payload (RemusStealer)", "value": "3aca18df0426522e0c301a55dae3d892b2009719854207b4bae45f4c94403c9f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "menomou-shop", "colour": "#E9C1BA", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744085, "uuid": "00863ff3-ee1d-4a5b-8901-8515cec340a9", "comment": "Malware payload (RemusStealer)", "value": "80f5b885582136a5e58d72b6e2e141205e17d538", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "menomou-shop", "colour": "#E9C1BA", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744085, "uuid": "b3a9808f-4d4f-442f-ac39-a2ab7e71e809", "comment": "Malware payload (RemusStealer)", "value": "d2946d425fd641433079e30c63738e6294839829a600182aec90fe191930f37f6cc0a33f81fbae0cc27a86a3b609756a", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "menomou-shop", "colour": "#E9C1BA", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779744085, "uuid": "60b545ac-8a57-477a-979a-74cbdb4b2486", "value": "T1C6954B0BACA119FBD06A733188A36191BB717C142F3213D72A90B7782FB6BE06D75754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779744085, "uuid": "290bba3b-30c4-4028-9028-b27f0e45d666", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779744085, "uuid": "99585e19-9de1-4a2b-ad3a-c4f420c9132b", "value": "24576:cP67O+HPwtX6dEAYEdtloSCwhsEqZaefsPele54KSitZKtjO:cPIOBXbAYszCQYaGwYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779744085, "uuid": "2b728589-681f-4995-8713-517255cf96c4", "value": 1922232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779744085, "uuid": "28e8d296-e3da-4863-a69f-7f9c24896cf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779744085, "uuid": "3c918ed9-4fd4-47b0-8df7-2bd615500c67", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feefd52e-5885-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779746795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746795, "uuid": "1a643a4f-7489-47a8-92e9-1b7363a75f11", "comment": "Malware payload (Mirai)", "value": "2829af90a5af2522a25eb4b4c86646da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746795, "uuid": "3afd9fd5-e45a-41a7-8450-dd26ae5c92dd", "comment": "Malware payload (Mirai)", "value": "3b3e6b3dfe739b5c54cda6bd52a7c13acc0feec2617a4c17bece8fccba56e335", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746795, "uuid": "5ec187e0-616d-4455-b47d-35afe67f446e", "comment": "Malware payload (Mirai)", "value": "ed0ea45dd159204f046059839671328366c66308", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746795, "uuid": "04ded7b1-a82b-4d0f-80c9-ca5053f89033", "comment": "Malware payload (Mirai)", "value": "0e7404f7026386b47f0f62e1c1fef64f4d7571e5c091186de44daaeaead7713c45bffd394d8702e021cf74feadc2b76e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746795, "uuid": "caa5d07e-6657-4e10-a62c-6ed5c3106484", "value": "T15464C51ABBA15EF7DC5ACE3301EA461110CCE04A12A96F6BB278C61CFB4B90F49D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746795, "uuid": "e193179e-c509-42e0-8e88-85f66500d2a0", "value": "6144:jA05g6BqP2EQHN2r2SLo1yICTVhumPDbmyuigRbm3o:jA05g6s3QEr2/CTVhumPDbmyuigRbm3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779746795, "uuid": "63c5bde7-20bf-46c1-bb59-615c7259923c", "value": 315932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779746795, "uuid": "25799e9a-5811-42f5-a690-1058501f27f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746795, "uuid": "b67bf7be-6c27-40c5-bcac-19086ee23597", "value": "bot-d446c582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bef9bdf-5867-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779733556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733556, "uuid": "01c07ceb-da52-4c06-b8a9-ffdc5b6b49ee", "comment": "Malware payload", "value": "31cdf297b2cd732889c3aab50a8095d8", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733556, "uuid": "b695b324-520a-4b9c-992a-43874447eba5", "comment": "Malware payload", "value": "3bad577daf532110598df89dd26132ede4c7d23523beb50c073c63dfffa145e5", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733556, "uuid": "81b65204-7351-4c0c-b3b7-1f256a975d7c", "comment": "Malware payload", "value": "6b3031aa9c6e72c4bac065261f3447576e14d737", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733556, "uuid": "b8544174-8d5c-4b87-9d29-20e0b8b29742", "comment": "Malware payload", "value": "79ba3eba2b8e1f27298c425f18db40e03e9c1ceeecabdb4b9a2cf31fed5a74910d5dc5a4d18abf9b9d546506bfed7878", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733556, "uuid": "686f6d2a-64f2-4387-86d2-0f8cb1d24f23", "value": "T167E40207B8999E46E50347F5BF131A891A4CBE09EA9176B734543FCF3E30F625DA240A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733556, "uuid": "14f7e6c3-1135-44c4-a9be-4a10f266a591", "value": "12288:ThPBbVlmyzFj1Or0Eg1q3xpLQXExwd+UU0gczCGtqzvMqzc/:rbDzFj1bEgshcEx5zcmGIAqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779733556, "uuid": "b3c598ea-0a89-4ac1-8f66-10ad72278403", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779733556, "uuid": "e9b0e8c6-63a3-4c46-b892-f00a8149c1fc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733556, "uuid": "d82a54a9-6a25-4f03-9ac9-ee4a323d5e62", "value": "SecuriteInfo.com.X97M.DownLoader.2343.2698.21981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2965cf1a-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747296, "uuid": "982cf17b-d9dd-4179-bbc8-ad120e567939", "comment": "Malware payload (Mirai)", "value": "277eff53e8cf581cb0adf8669c5337c9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747296, "uuid": "b8e658c5-2aea-4b5d-a843-782e893bd69a", "comment": "Malware payload (Mirai)", "value": "3c5975f89124065063aab9f3c98b3c69868654f8cd6f8e638342df997a58d63f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747296, "uuid": "38d3aeb1-5ec9-498f-b1c8-7a90e325255e", "comment": "Malware payload (Mirai)", "value": "514df2dfa32de0d5744e803f685b63d40ad444bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747296, "uuid": "a0d49979-e251-402b-8155-3be3cfce5a7e", "comment": "Malware payload (Mirai)", "value": "6c92e532856c7f06adc5fe8506a3f1b8e2c91dbd56d01d2dbc3d196ec5e30015d38c3b34bd62d5cd99aa8a24a0643e04", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747296, "uuid": "ebae3f96-413e-4a65-84e8-3bc8e3431644", "value": "T1E45150C552856C3968B7AE13F6B68128308190939CFE7F99DED8BAE4878FD247140753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747296, "uuid": "a6a62f6a-7e49-447c-b04e-6339397ec38f", "value": "48:vpU70U7N7hpUvU6GpUgnUzPpUfUKWpU1UoUpU71U7o7UpUfOU3bpUEU9RpUhUcgL:vi7R7N7hiM6GigUzPi8KWiGoUi7G7o7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747296, "uuid": "6d2dd1e2-fdc8-4532-b9cb-a51523654519", "value": 2970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747296, "uuid": "c21af20a-0d21-42a6-901a-c8ae0c0a4078", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747296, "uuid": "3d65e249-f54c-436f-9d59-b7b5e9cdedba", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aab44c3-585a-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779727944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779727944, "uuid": "3234af28-3ceb-459e-a0f7-6e351ca00050", "comment": "Malware payload (Mirai)", "value": "5e9d65c17bc900d4574d9c9a5c08adcf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779727944, "uuid": "77a75c73-1ed2-4f39-9530-ddd363d8f45d", "comment": "Malware payload (Mirai)", "value": "3c9e24d178a1a542f37d7b1e4c4b4d74eff40929bd402ed006b8552357ecc2aa", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779727944, "uuid": "693f97e7-0b4f-4e7b-969c-344b9dbc5ca8", "comment": "Malware payload (Mirai)", "value": "557a7b44d7024971da1ed2b15ca2149657c498fb", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779727944, "uuid": "e4b10e3f-5e44-4552-9592-a6443e1fc53e", "comment": "Malware payload (Mirai)", "value": "a2fd3f4673e88ac5af9adfe107381fbe2ef93dd83ccd7c96702ba234e09ad0ff20d741c4f92b681634ff62a3a89ddd24", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779727944, "uuid": "6082129d-044e-40fd-87b8-187770616e4b", "value": "T1492129AD5C32D4FB9E099A41B1636406D14FE0F55378C228E8490D23A4AFF316D26AF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779727944, "uuid": "1a8edf68-ec3e-41d6-8350-c669d9b3f4ca", "value": "24:vPPuwy7wLNIW6wEzKwwgBw9HvYwAyWjwBMKPhyiLNIW1EzKTgo9HHjAyWaBMA:XqGAzPuHFNjIMaz5oHnbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779727944, "uuid": "fe1a8a47-6388-435b-849b-cf64ffafb877", "value": 1432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779727944, "uuid": "feb758b8-8c37-441b-835f-778a6572c600", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779727944, "uuid": "a76fd885-4f68-4cd2-9dbb-f6ae328a6ce5", "value": "sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f3e51bd-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747279, "uuid": "e17a035b-b4ba-4f02-8223-75b11cf7a9f9", "comment": "Malware payload (Mirai)", "value": "4e05a533f647a786a394377490dd4d4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747279, "uuid": "3b237bd3-3a9d-41c1-b4b6-38e48b9498e3", "comment": "Malware payload (Mirai)", "value": "3d27b7f26735535c0ba1e456ce4bd3e7db8eb52ab5e68c7b3bcb2c6b0ec3b7e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747279, "uuid": "a4e6763f-53fe-47c3-8361-171ae244c54d", "comment": "Malware payload (Mirai)", "value": "0ef46a9c94bd0cf1554e9ee9c3449c9e8f16a370", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747279, "uuid": "0b5db980-146a-47bd-a59c-a197f1994eec", "comment": "Malware payload (Mirai)", "value": "0a5536444ed6ff2dd495bab24275e64631a350eba44c66983a98f1ca9b792512d1dc86bf98a45cc31c43bee20104de11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747279, "uuid": "9f93f1de-92ab-4e0c-bffd-a9858b3c9141", "value": "T112735C32B9751D2BC4D0A87A61F30325F2F2478A25ACCA1A7D720D8EBF6565032477F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747279, "uuid": "577f1e00-a012-4ddd-adbc-4959fcb45a80", "value": "1536:jP+SbCGR18pspTH1ODQ2tXXUN95s0xwlWptCMR8/pW:zf4yVApENP1x6MoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747279, "uuid": "94da7d66-b9b8-43f0-8705-3110c2134848", "value": 78528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747279, "uuid": "186dbd4f-eb1e-4ab7-b13e-c2f58f6bd63f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747279, "uuid": "9c16e6a1-728a-47aa-a56d-36907c98f129", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e190744a-57e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779678026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678026, "uuid": "c5b6624c-58b6-4e7f-9c0c-e5a8c4cfeb05", "comment": "Malware payload (Mirai)", "value": "2203b10172a2dac5711f7f31132ca4b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678026, "uuid": "b67d2f53-264f-4c1d-a3e5-160b050e39cc", "comment": "Malware payload (Mirai)", "value": "3e7f7c2dcfbba67030334feefee935ac9284962d86865d8b99e2196730fa171b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678026, "uuid": "f94a968d-4b09-488d-9229-2c83fad8cdf4", "comment": "Malware payload (Mirai)", "value": "5daecac672f38c263d56791f46d0ab1a73b11aaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678026, "uuid": "faf5a40d-efb8-4da5-b3ff-dcfd30fe7f37", "comment": "Malware payload (Mirai)", "value": "e5a5d8ad63d92403094f6f91fa9920e825852dbc94eaaae79e561eac24daf909e0c4f3a9aa48d2efb562f58701c8a95a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678026, "uuid": "2db6e40d-5082-4060-a84f-c51f9970aa79", "value": "T1F0244CC7F801CDBDF80AF73A44274905B131B7E211925B33636BB96BAD3B0961563E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678026, "uuid": "fdb16120-92cd-4405-b73d-56a5f7e52e18", "value": "3072:OZ0qzxIBy+KzemYt/qjmQ4hTq9Zz/0E/u6buOWFVcjbiqLVFdbyBSReXz:OZ/IcehN8bz///j6OW0LByBWuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779678026, "uuid": "b640231b-795e-4f1f-9ca2-6b68223aef69", "value": 211424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779678026, "uuid": "c6757fd4-abd4-4729-928c-5b3a14c939c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678026, "uuid": "54882762-0f3b-4881-bea6-687e1ec71112", "value": "nuclear.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c740e33-57d8-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779672327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672327, "uuid": "50f1f5ff-bc45-459a-9966-3b43bb52175e", "comment": "Malware payload", "value": "8ad02f276e360f4be013f1194ba363d9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672327, "uuid": "6f979280-a6a7-43f8-b6b1-1796001c0a56", "comment": "Malware payload", "value": "3fe3ba2fd6d5ebaee5e95c1608f9615251e3f05846ae434609349e5bb979efa8", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672327, "uuid": "78311022-6f77-40c6-b61d-605e1b5b570e", "comment": "Malware payload", "value": "6ee30eb5a3f8a4ef7819560769c6dc87a98540c3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672327, "uuid": "46d77cbf-12ae-42e6-b0ae-f07141bd08bf", "comment": "Malware payload", "value": "c12c8e1f57ac77a0f318f938d8d1a176c68793ad787c6fef7a030991ffb5e4304c1e8548179b841afc4b28ea135ff189", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779672327, "uuid": "144e0c99-2e6c-4bd6-8a68-b8318dc98661", "value": "T1B2A27D7620F08A735A9015C4B37317A15FB2955B45A320B8B4FE2B399F69B03B4FF621", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779672327, "uuid": "eaccc8af-a8be-4dd3-baad-e976ca562857", "value": "192:c5uz6L4hvZ5mN9oKNpivjFV3+gukIFzITh5oeyeVeO:aL4hvZ5mN9oKNpivjF9+gukIFzITAXGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779672327, "uuid": "8b2306ab-5174-4cc6-9b81-1b8fd7cbc9af", "value": 21931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779672327, "uuid": "cea7b3e2-6d88-4201-99d2-3da647e99cd1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779672327, "uuid": "006f8487-0035-40c7-b129-8eb0ffa52487", "value": "3fe3ba2fd6d5ebaee5e95c1608f9615251e3f05846ae434609349e5bb979efa8.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "245067cf-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747287, "uuid": "ac17d42d-947a-4ed9-a179-6f991d682b06", "comment": "Malware payload (Mirai)", "value": "fc067b5b5f907d0b8525b5e9632438b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747287, "uuid": "5a6a6e45-847a-4655-aa0d-352d1dfb7eff", "comment": "Malware payload (Mirai)", "value": "42b0d0fd68da41b45fd9600bbf6561fda6adddac35adafc361357fd6cc87dc2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747287, "uuid": "be849b4c-a063-4654-83c2-53310f793e96", "comment": "Malware payload (Mirai)", "value": "819db907da2292af044c11e64dd4b86ae815ce47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747287, "uuid": "19555f8e-1ee3-4caa-98ad-f7889c3dffd7", "comment": "Malware payload (Mirai)", "value": "a74848590f7f4670af0a95c0c74b4e25473a844067077d3d4666d145c59423f05e0028e35da6c620443d05b22471dc79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747287, "uuid": "e5c58efc-04b8-4064-ac0a-3613b933ddd3", "value": "T16F7302083489E111EF110B76989928C98841A9D5D0ED71EF322A5E2DCDCFDA32DBFD97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747287, "uuid": "2ae7f1e0-48ca-406f-a7a4-b37821d985c8", "value": "1536:V8IHq+kgs7VI83wgrzlEFSPO/hcoiisjuq5Z14+CGKLtBcGXUqh9+sadEO3dzzUX:SIHq+kOQwgrBEEO/h7iF6q5v4+vKL052", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747287, "uuid": "fa1edd7f-6a16-4a64-82ef-a9f91d5c436a", "value": 77216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747287, "uuid": "dd1ae309-cd51-4ba7-a242-39654601caed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747287, "uuid": "f1224530-4fb1-4a63-9d01-cd7ac5e6d170", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22199407-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747284, "uuid": "3dba03b1-d742-4b70-be64-03c991a0a4fc", "comment": "Malware payload (Mirai)", "value": "23ce083ce35ab0f8cfac2d6f2beebfc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747284, "uuid": "3d1d64b6-48a5-4d82-b542-851703f5134a", "comment": "Malware payload (Mirai)", "value": "431e983730ee960aebb586042fb1d2ba46b131f413a90911c9d4b516af5c1ac3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747284, "uuid": "591a907e-16ba-4614-850a-72ed07e7b91b", "comment": "Malware payload (Mirai)", "value": "efa44b392836e63f9d03731545ffd3479ae34fd0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747284, "uuid": "50d23e79-12d2-4cd9-85d3-7f376a592e82", "comment": "Malware payload (Mirai)", "value": "6535e79e3d86f24f8bd380cd6d8aa7a373bd79fb8283a547ae4a2e2c7df3dfe980a000e0acd5181b43d4b9681c3a44ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747284, "uuid": "0226bc05-fe16-41c6-8aa6-17f119b99dbb", "value": "T193E2E1757E6A7CF0F9A0D433A829C7953B9503B8E4DD3099352C15B623C382CCA3D5AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747284, "uuid": "24c01809-0795-48ea-8139-25721dd5ab2c", "value": "768:heBsVPxhgMntQOJsrNTkMrV76N4MWH+1aQCis3Uozu:heGVPxGMpiB1V24ryCfzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747284, "uuid": "71a2877f-4028-4635-9b88-7f3e714cfc70", "value": 33864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747284, "uuid": "5979078b-7312-4f6a-947c-963feec7de15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747284, "uuid": "9c01ae7d-26ed-47c4-b45e-e9f341ca5b79", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb9dc9f6-5809-11f1-a769-42010a9c0008", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1779693532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779693532, "uuid": "cfd9276c-1b83-4113-926a-08d01288eff5", "comment": "Malware payload (Socks5Systemz)", "value": "fb75132496a6c99bb5d59a37a8cc30f1", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779693532, "uuid": "4ba19f4d-d088-438e-a0ee-078676050642", "comment": "Malware payload (Socks5Systemz)", "value": "43383f445121fd4b314044f086f3bcb7d981c07e631bbe85ea07eb989f6d0b46", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779693532, "uuid": "f89ed1a4-2f92-480f-99b1-3a80cc0cd4c5", "comment": "Malware payload (Socks5Systemz)", "value": "dfcaf7cfeeed1d44fc91d12480e0457c999a647d", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779693532, "uuid": "20c4642c-289d-4ea6-92c8-d4cafb919ba7", "comment": "Malware payload (Socks5Systemz)", "value": "15e5b5d004c053b027b09f0e99820170bfb956d12fb4ab9adc1d7298544cbd1a247602699c0b9b57bcef747414a99708", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false }, { "name": "UNIQTWO.file", "colour": "#7CBCE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779693532, "uuid": "cef27cd4-bec7-4221-b60c-579dfe2bd476", "value": "T15B0633656F1238F2F063ED754821EA34A567FD12B3B29351A2ED4E888A7F7543207633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779693532, "uuid": "2a640af4-972e-4f62-a653-35a7477fba46", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779693532, "uuid": "b9f479ea-5ce6-41dd-8fde-ff190e8e814f", "value": "98304:NzXiwwaAjx0K021YYfVJnuyJuq1kLPHXcifrm:hXi5aGxlHJnuyVyDcijm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779693532, "uuid": "7fc9063c-8005-4f90-93e4-8733dd5b3269", "value": 3727625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779693532, "uuid": "fa02ab98-09bb-4529-be5d-8ecfb3d73716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779693532, "uuid": "2f897f72-79b4-4e85-8a82-9e87c579e6ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b506b39b-5827-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779706298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706298, "uuid": "4d844d7e-c330-4998-ac6d-47e934586093", "comment": "Malware payload (CoinMiner)", "value": "bca4b3e3b33432fd58bc58173d65fec6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706298, "uuid": "ae2ad988-9d9a-45ce-aa1e-dbd938b674f4", "comment": "Malware payload (CoinMiner)", "value": "43752a9a68fc625b865f79b5f3813a46a81aa704c986727bcf837278e5df972f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706298, "uuid": "28da41c5-2407-4eb9-b7b0-53533a5ec9b2", "comment": "Malware payload (CoinMiner)", "value": "084343c7eb9d1fc4034a56eae34d1244f61a56b3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706298, "uuid": "c969281b-02f1-44d9-b301-c6a45462d988", "comment": "Malware payload (CoinMiner)", "value": "b5293b63cbbba89c83940d00d2a6cd2f4c4a0481b3469663dd8f9b1564bde101d8f9136570808162fd3b970f0195da8a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706298, "uuid": "4566e7e4-368b-4e86-a089-0775a90d0a99", "value": "T1D7065A95B90F3812F3CAF278EB6E82D9F13F7158A22950F33D410689C29599DCEB3552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706298, "uuid": "8bb71bc2-e3c5-4776-9f7f-4018afb4e407", "value": "24576:yp/1OdImyP10HB1nYB6f0rpkK+8UW8VV5HTbxPdUfxP0r5lodAxq2/aRvwPSac5u:Dy+HL46fLtfxloQcq1iV7acDOi/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779706298, "uuid": "8591355e-524e-4b82-88d4-4292ab2adc58", "value": 3880992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779706298, "uuid": "a96a7ef6-f3cd-4a44-93bd-6ea99ffaaae4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706298, "uuid": "16282b33-25dc-4073-ab0b-22dbce7cc37a", "value": "bluefix.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687c524d-5870-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779737523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737523, "uuid": "2fce444e-076d-42e3-b11d-04ce5d88c283", "comment": "Malware payload (Mirai)", "value": "6cde9ddcf814d4b05ff93f30e3e5be83", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737523, "uuid": "fc9c7b00-6841-4b09-a2e9-072c17d524d4", "comment": "Malware payload (Mirai)", "value": "44820f6340914346d5632e17c83032160322d1101ec39102081660b8fd507eaa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737523, "uuid": "ebc584a6-044e-46ec-804f-2cd890552f9a", "comment": "Malware payload (Mirai)", "value": "991b40db2e3c3c7d32d01622a5060b8550f2e18c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737523, "uuid": "759e87c6-86fd-47e6-a0e6-27e20abb1b06", "comment": "Malware payload (Mirai)", "value": "fdb727f34fcde2d7e79c6d917256d666ff7738259d6e5fb7609baf065e52d612c3e05582ec4d19c8b8ef67c440131969", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737523, "uuid": "a69465e5-342a-405e-930a-b1bfe68f357e", "value": "T147565B07FC5915E9C1AED23589729212BB717C4A1F3123D32B60F6382F76BD0AAB9354", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737523, "uuid": "6cf3c6c6-c79f-48a1-a129-edca0b4fc295", "value": "49152:aIULkj9iHa49k/3lnu7U4cm2b7vzQnrWEXavCAfWaWEI4ZYHG8taAIU/V8CKlK1T:aI9j8ldrKvkR4Z18tukw6VEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779737523, "uuid": "a45fdf7c-11d5-4ad5-82fc-fe701e2fdaa5", "value": 6099106, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779737523, "uuid": "d70420b2-3d96-43f7-a5a4-ccd3375819e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737523, "uuid": "943524a3-d97e-4241-971c-5a00ae43105a", "value": "amd64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91b7f23-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747107, "uuid": "d2842a11-b4b0-492a-b246-9729ef511036", "comment": "Malware payload (Mirai)", "value": "e4036b0d807989edbcbe90593c8b1f0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747107, "uuid": "ea5f8a9e-a997-4d31-912f-e0d84acdb1a1", "comment": "Malware payload (Mirai)", "value": "4519b003c931cf0706e2e878dd907a090f1cd51b0b4504ac6cd53d02dbb39961", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747107, "uuid": "b0367239-7c1a-4197-b624-38afb8cd75a5", "comment": "Malware payload (Mirai)", "value": "bffc4f6526e6a819bb006bdf21f6b468560d9d68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747107, "uuid": "9d0b1624-1570-4dfe-81f8-1b94f661a1d3", "comment": "Malware payload (Mirai)", "value": "4cf51a3d043f4621525ef5fd842d2a730c872e401f27c5dc5b92d029c8c1476c345ba7fed033af2650624e8dfa34b514", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747107, "uuid": "dbdc1a24-f180-4941-95dc-f5b257ec9f1d", "value": "T14AD35C0673180F17D5A35AB0263E1BE083FEE5D021F4BB89691F9B6A4672E371581FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747107, "uuid": "489404cf-1ae3-4f4c-a014-8bb395993722", "value": "1536:Gom472eUS/FXyFQ+16G3m/2kcVJlVAzWXus3Z7AUneMG0Dl/wnBy5Z2o1jaq2Vi1:ZXUoyzm/5sJwzWXNZ7AUrRZYy5ZfVi6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747107, "uuid": "f4ebf307-3422-45d1-906f-5ebfcc659a89", "value": 136760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747107, "uuid": "d53e0f27-4f15-49d7-8753-47c6f072fa6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747107, "uuid": "b97c52aa-4e11-4d2e-9f4a-dd2a8c15aba7", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23ba6514-581d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779701760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701760, "uuid": "a412254f-72e1-4835-9482-453cb7ba3084", "comment": "Malware payload", "value": "5b02605b56279d6ddc5a56165b75a78b", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701760, "uuid": "e4cb9342-5dc7-451d-b376-192b3a2b2d33", "comment": "Malware payload", "value": "45ca1d60ff783330509b4cff521c00f47513751978fabee066c1df63ccea52dd", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701760, "uuid": "d99c2b10-26b8-4f87-a0e3-b8d91da443b3", "comment": "Malware payload", "value": "1c00a40cd8e47ac7b16b8a78613f56517a2560ed", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701760, "uuid": "a93db233-9e42-4147-959c-a060c94cd463", "comment": "Malware payload", "value": "7337d071c45ebeda9d0a7b87a6c6de989fb07de56fbcdd3a1dd836324a5c31d66881ec2bbf9b40e09b3b6020d79ae13d", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779701760, "uuid": "70bfc6b0-ef26-4429-88db-b1986e49771f", "value": "T135159EF73E506A2B4E6F0A94D0040B455C7C589BE76882E87BC1F4776297090CBBDABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779701760, "uuid": "51680a73-09e2-42e3-9b39-60694108e687", "value": "24576:zn2hqbEtAQI6w3VtrlBw8lVV+uUuc34Econ5Ldfv:72hQCQ6wF7GADon5Ldfv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779701760, "uuid": "41b8e54c-9a2e-41e7-a171-c5c55558b98b", "value": 881252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779701760, "uuid": "e212d456-08c6-4b76-8e71-1ddf9ef0a3ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779701760, "uuid": "111841bd-3c93-4df2-88bd-8f3b41f7b00a", "value": "45ca1d60ff783330509b4cff521c00f47513751978fabee066c1df63ccea52dd.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f9d410e-586d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779736139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779736139, "uuid": "3d810aff-79c0-4cf9-a169-4ca74226f810", "comment": "Malware payload (Mirai)", "value": "a8541528d3927d35a55f53176b9480c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779736139, "uuid": "330aa543-9ec3-4360-a074-8c8bfdc7b630", "comment": "Malware payload (Mirai)", "value": "468b44cafb21a7f9a3033160967bbc5d7886bc9e49c9cce61ea4677b6776bc2c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779736139, "uuid": "4f2d1e85-b74a-431b-8f8a-13e62890dd14", "comment": "Malware payload (Mirai)", "value": "260fb6824407432700d05834acbb535914b5a2d4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779736139, "uuid": "086a0a09-d1a9-41ac-aed9-906c4222026e", "comment": "Malware payload (Mirai)", "value": "98fd6298f983f81e83afb0d395aad9ed097da57ba6c168098732f7163b4795261f071dfde9529bfd9da123967f41e3f1", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779736139, "uuid": "0dc1fb6f-e98c-471b-8599-ec43fc23e5fe", "value": "T1873138AB237141F384019D6EFB9228E4E14CD2DB919DDFB8F4BD4422415816CF5A3A26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779736139, "uuid": "27cd1ddd-ea14-4b36-9d73-6748b3c11e01", "value": "24:x3OJesXZQ4agwBhn+5NIqZNIraKPhMKP+0jx4RHhZ+szl:yVHMx+KPCKPkHnD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779736139, "uuid": "54f9e588-e073-4ec7-8eaf-c1482ad020f6", "value": 1468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779736139, "uuid": "49ccb826-2885-407f-a6b6-86c413c9a519", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779736139, "uuid": "889a1d88-2f40-4fde-a8a9-cd584de331fd", "value": "bins.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77caa7cc-5891-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779751722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751722, "uuid": "54a2b692-3af1-467b-9653-135c633417a0", "comment": "Malware payload", "value": "f04d390e3d3701d8a534d4b32b8b56dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751722, "uuid": "02098368-c108-4fb1-b41d-5ff3aab2c4e4", "comment": "Malware payload", "value": "47a2204dd5a0c8e9540373dee70d74dbdb73bac49eb26091c0722589013239a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751722, "uuid": "e2964e0f-1b39-4906-b319-42734c71eb21", "comment": "Malware payload", "value": "cd30fb51d1ce6a57141038e341d65b7fcb1a9238", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751722, "uuid": "fa6ca730-47e7-4a37-bf75-9c1bcf08de71", "comment": "Malware payload", "value": "b2c70b30f8889d62754d1751dfd580d4052658c97552b431524e17174b691af4c10cc02fa9811a3c26e02bd9a536fdf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "neuralpulsecore5-sbs", "colour": "#92CCB0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751722, "uuid": "174b20df-6b36-4457-9a49-69aa863c1778", "value": "T145A57C0ABCD008F9D06D93328DA766827B72BC190B3263D72E9075782FB76E49DB5750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751722, "uuid": "3d15dbc8-213c-4407-976d-4676ec8160f1", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751722, "uuid": "d1c37f0f-9ea1-4e14-9a76-0d1534ec1f5d", "value": "49152:LNuKXJjQ4GrbrgAm5koA/1BwQDWI1dvFkr3Jn8:LNhZjbGnXBwaWQFK8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779751722, "uuid": "9db427b2-9724-4d5d-9446-a30cc456f32d", "value": 2228432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779751722, "uuid": "07528ffe-42ca-4654-bbda-8d5442a1e80f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751722, "uuid": "efee3c38-f1b8-4516-93a9-6c1ceb26b706", "value": "\ud835\udc12\ud835\udc04\ud835\udc13\ud835\udc14\ud835\udc0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2162ca05-5887-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779747282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747282, "uuid": "43cf6158-4e1f-476a-aa25-35f389ef531b", "comment": "Malware payload", "value": "5be130d64f31451634c2365bad090f3e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747282, "uuid": "796617d6-543b-4dc5-9a2a-b1c5b50d7828", "comment": "Malware payload", "value": "48497f7eb6077a3f87cfbd8fd4a62849294b625a4e05c7f4a8f877f5b45cc7fe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747282, "uuid": "3f79e5aa-a6b7-43cc-b290-be458e391deb", "comment": "Malware payload", "value": "d660ae17b205c77be0422a274e9c81d344b154f4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747282, "uuid": "ef7b2c5e-0013-4fdb-8c5e-5f6605190295", "comment": "Malware payload", "value": "927fd742b06547313ea72e0099c387439a64a5b9ffc3382ac0df35820b21e9f835d75fc12d047aa12742b9c59bcc6dbf", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747282, "uuid": "f9f9cc30-76ac-48e6-b357-c195337592b2", "value": "T1822165CA139026EA491BCF897A624DCD4F8F05F5FF4E0768DBC4181B516F29C3DA6A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747282, "uuid": "33e62610-5485-4fca-82eb-ca02175aa46d", "value": "24:rv5okq2cgqi8q9ZebptXtCqu26NcVc4bJlEx9d:rv5okqlgqi8q9ZettXtCqulKG4bJlExX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747282, "uuid": "350f3841-f753-4d43-aa34-cae4db573fca", "value": 1251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747282, "uuid": "12c583cc-6c46-4aec-8ff2-9f64318a46f4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747282, "uuid": "4501bdc7-3bee-4661-acff-44245e621ed5", "value": "manual.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf7d88f4-57e1-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779676251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779676251, "uuid": "179f527d-2f5d-40e8-b293-0cf8ffc7566e", "comment": "Malware payload (CoinMiner)", "value": "71d9a78d7639f2d557728a88265499c5", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779676251, "uuid": "3091a6b9-38b7-468e-96c5-875955c5db4d", "comment": "Malware payload (CoinMiner)", "value": "49919eea4301cdcfd5b34b75d11254ba131a11472ca57e7629b05c12fffc56fd", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779676251, "uuid": "2051e79f-9d5b-4c9d-bb89-8d89d0da2040", "comment": "Malware payload (CoinMiner)", "value": "99ac1cc45dfc2c1edebbac01f38467b75ca20eca", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779676251, "uuid": "7fbff99b-4562-405d-8c6c-68cd47b73beb", "comment": "Malware payload (CoinMiner)", "value": "ad461b2add116301d532d54adba71484e2f2ec1bf6e670334961f47eb360df612fcb99b64ff328f4a9dc82e0f7f78926", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779676251, "uuid": "ca731719-91a6-455b-a56f-201ab5b9fbb1", "value": "T17F32E829BE810331E3A049B854794347957D2663E793E3EFF337A59E49A63488C41E2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779676251, "uuid": "04ea528c-72eb-48c5-8c86-a2e6452ad55e", "value": "42cf01d41ef6dc0627982490afc9cddd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779676251, "uuid": "471cd1a7-3c39-4293-8155-b401c0a3538b", "value": "192:oIcofWXvy8BqOx+eEP9PFJxTEZmFhS+cHf:o3o2vyfOwLPFwZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779676251, "uuid": "07df2cdb-ffbc-4c13-a633-8a0deb39acff", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779676251, "uuid": "e0913178-e170-459f-a1e3-20b95930f95a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779676251, "uuid": "971810ff-7bbb-4fa7-ad5f-6cb85836a005", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da5a437-5892-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779752189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752189, "uuid": "a72efda2-9f76-4420-96a1-46e10d017c5b", "comment": "Malware payload", "value": "46ab4cad212c25d19f91eb3e6f13a67c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ani-hitnoop-cc", "colour": "#23DD09", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752189, "uuid": "b8d548de-b4a7-432d-ba11-3f71bed1e71d", "comment": "Malware payload", "value": "4a35747220e8718f8abf72bc11f12c7f1eb8888e99893a83393e9b02b0a23f12", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ani-hitnoop-cc", "colour": "#23DD09", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752189, "uuid": "76d249fe-5caa-4778-99f4-8a413b9a6dc8", "comment": "Malware payload", "value": "b5944157f52b3e5966a8615b43b1e3721c0a29ae", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ani-hitnoop-cc", "colour": "#23DD09", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752189, "uuid": "916976e6-d6d9-4a3b-b08a-9ea80e34afad", "comment": "Malware payload", "value": "f6525858e293f8f27177c6891fe92c40aa25107eaaa1d8fa277f331a02c4c6e77ff5d4678b9b22bdb186f4d6a47c9107", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "ani-hitnoop-cc", "colour": "#23DD09", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752189, "uuid": "d20c8706-d3bb-4d0f-b9ff-460292768e9c", "value": "T18C873325E0952262FC8DC27519B80DA903E03EB5271716C423B9F09FD62BF6B8B35D79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752189, "uuid": "bf02600b-ec29-4ae0-8e15-fa499536113d", "value": "786432:IfOpf6z61Ha9qmowd9AYL/iepdZDE4q8kdHOTg90vb2qrsZ4lpL4o:IGSz68vdZqebZDo8kYTBvbbsZ4lp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779752189, "uuid": "f3d8414c-b6bb-420d-942d-2ef3ffdb1d8e", "value": 39380697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779752189, "uuid": "b09320a5-4240-4914-8263-718db08f2229", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752189, "uuid": "c3389b31-335c-4add-8794-284bf8f07a4f", "value": "Main Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707935c1-587c-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779742691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742691, "uuid": "3268e868-a85e-482e-80f3-2417941e5875", "comment": "Malware payload (Efimer)", "value": "31d59798b9ffd315d6b1424743087506", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742691, "uuid": "9897ae18-b2f4-46fa-bdd6-2b6d30640e07", "comment": "Malware payload (Efimer)", "value": "4b5d2e8ff830fa99497eb0357901964fcd7ab67fec1439df2a17080e1b658b5d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742691, "uuid": "17b18d66-88a3-4c2c-8ae4-ecdcf7220466", "comment": "Malware payload (Efimer)", "value": "c15e3b10a02dcf6d387654e96c611fda93ed29d9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742691, "uuid": "eb62e0fe-2b25-4ae4-8cdf-22a2499b5b11", "comment": "Malware payload (Efimer)", "value": "842f1f8b40d2634fd2baec5fd351fa9aa82bd31cd3634bea967f1e6ad50dac98ab2d89885a73a0c60b074ee4a7fa828b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742691, "uuid": "83f70446-6dc3-49a8-b1dd-5f018fe6b2af", "value": "T125D6331C88D331EED2A7D0BC5FD11BB0E869B97952309D7F4AA0C3B5AD5B930092C56B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742691, "uuid": "cedd0ff0-9893-415c-b862-bc456b72e43d", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742691, "uuid": "65b7b29b-dc1a-478b-a770-bdaa90e99383", "value": "393216:BkhAlkwtzNsX3yRsXMCHWUjX4cuI3/PGTAI:BkhAeMziXiKXMb8XNH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779742691, "uuid": "f35efc87-0f66-4663-a2cf-374f855a6c5b", "value": 13850300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779742691, "uuid": "323d24d1-4d4d-4742-8ab1-87e4df58b3f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742691, "uuid": "b384d5f6-fb62-4f7d-99b8-df492050e40f", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9ba947-586c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779735651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779735651, "uuid": "77a615ee-c000-450c-83af-3ac6f1939dec", "comment": "Malware payload", "value": "ead14581abd8bc03e0eb75fb46f2ff33", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779735651, "uuid": "1c76417c-b753-4c69-a04c-0b33907f0394", "comment": "Malware payload", "value": "4c5d32c3982e218aacc1f142e9872c98706e152394b4156f9e848f6546817def", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779735651, "uuid": "4aaa8297-3841-411b-a0be-d40cca51f89d", "comment": "Malware payload", "value": "35fd59e653d5807fa67b0b4bec7cecff9ceafab2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779735651, "uuid": "a8e5baba-8ef1-48d1-8765-ed9d77467390", "comment": "Malware payload", "value": "5fff9497c541075155b0f7563085b980edca2e34488ca79f8b82389a85e99af1238c7b7add3d9a984eb9f0c182267748", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779735651, "uuid": "b9280d54-26b5-4a1a-9c24-abccd6f396c5", "value": "T15154191BB29318F8C297D17496C3A7B3A836BC190334BEAF46D4D7723E25D60076DA94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779735651, "uuid": "c88f1f72-2bdc-44a5-a687-abea6952ac25", "value": "75e2b8ecd75fdbc33baf14bde024f3ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779735651, "uuid": "977a8cdc-2043-4657-a4ee-f979666fb67c", "value": "6144:yY2qFaO0mIL5WK4dA4sHsbvg8WoSwC9xUNVQFu9kqd:NfMmeF41vgwkQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779735651, "uuid": "2e700c1e-f840-4c43-acc4-b8af8c3c37c9", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779735651, "uuid": "4d70cb85-be1b-4543-a78f-6f64c3a5e30c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779735651, "uuid": "6e6189fb-93a1-4679-98f6-cafa496e6de3", "value": "svcdata32.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f13535-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747018, "uuid": "72bf31ee-7b91-409a-aac2-cb3aff7137b4", "comment": "Malware payload (Mirai)", "value": "c8731485b969389590979119f4c2a137", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747018, "uuid": "505e4f8a-ad03-43a0-8a2c-67b90f9452e7", "comment": "Malware payload (Mirai)", "value": "4da2f9c3efb6d7c41ac84566eea67e562fd16a2c4425b018098cc387b5def5d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747018, "uuid": "fc28b8a2-3c44-48e5-ad63-0953e4b08873", "comment": "Malware payload (Mirai)", "value": "dd6625252660592aaaa54b33aff354b23ab2ff57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747018, "uuid": "37cfd479-80bb-4fd5-b0ba-73cae4257d7a", "comment": "Malware payload (Mirai)", "value": "1b63efaca1e811854a95a1e947717d01807946fbd833417cc438b2b9ed5a5518998abd3bb641057f2867d28c9a5f5557", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747018, "uuid": "d72c9dae-9f5c-44d3-b2e2-8da8b8d88f09", "value": "T17C045B0AB0C094FEC89AC2744F9EE136D972F41D1234B59F27D4AF262E4EE615F6DA10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747018, "uuid": "1949f455-885e-4d46-8854-c7deb136d6e7", "value": "3072:m3IycwYZyxyvcc7cZ96dLySw3I/vp01g1r39acjTLf7NNjXWbZS3UL:mTcwXxyvccpHBqOZ3LfJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747018, "uuid": "5ad97a4a-a067-40ed-9257-f2d074bd090e", "value": 176200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747018, "uuid": "6a93c768-3a3f-407e-b983-5bcbc740de83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747018, "uuid": "b108933a-5496-452a-ab05-33a6715ed977", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20d8fc1-5827-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779706293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706293, "uuid": "8012dc27-06db-494b-a761-22a3a68ef33f", "comment": "Malware payload (CoinMiner)", "value": "b9b60e7fe42ac73cb190efc983d602b9", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706293, "uuid": "68e71585-ba5c-48bb-86d8-f902f55f862b", "comment": "Malware payload (CoinMiner)", "value": "4df139ba104501081de99936caa8d3d7cc04ab2442abab0a70770a1341f0eff6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706293, "uuid": "4785636e-6eb8-4291-a033-beb1cc3f48e7", "comment": "Malware payload (CoinMiner)", "value": "9e6a0b0a95f3efcdf1c7a414bde625fd73ded409", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706293, "uuid": "8b2e959b-0c98-43ad-baf1-ed39a39160f4", "comment": "Malware payload (CoinMiner)", "value": "18835d5bfbfa06d65e7e2baf1083920f29ac1c7965efe33a9c6db3ce249004c9126cce2908b2f5318a73780a4821d2e2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706293, "uuid": "7fb640d9-9ee5-4619-a28e-042494d01483", "value": "T1A0667C88F793F0F1F20348B0025B9BF7652016356047F5F7EB8A6A6AB0777816B153A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706293, "uuid": "e642119e-a396-415f-97e5-a87b328ec8f6", "value": "196608:r2D5hmyTJYDu0KCONmSZV3+ZgDho3ZDNVcDIAaiLqf:r2D+fKCON7ZV3+ZgDhIZDTcDmYqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779706293, "uuid": "32a5f454-ac42-435b-97c7-3fe9f031a246", "value": 6588232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779706293, "uuid": "e7fc47ac-fc69-478c-a208-2271d3e2c8af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706293, "uuid": "66686215-fb44-45f9-ad21-06a0c0e9108d", "value": "bluefix.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515717e9-5827-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779706131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706131, "uuid": "8f1c09b7-8382-443d-802a-53544876aa96", "comment": "Malware payload", "value": "1a24e3c38a91011367b7ac256ebf80cf", "object_relation": "md5", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706131, "uuid": "38047ce2-eb8e-4051-b82a-8e3c2aa4b772", "comment": "Malware payload", "value": "4e6c3f36a00638652d94b6a79722c7e40e11d73674fc49b4dbdadbe82acae581", "object_relation": "sha256", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706131, "uuid": "f56c645c-08f8-4d47-9f39-cd847527867a", "comment": "Malware payload", "value": "1a0a97e0bde2dd7098eb3ff813be953c4c2f48dd", "object_relation": "sha1", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706131, "uuid": "a34719bd-1e67-4655-b2d0-33bc162c423d", "comment": "Malware payload", "value": "75e2f62a42cff0d4373f2aa8e3e57ad22d662f3a12e0c4651087f188ff931a1ddc2171a59a3e87e4066e0d18ab5fcc1b", "object_relation": "sha3-384", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706131, "uuid": "4d6a9b14-feb1-4995-9d57-44a7796ab36c", "value": "T1B516120AF54DEC7ACE793439729A6775A32278685321C3C347201E256F9B6D5CF3AAC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706131, "uuid": "72fe1974-17ea-45f3-bb9a-243f50b465e5", "value": "49152:rbEnvZ2PEROz4UkG8vxv9Oj2n5j44PVYnnH13k6j+aFhptxNTDhYaBrHmkWlSX3:re28ROz4UV2rzu46FkS7hj3htBHmkqSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779706131, "uuid": "177f2799-4fe7-4f72-bf4b-174da0715b20", "value": 4254293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779706131, "uuid": "93ebd904-5991-4c0f-a08f-d5d45e6748d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706131, "uuid": "29719541-d71b-4537-b4d6-1d8707f51cff", "value": "Mise \u00e0 jour du navigateur_a664ca.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c5aa9d-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747290, "uuid": "5a10fcc0-c020-479e-96b0-31796a9478b6", "comment": "Malware payload (Mirai)", "value": "cafc41ebea40ded8a8af1571925dfeb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747290, "uuid": "e73be2fe-344d-4390-8203-b62e0903d6a0", "comment": "Malware payload (Mirai)", "value": "4ea402e81de3d2720185fe80b26389299146b1038467421bc2d5d9b10671cd82", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747290, "uuid": "0ecc50e5-dc23-4b2d-90ef-534b42512548", "comment": "Malware payload (Mirai)", "value": "c1e31e7d2272b2ad4fabed4330afac5a6a3a7918", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747290, "uuid": "f38faba5-841c-4f51-ad6d-e1ec09ff5943", "comment": "Malware payload (Mirai)", "value": "a17417ae57154e0296954cd7f4d971da53080bf2203912272816cd2561f0a6962f2126a2e7322728a289633857fc23ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747290, "uuid": "b44493ab-c32d-47a7-97a1-8f3dc1cab38d", "value": "T151A2D0A6D3D3D671D6508A35EBBC84926ED08BB9F7FB30B32131428622C1E9656F51D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747290, "uuid": "ad8f3060-95e1-40c0-adeb-40b431f8ce68", "value": "384:FOTec4Qq28dNSrGxwmI+mCsOWbckgtUdyismYi2jvkhymdGUop5hXg:FOizQq28CrGxKCP/ky68cs3UozJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747290, "uuid": "43466a97-f20a-4153-a43b-501f76962f3b", "value": 22244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747290, "uuid": "4ae641a0-9a1d-45f1-947f-e08cbb0fdf0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747290, "uuid": "cb4527ad-8c3c-4ce4-b716-68677bac94aa", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6764ffc-582b-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779707992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707992, "uuid": "4b33c3aa-754b-4c9f-9a72-c95e74df576b", "comment": "Malware payload (RemusStealer)", "value": "c550c06858daca78c360bba0d144c367", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707992, "uuid": "dafc6ce0-9a91-4af5-af39-3c997deaeecf", "comment": "Malware payload (RemusStealer)", "value": "4f41aa4ab30b58dd89a2036f8e11f40859f13a937ca80468d7f646d21249025d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707992, "uuid": "6d7ddfea-fb6c-4913-8eeb-65a895adecd0", "comment": "Malware payload (RemusStealer)", "value": "4a82efd0f5d8d257868681facf5b328b0223a658", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707992, "uuid": "3cdb052f-05db-4c99-bece-bdc2606c7b6d", "comment": "Malware payload (RemusStealer)", "value": "ebc584855dfcb5e054e5bcb8568a8a3420ee20574553252fe7dde6e4116d157db26f073a4e1ba7f5cbac5bd78745a78e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707992, "uuid": "ace6646e-d1c4-4f36-bfcb-81730a00c8ef", "value": "T1A708338AE3FEC67DCF7738F955B04560D384E9379A3210959BCC28F225E6249642CD3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707992, "uuid": "575bd895-bb87-4106-a73b-edefee0ed820", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707992, "uuid": "5456c27d-9c7e-4573-bf2d-89caf8abdfca", "value": "1572864:Ut9IKPybkHAmsD/sWFtrqPMUKzZ0+Qe83qkMaMzcQX37GXm0XA17:UUKamAmwFtAE0+QejkL0caLjcA17", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779707992, "uuid": "bb498707-e226-49e8-934e-7bc928457e6d", "value": 77821816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779707992, "uuid": "b784d3e4-1cfb-4123-865b-2f67ecc66ed4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707992, "uuid": "04449840-0439-461b-91fb-2780412b1e19", "value": "Quantum V4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d45ec388-582a-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1779707640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707640, "uuid": "e791e39a-1dc8-47bc-a717-e422dbbe0fa8", "comment": "Malware payload (NetSupport)", "value": "ed9a453c5e2b55e2140c0310dc270d2a", "object_relation": "md5", "Tag": [ { "name": "194-180-191-223", "colour": "#501243", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707640, "uuid": "12905963-ffa7-44d9-ab89-c0b69fe1bb81", "comment": "Malware payload (NetSupport)", "value": "4f76999c589c0325502d979f984e120629cd1ad61b1fa91bf8b936609040f5e8", "object_relation": "sha256", "Tag": [ { "name": "194-180-191-223", "colour": "#501243", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707640, "uuid": "f9544fb0-42fa-475f-9884-b728c3fd404a", "comment": "Malware payload (NetSupport)", "value": "1ab82d32e4cc7e0aa9dfe54b8b9919f6bb594e13", "object_relation": "sha1", "Tag": [ { "name": "194-180-191-223", "colour": "#501243", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707640, "uuid": "112a5bd5-56f6-4081-8e62-784cb00c64f5", "comment": "Malware payload (NetSupport)", "value": "e8936e9caf547d6d700f5ac4c8682063bbbeb3425aceda52507665d9f066dfd3379de01a4ed74b61a5152c372d3ed5eb", "object_relation": "sha3-384", "Tag": [ { "name": "194-180-191-223", "colour": "#501243", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707640, "uuid": "90e03cd6-f9f7-4780-b850-7b987bec544a", "value": "T1A5963367234CDDFFD2452F320AA86B49D4461BC119770A72E1A6107FF134E8A9B70ABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707640, "uuid": "c148fc81-1d34-456b-b06f-18b6652b9097", "value": "196608:ymOfLm0Nog30hMuMGkRazF7oB97XaF2xbSwPhhrvfslWlWYghrE9:ynLvJ30KuMTMB7Y7e2xbSgLrvfsT7rE9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779707640, "uuid": "44d4ea68-ba88-48fb-bf52-e23489a9b76d", "value": 9020138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779707640, "uuid": "5ffa6344-6897-4e58-adda-e7d9758749c0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707640, "uuid": "5ca323a7-4659-4864-9b9d-9eaeca7fd351", "value": "UpdateInstaller.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76cb241c-5827-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779706194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706194, "uuid": "e0faa7e7-1eb4-4faf-ac81-da0f86999a8c", "comment": "Malware payload (Mirai)", "value": "b412dfd4c34eb716525ee8797de88bee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706194, "uuid": "71e0c241-5752-4094-92de-f61c9547522a", "comment": "Malware payload (Mirai)", "value": "4fa7f5b70e7667263890a7872700d4d47d5013cd66ddadea0a432513e56ea143", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706194, "uuid": "0d3a4119-a2c4-4056-996a-301fe3ab5e31", "comment": "Malware payload (Mirai)", "value": "cefad091bc9f7e4118dbad1fd4070c9e8b397f23", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706194, "uuid": "85a99471-fbfe-4e0a-9d2f-ab339e04993e", "comment": "Malware payload (Mirai)", "value": "37164a57973b86953971971522d6d18ef748a1ddbffbfa5203c5af50c06a238bbf9f0f82df42f528a9318cfdc6bb4db9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706194, "uuid": "d42692a0-e6ba-496b-af97-5295fe34c5c8", "value": "T111356B47FB1C8522C8470EF1193F53D5F7217A4341B9A22A670F9B672622E39EAC7349", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706194, "uuid": "6f270e98-649e-4da2-85e2-a17654b9e2f6", "value": "24576:AkZG3qNGCYIBwiG9GQgbiw2WEixHz2t++BcQLNDY+rgS:AkZoqNGCYIBwi4lguwgit2tXcQLNDYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779706194, "uuid": "dac0f174-0ca3-404d-a52f-3ac6f7fd8f00", "value": 1074820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779706194, "uuid": "134dc543-48eb-4401-937d-b6c53d193d95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706194, "uuid": "93bb15a5-f6a5-43cf-88bd-f47db00b034d", "value": "nig.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ae25c08-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747298, "uuid": "203a4a47-c56a-417d-ac54-8ebd0ee26662", "comment": "Malware payload (Mirai)", "value": "d6eb8b11a570eb3c10022a8b19fece40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747298, "uuid": "881de4ea-d318-4d0f-b806-748c12f0f8a2", "comment": "Malware payload (Mirai)", "value": "5181d6a574409ac57d8a2a4781fca71ef4c883ede3cf3799ed48b78f100fd7a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747298, "uuid": "158d9511-4b2e-4a03-9607-c65f85db4525", "comment": "Malware payload (Mirai)", "value": "439d852284a320339d62117cfea840a935cf9b0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747298, "uuid": "f9a53337-19c1-423e-9f6d-92d2b5aa5b56", "comment": "Malware payload (Mirai)", "value": "30c47cfba08f921efe7675891f0358f0d7d4883fed7bf85973d497801afd21909807e63e2c956a86cef147cbf5342dea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747298, "uuid": "461f4524-b711-4185-8bf3-24db466a3bed", "value": "T10AD37B73D8256E98C625C5B4B0648F782F43D1A881436FBE69B7C2B05487D8DF609BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747298, "uuid": "5b9eaf53-40c0-419a-8012-20754d3b62b0", "value": "3072:QOuckx3SPfcjjNr/qDhTdDWIZ19K6hh1LEb6:QOucl0jNri9dSIP9dEb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747298, "uuid": "8d29f113-2b6e-4654-bd8c-46d94adcfdbb", "value": 141920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747298, "uuid": "a6f61bf1-c88e-48b0-9148-3575ffb92f91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747298, "uuid": "fe015d99-4c8c-4cc3-b44e-6bf07a4e0a0e", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f333920-585d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779729294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729294, "uuid": "d6fcc0ea-1cad-46e9-9f1e-0ae0e18c6e32", "comment": "Malware payload", "value": "e14481d0d2ed1684da6818e076f4bfe9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729294, "uuid": "005fa70e-c837-4f17-b69a-7172c77c47a1", "comment": "Malware payload", "value": "52e75b6a2a528d075aa78de0127ab1c213f18a8a4339a1c9b207242079ae2d29", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729294, "uuid": "e1d27ccf-e3a3-4a38-8a5e-873dbce22fda", "comment": "Malware payload", "value": "5f1c94c3048cc9cbedcb7383091d6d15bee42554", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729294, "uuid": "4b9efd8c-da1b-430a-985b-b9794c658a30", "comment": "Malware payload", "value": "e1f52e481bb94625d2a8a45d69888bfd487960118e5dceb7b7c005258bc11d82178ad2d0bf75b58508b5c190e6be034b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729294, "uuid": "16236c30-b882-4024-89aa-02e1c9b17d18", "value": "T1A867CF7792067CEDE9B94DB4C41015816DA878874778A3C7BAC8B1E666FB2D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729294, "uuid": "9825dff5-aa22-4aa0-bff6-41120c4d2439", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQM:cqYUQuVDt0TZEAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779729294, "uuid": "2915b7a8-0602-467a-93fd-db5793b45774", "value": 29753344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779729294, "uuid": "6554562e-7767-4d8f-9587-41b654d1252d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729294, "uuid": "2e2ae74a-548e-438a-b9ef-77836221aad2", "value": "52e75b6a2a528d075aa78de0127ab1c213f18a8a4339a1c9b207242079ae2d29", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fc111b-586f-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779737041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737041, "uuid": "88ff3dc1-6d77-4a17-a37e-75db0e39bde0", "comment": "Malware payload (Mirai)", "value": "1e3b55bae248111e06f984c9a04c4519", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737041, "uuid": "cc08e339-0f19-42f8-9d4d-3403f38e6c94", "comment": "Malware payload (Mirai)", "value": "56b2069d230583ed78891de2354cf27dfbabc6c962fe8bf6b63f7bf6bc119721", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737041, "uuid": "84349176-f985-4b62-b874-3fab151800da", "comment": "Malware payload (Mirai)", "value": "5b1e9abe0e3ed3df5813ea4b7bb0f1d520f92c82", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737041, "uuid": "e6855b24-3b5f-42c8-9ab6-6c092f57d2b0", "comment": "Malware payload (Mirai)", "value": "bec632361b19c967fde2b93b55caae3dcdf4f77c4a4ddd274f5c7a01c4e1239c351b71dbdea3d61d9c040dbc736ba7f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737041, "uuid": "28a5be94-f64f-435d-b0e7-df155b96f21d", "value": "T1D234D707AB519EF7C89FCD3306FA860120CEF4572564772B3274DA6CBA0A64F5993CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737041, "uuid": "f97e2d46-9146-46f2-b070-e425f7586eaf", "value": "6144:YyUDF67Vxc3zys2beDvlhxNNyAxYM9LkwZOvjO:Ch67Voys9lhxNNyAxYM9LkwZOvjO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779737041, "uuid": "a5eae97f-5972-4dbe-b22a-4ede90343b50", "value": 236157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779737041, "uuid": "f2bf20e6-0ca7-4477-8455-ef0ca064ed89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737041, "uuid": "741240b9-f0ac-45ef-852c-68db85e3068a", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2510cead-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747289, "uuid": "f89586d5-2127-4846-9f8f-f9f135c1e211", "comment": "Malware payload (Mirai)", "value": "aed685d24c07d79d72f86bb8bddf0536", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747289, "uuid": "9fed63c0-bb7d-4179-95f1-b4ceeca293e0", "comment": "Malware payload (Mirai)", "value": "577172843e3731388f046f490cee6691c7926a0fe484b8b96580e63de181d3ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747289, "uuid": "0808f9b3-1c94-4103-9c14-7b563f65847c", "comment": "Malware payload (Mirai)", "value": "542677475e2ad7d867033c791b537426701bd537", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747289, "uuid": "0f2924ca-553b-447e-8e1b-f763b82afa93", "comment": "Malware payload (Mirai)", "value": "f5662527492563dbdbe558eb63aeff278d4d7fe92f9329b7771a4db4fc8babf790e18c800fed34d02bcfb34d0609a4ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747289, "uuid": "89f2849a-1b96-4209-9c5c-60cc51f3a7ad", "value": "T1FC330260058FF344E6302D3EB9A9CC1A1CD5A7ACD9B4B0B345D44B811F43A5D98B9E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747289, "uuid": "1c84f8f4-e23e-4398-8c49-4a9d8ea6f2b1", "value": "768:B44O4eyC217SuUTXZazr6s7PvQAdpakxue6+t0NGX06/OnhqolRRN1iZ20njShIA:BbdAsKU64hp1uGKsKR4M0IBg2ScgUzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747289, "uuid": "26f8932b-db29-49bf-b674-64e90071973d", "value": 53776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747289, "uuid": "4c9a7736-fb3b-4cc3-89b9-b50f51a14922", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747289, "uuid": "63342651-a401-4266-8f5b-a34f33fbcbe3", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c70ff641-57e1-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779676264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779676264, "uuid": "853398a8-4bae-41c4-8b89-96ba9fb07d21", "comment": "Malware payload", "value": "c4fedf5405325e640262ef03da88b1e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779676264, "uuid": "bbae31f0-f791-4d46-91e1-0cf80969025a", "comment": "Malware payload", "value": "5781c4252c1e9648c3edcbe5aacb26c61e2997dae8a4d0d8dbe0c17a138a63d3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779676264, "uuid": "67d90c2e-e89d-4ebe-9b82-17da9cd0748e", "comment": "Malware payload", "value": "71f9da2718ed2fcfefcecef9a581bafe9ce18df4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779676264, "uuid": "80a1c230-e3b9-4cac-a844-b4356c0641d1", "comment": "Malware payload", "value": "cdecaad383bedb0eb849754ad78070b381c554a860e5732e99ba057dec9334c1c8556fc03da090e7505b2bdb296f05fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779676264, "uuid": "c4865bbc-fc33-479d-89d1-9be1678ae913", "value": "T17D17BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779676264, "uuid": "dc9d112a-e332-4bce-a626-3e87be3a0cf0", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQp:cqYUQuVDt0TZE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779676264, "uuid": "8df6692f-0a9c-4c00-a0a9-f061ad51630f", "value": 19431424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779676264, "uuid": "c24efb61-cf1b-44f5-99f6-b31759dd8d07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779676264, "uuid": "c8d3f84d-69ec-4640-82e7-ef261d195c93", "value": "5781c4252c1e9648c3edcbe5aacb26c61e2997dae8a4d0d8dbe0c17a138a63d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62334bb4-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747391, "uuid": "ca4e2af8-a958-462a-a780-e3ae2e9640d7", "comment": "Malware payload (Mirai)", "value": "a34574500d964085ce83645b9885b187", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747391, "uuid": "3ec85721-7a14-44b0-8197-bc834c35d1e0", "comment": "Malware payload (Mirai)", "value": "579f12651c975bb3455ff5b4ba7f9a7862eb1a079143d6e1483ea1c0bebb6459", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747391, "uuid": "be35d605-7a0e-49df-a47b-a4f11c58aa62", "comment": "Malware payload (Mirai)", "value": "34711d95fe27f918365a2c527750d8a271921b78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747391, "uuid": "55425fc0-6824-47cb-8c14-36c537119999", "comment": "Malware payload (Mirai)", "value": "c0ea45f8435ce7a2e0b57d65de0ad1afba195464e17c27d8d29c2cf7607a5eec0f4383c319cb7261c1d19222760a3649", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747391, "uuid": "66db050c-ffb5-447c-a88b-5b6fe6be95c7", "value": "T127F31A42F8418F16C5D211BAFA1D128E37131BB8E3DF7212AD245F607B8A96F0E3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747391, "uuid": "7c14e323-b032-4fcb-a9a8-b76417e58fef", "value": "3072:XkGROPfU3yLPrW40QdIA2XSaRuwXOcJvBCRlYOP6hh1zJ5:X3RgfU3yLPrWlesXSaIwX6RlYO+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747391, "uuid": "645b794c-f569-4a20-9252-6990222b03f7", "value": 170940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747391, "uuid": "a741de61-7cb0-4475-9504-da86763562c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747391, "uuid": "ac7ca215-ef6c-4a26-b5ff-0529065e7848", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f32200-581c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779701515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701515, "uuid": "d31dc861-4134-44e3-8aa6-2562b884f35c", "comment": "Malware payload", "value": "c5a6e991b68128b51d522d580dd4b793", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701515, "uuid": "81f088e7-2082-4b08-9d6d-666640736ca7", "comment": "Malware payload", "value": "59b6fc2fc694f2f92dff04f172056eab402916a3993789b5a06e40793dbae2b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701515, "uuid": "55b658a5-d502-4b62-ac51-dafb7cce16e8", "comment": "Malware payload", "value": "d5e565696787415de06a4bc4e99958221e35dfb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701515, "uuid": "b0e2e4c9-8296-4d1f-bf46-8e1be4df84c4", "comment": "Malware payload", "value": "80a7b31be3c3c23b261bc136d943b8a5e177ce37b16078c4e86a4e492ab48f08d2597a564b963742e0c6c9f329c0329d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779701515, "uuid": "e9aefdf8-058a-4914-b47e-1eaa0600a4d4", "value": "T1FFF69D77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779701515, "uuid": "48eaf0d3-9e5c-460f-9029-a910cb67b663", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQi:cqYUQuVDt0TZEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779701515, "uuid": "0eaa6b2c-32ae-4e32-90c9-74886bb7bfae", "value": 15663104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779701515, "uuid": "f41d21ec-d370-4806-a02f-33f49c7dad85", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779701515, "uuid": "6691ed55-8825-449e-b503-d874c1d05d15", "value": "59b6fc2fc694f2f92dff04f172056eab402916a3993789b5a06e40793dbae2b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "707684c6-5882-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779745268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745268, "uuid": "c064f03e-3ce5-4507-b4dd-ce85588da520", "comment": "Malware payload", "value": "464e037ebf40171529d70196da758eae", "object_relation": "md5", "Tag": [ { "name": "ayrseu-shop", "colour": "#724810", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745268, "uuid": "78258d53-5721-416b-bb08-be086e50ae6d", "comment": "Malware payload", "value": "5a5b337353b1a5faa9a3a18887de1235426da743fb6d77885c78b03db47b12cb", "object_relation": "sha256", "Tag": [ { "name": "ayrseu-shop", "colour": "#724810", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745268, "uuid": "79f76515-8d40-47b4-a5b8-44c4fd17caaa", "comment": "Malware payload", "value": "ead6b2fee4ad9f9e91f06ced328a2bf83690fc5f", "object_relation": "sha1", "Tag": [ { "name": "ayrseu-shop", "colour": "#724810", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745268, "uuid": "43065161-9a3a-427b-9426-b2512ab586da", "comment": "Malware payload", "value": "3e0405d22dacc76794ecbf8c7bded4b740f4656c4b743701f21a1f35d76eef00f32dfdf3213b6cb3916ca26a4e1829ad", "object_relation": "sha3-384", "Tag": [ { "name": "ayrseu-shop", "colour": "#724810", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745268, "uuid": "151bd201-9168-4936-81ac-bcf2f215ca88", "value": "T1B2243A2BC25371FCD592C074926A7332B733B63947249EFB4392D335AE229C06E79924", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745268, "uuid": "3d549bcd-c69b-4bb3-82b0-8330c3c20c0d", "value": "f7f06265082add6d6d0fec781c269c83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745268, "uuid": "0cf76636-7cb3-4c3b-be2c-fcb64c7807c1", "value": "3072:0aN2T8HZY0QbLXBgbwJymPssDxRMRlGgBhmxOoDxbWsLbFRkPx6KR:l9ZMR53xIlFs1BKPx6KR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779745268, "uuid": "79f4fc3c-fa6b-4fc9-bfe3-1f10fb38a09f", "value": 217088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779745268, "uuid": "78b41d5d-3cba-41ef-8ef1-1201e85e12fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745268, "uuid": "27c34c27-dbcc-4ce5-b0e3-8e709f1fccd6", "value": "rtom_tom.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab78926f-5863-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779732052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732052, "uuid": "af1896ed-848d-45d5-9e5f-4557aa8332a9", "comment": "Malware payload", "value": "82699276b0f59a2304120a6baaf64a6b", "object_relation": "md5", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732052, "uuid": "438f6358-e251-4afe-b954-cf77fd7b6f09", "comment": "Malware payload", "value": "5ab36c116767eaae53a466fbc2dae7cfd608ed77721f65e83312037fbd57c946", "object_relation": "sha256", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732052, "uuid": "8e09bc84-78b5-46c7-944b-fb4d0d5e8f71", "comment": "Malware payload", "value": "87903559afa09a0dfe251598c14e58124bddde1d", "object_relation": "sha1", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732052, "uuid": "724d21a8-b21e-4918-998b-a80c50e42fa4", "comment": "Malware payload", "value": "ff7b3e4eb3895b627cefdf916d0fa7e18aa007ca911b06312d1bf512fd43d69382c5ae597df40098c578a5d230b2c6bb", "object_relation": "sha3-384", "Tag": [ { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "sys", "colour": "#C7F753", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732052, "uuid": "4ca33477-d42f-4c80-9ef6-6208d08334d0", "value": "T1B9D219C21B792086FBD7C979D2A2D667ED30F6E0979589DF01B4C1911EC1FD02B3921A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732052, "uuid": "d6eedc11-48cf-4406-9c1e-1e0cd509e3d4", "value": "e1e5f6628200ed317625c64c1d1819aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732052, "uuid": "672b7300-0718-4e46-9bcd-a3d409b0e386", "value": "384:3TpsRK6OzLQBegOKVNIRI0o4nYPLeiOU1UiOUH5JNNzFwhhi5:Dp4aUNOciIL4ELP3wh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779732052, "uuid": "6fe4b0c6-16b0-4e4d-aa1b-ff0f5451ab95", "value": 30320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779732052, "uuid": "6e3020fb-4bae-4c85-b22d-bd36c0cdc014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732052, "uuid": "67c25a36-e4f9-4ace-a22b-31fa8c063755", "value": "BootRepair.sys", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e809dfdd-582e-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779709390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779709390, "uuid": "1ea1046c-add7-4a89-991a-af02e0d424c8", "comment": "Malware payload (Prometei)", "value": "31e42561d6b5b435095db56e990faec9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779709390, "uuid": "02eb5f6b-b8de-4289-8590-5a75aee59b6b", "comment": "Malware payload (Prometei)", "value": "5c307e3667dae2acc74b57b3d5fc37f7cd9ca65f296e9740e5fe25b7ee3e6686", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779709390, "uuid": "b161e50e-1529-460c-bd38-2a9b5f92d034", "comment": "Malware payload (Prometei)", "value": "85f8a0f6e848fb019946d92fc1241c9cc00e3c1b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779709390, "uuid": "60cbfd2d-ea67-4c0c-b30c-e1110f25007c", "comment": "Malware payload (Prometei)", "value": "c8febfcb75dba8198f070385091c98b8c8f5f7203cf3a4c0852d66056efcea51193ea1f0795df37642176c5d2787deb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779709390, "uuid": "bc6ba0c6-5eff-4773-a127-c6fe496bcff4", "value": "T1B907AD77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779709390, "uuid": "77e87a6b-d328-49c1-b3b2-208960d1285f", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQl:cqYUQuVDt0TZEO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779709390, "uuid": "01ccda44-e373-45f4-9d6f-95e5ccc6174e", "value": 18219008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779709390, "uuid": "f6ad2953-49dc-4ebc-ac46-2d90b1bcb862", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779709390, "uuid": "d73a51c3-9287-43c9-8e2d-b5934d25f860", "value": "5c307e3667dae2acc74b57b3d5fc37f7cd9ca65f296e9740e5fe25b7ee3e6686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19154e2a-584e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779722787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779722787, "uuid": "3aa52654-ff8a-4c66-8006-733af301ade3", "comment": "Malware payload", "value": "0c0a38595cbe66fce7387e42e08afdd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779722787, "uuid": "acb4d842-61ff-445f-b8c8-6f0cb36bdbfb", "comment": "Malware payload", "value": "5c7055f6cb37879928da46dace5a814ff1016f902c1a47d6657a2a558a1fc12e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779722787, "uuid": "8905bc03-0f2e-407b-a14e-35a5a7c65150", "comment": "Malware payload", "value": "ccfd0b26368f582705c74c69f58af296aeb18cd9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779722787, "uuid": "af0dbb97-0363-4b8f-baaa-ca0e8c0dc881", "comment": "Malware payload", "value": "0fb412471706d55894a407853c1198d5894ebc0b7e3cd8668469d23a75a77b5787536c21fee79a1ae5c3c35be9201b25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779722787, "uuid": "e194a93b-d8e6-43ee-9a69-14cbb9d3092f", "value": "T172D49531EF005069FED2027359ED569D41A86C318BED44D3A186A9FAD7BA3F127362C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779722787, "uuid": "4c2ed13b-ad37-4752-9ba1-5d5be0eb0112", "value": "7de0ca39d27a767536169165223f6578", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779722787, "uuid": "226fa615-328f-40be-9ea4-8c587d08651b", "value": "6144:9WSpp2LpKl/RmSCgkqCOI1vFuyBsBebot83KHOwYdU3IQdBjdQR:9WSn2LQ1RmokqC/OFBSotEKHO5GxxQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779722787, "uuid": "08762420-640c-43d4-9730-1dfaf933197f", "value": 645632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779722787, "uuid": "57a58bba-438e-4e31-8063-49e7ab9c5187", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779722787, "uuid": "065fac47-9712-4874-9bfa-e2f2a31992ed", "value": "5c7055f6cb37879928da46dace5a814ff1016f902c1a47d6657a2a558a1fc12e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4479f0-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747111, "uuid": "50616f3d-3317-4bd8-99f9-3e58ae33d477", "comment": "Malware payload (Mirai)", "value": "34c0ca720a1465fb475fe740ef4a7db8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747111, "uuid": "efaea107-5b15-4ea8-826f-7381a843611f", "comment": "Malware payload (Mirai)", "value": "5c7d1b8b429b1d5cc59b9ed63de49b09a111dcf23f55917c43a3f45b24e78d93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747111, "uuid": "e9c49dcb-faad-4d9b-ba4b-716b6b25632a", "comment": "Malware payload (Mirai)", "value": "40a90e79cab407cd618ad3cc6bdbdba70f6dba85", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747111, "uuid": "d03f9c3a-dae0-4b8a-a80b-3ffa7900df80", "comment": "Malware payload (Mirai)", "value": "5587985237c88df962beb61fbc16505b9227f638808ad6a490c780d0b8b0f7effe083eb597e77632325b61b2ffa895fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747111, "uuid": "7387fb62-9f55-4454-b512-ee566dd48b8c", "value": "T14C93E651BC82562BC5E423BAF67E668D33A577E4C2DF722BC8214B14BB8550F0D63B84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747111, "uuid": "ef832c88-cb28-4deb-9dfc-aa36a958e02d", "value": "1536:Nnd+RS/fk8Tq/hCaNV+A4yOeCLiEslKwczHMWLLRvAHLBFt:Nd+RSk8TMVGVhw6LRvk7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747111, "uuid": "1b0b6fab-2e4e-4ef8-80f2-0d8fd7e52d77", "value": 93756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747111, "uuid": "54fb0e54-a862-4686-b380-091885c9bb41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747111, "uuid": "3884b04a-fba7-45f1-a97d-fc67b9d831cf", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2161d612-5852-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779724519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779724519, "uuid": "6d5ec8ff-41dc-4ae5-9788-4e2e36ca3cbe", "comment": "Malware payload", "value": "3536cd866382fc3f4c014e7e7b3d21eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779724519, "uuid": "3043b58e-ba42-4f60-bbdd-1cd74aec2317", "comment": "Malware payload", "value": "5f20b0430c5f395f2e2b81074a144deb09ad432f37ffeddf66024e83cae31104", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779724519, "uuid": "0b3c1440-9064-4dca-86f1-29a7c37f7702", "comment": "Malware payload", "value": "0d279f797cbff9aefc4d3d9716f15cc66f2b1dfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779724519, "uuid": "c42a7be8-c603-4819-9745-18194584ae48", "comment": "Malware payload", "value": "7be3385573a91009a7524d6f9c7db385fb5b23b348fd9a5f527453e8fb42a0087782587b1723dc0181d7ab225ee9f657", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779724519, "uuid": "cbc1400e-f648-4b9e-8288-2140550d0f41", "value": "T148E5BF03FF8284B1E9D2427911FB577F8D395524973099C3EBD019A9C8212E2AB3F799", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779724519, "uuid": "e3d07cea-d1ab-416f-8aee-f962698097ec", "value": "249ada7a1ff675b6ad43554317f27b78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779724519, "uuid": "73724568-d1c8-4492-8679-533d0c4a1789", "value": "49152:HKR43bY28HcQi3MF2CV0Z6aNz01lxySMQoNvnIVxL10GknkkfztPO1NujuSUj5Nr:HKRR9HcN3MF2CSibsPIX11k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779724519, "uuid": "6cf40d2e-997c-46f8-89da-1d72a3332608", "value": 3258880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779724519, "uuid": "63604e5a-96b2-4745-8111-fc7ea0274656", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779724519, "uuid": "10a02e14-9731-4698-a59d-0cf3c2b4b92e", "value": "5f20b0430c5f395f2e2b81074a144deb09ad432f37ffeddf66024e83cae31104", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a355b5-57d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779672421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672421, "uuid": "7f4f6425-4a2b-45f0-ad51-eeeb385baafc", "comment": "Malware payload (Mirai)", "value": "0d2d11fb33130dac6669306a09317f26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672421, "uuid": "139f037c-d2ec-4f86-ae6c-e9db9f943580", "comment": "Malware payload (Mirai)", "value": "5f3f2cac9f0343e3b740fcbf0f46e4d77ed6fcf6b5d0bc87f54d1fa941b68059", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672421, "uuid": "66874a11-aab8-4236-b0f0-4ec730edce3e", "comment": "Malware payload (Mirai)", "value": "1d26644899aa717a212c3aafda7c3f540020fd9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672421, "uuid": "3ea3cf08-86a7-4db8-8873-18df8ee40078", "comment": "Malware payload (Mirai)", "value": "231f2e5e1715655c695eb330c970f54c1598584ee2b4007b3028d419aca977f3b508f9204f918f9fc5366859f42f6e08", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779672421, "uuid": "0dd2eae4-6eff-4485-bd62-c5a9833db44a", "value": "T123143B45FC415F13C6D226BABBBD818D372627F8D3EA31179D226F60378642B0E76A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779672421, "uuid": "00061a11-5270-4fe7-86ea-78624f5ae368", "value": "3072:ehabadXx06K+0rxW2zdMSM2MLn1Pv4rdWKsxIAJAvfmn0:ehYsXx0E2+r2AJv4r8KKZJAvZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779672421, "uuid": "05c8a983-2f2c-4f7f-8e9d-a4f8a1e4b967", "value": 207584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779672421, "uuid": "9b96912b-06e7-45e0-ae43-cb241dd64cc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779672421, "uuid": "f8525a42-7251-4555-8b96-837aa56af3c7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601b9eb9-5873-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779738798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779738798, "uuid": "da84a345-0de4-4084-ac55-38706f893175", "comment": "Malware payload (Mirai)", "value": "c5c5546590a723c6979cb2fc232825da", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779738798, "uuid": "ef56cccd-920c-445d-aa63-2a17256e58ef", "comment": "Malware payload (Mirai)", "value": "61c26358079c724389cb30fa0100b943d4daa156be867fbf32412dbeb28ec0c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779738798, "uuid": "6d08e860-6d29-4ed7-9e6d-5a501de07c1e", "comment": "Malware payload (Mirai)", "value": "f5333b9fac12fd622416c0675049d454a76ed7d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779738798, "uuid": "0a5d0342-9e60-4521-b865-506f20dd8915", "comment": "Malware payload (Mirai)", "value": "a6754bb7648b88e114feebb297eb02af48229e96410f8b57594b4426d012afde1b2261878bff765cc0f1895cfffa43fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779738798, "uuid": "792b3e48-7fa3-41d6-828a-89503da10371", "value": "T1CE9317D5DA63D4F0CF450E3930A3E7368E306529932ED353EFF1AE127AA27119467A14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779738798, "uuid": "4277ae8d-93f0-4f92-aaa9-8537ee878870", "value": "1536:DXSp/V66f7z5VLOgp/ChyfFtVQefudGke+uEBIkUWbZJP0ePnTYHhFg:LM/V66DtVLOcChiinzuEGk7GenTYHhFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779738798, "uuid": "a10a6f63-ec01-4764-903c-0879e4e6b545", "value": 93012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779738798, "uuid": "9d7b4bf8-974e-4156-bac9-45e2977d2170", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779738798, "uuid": "98c40ab0-2b14-49e6-bb15-4d3ba43474ad", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c8c412-586e-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779736678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779736678, "uuid": "d58c08c0-4d00-4b64-8333-9a81b0c5bcac", "comment": "Malware payload (Mirai)", "value": "9bd2a5156f18bdb262694afa4a59d738", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779736678, "uuid": "d243a178-cb6c-4913-958a-632f3495af91", "comment": "Malware payload (Mirai)", "value": "622c58eec3036a3905197d2fb39f9b23d58a775f1c3d931f155d04e3d4455493", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779736678, "uuid": "03037d9b-99c1-4579-bd22-c589f2b116bd", "comment": "Malware payload (Mirai)", "value": "8637aa92dbb303e1c42b3a3e5d4f2d179fce6807", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779736678, "uuid": "dcc0fe6d-9712-4a4b-97df-8fb779cbfc21", "comment": "Malware payload (Mirai)", "value": "a141edea2ce219481cba38e5cbd9b002b6ff9541d91482eb9471e9f9ad282ed7309ff9a58d9f681d3fd9e0f86d6b4a01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779736678, "uuid": "b555d797-61af-4b2a-9cd2-42cc007ca82b", "value": "T1AFC34B1E7E189F2CF7D9937987B7CF2593A823926791C201D02DEA106D6034E681FF69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779736678, "uuid": "4f5fb849-b405-4c7a-861b-3c9ad5611db4", "value": "3072:GzunDHpRUau0EvY8QrCSjhVnKxTsECnLE:GS7pRp8QrCSjDn6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779736678, "uuid": "1249971f-d9aa-48a7-bb4e-5063f3a3117e", "value": 129624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779736678, "uuid": "d0ead7c8-f3db-434d-b17b-66d5277f554b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779736678, "uuid": "038b9a11-cbc2-4ae5-b76c-1867be4ec640", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e60d01-5891-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779751635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751635, "uuid": "73630dd0-b914-41e4-9174-8daf20f16f24", "comment": "Malware payload", "value": "afe35a657ea5aed591505db40d59a6db", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751635, "uuid": "d4818709-edc3-4b12-a82e-574c21964455", "comment": "Malware payload", "value": "624f52cc31cd7ae5a311c9800b619386c9fd1a45af11b4e852391699ce36d3d8", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751635, "uuid": "3f24de41-1a64-4edc-844a-5472819722af", "comment": "Malware payload", "value": "f00edabd1cde158179019278507b72c517e2ff71", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751635, "uuid": "fde11451-6476-49f3-b361-0a3143729731", "comment": "Malware payload", "value": "2db83b17cf222ddb0dac3a8c36f467e7739fdbfb2dd60c742ca2c505b6aadd547507301ec348c5f1a58602ea661beb6d", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751635, "uuid": "6ead63fb-1562-43b1-af28-eb2ae8f5cf14", "value": "T188C58D01FD9784B2E402133299AAA2FF2335AC054F759B97EA587A7EF9776D11C32301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751635, "uuid": "97d213c2-21bc-4a0a-b20e-edd3d4d2aeef", "value": "5af915f278815e76bad476ef32593028", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751635, "uuid": "58bf39a4-f869-41c1-ac50-b6d3eb5e62f7", "value": "49152:NJ/viHNnC7x7l8DKE8RuRqu2LVHGiIpRVNZB99:NJ/viHw7x7lXdRyiER/R9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779751635, "uuid": "227b3bdc-9e3a-4259-ba6f-dea3e2372d43", "value": 2688640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779751635, "uuid": "b095666f-6426-425a-92f3-33cfd630cf5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751635, "uuid": "ee6f12ff-d99a-4a85-8646-32d5784a4076", "value": "Pro Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c4391f-5801-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779690026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779690026, "uuid": "9c262cac-21cc-4dc2-a891-d96f6a4990de", "comment": "Malware payload (ValleyRAT)", "value": "899891756dff935253e4c235030e7b55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779690026, "uuid": "3f4b680e-8e04-4472-90c3-6e83b0d3133d", "comment": "Malware payload (ValleyRAT)", "value": "62bb24f5f1c68116d03a51d10686a3e08859241b49d8283dadb44034ae0c1108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779690026, "uuid": "5ece5e7c-73a8-403e-8340-f7adbbd65c1e", "comment": "Malware payload (ValleyRAT)", "value": "0ec8e64e79a50d16d6e55d50c58f3745bb207a2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779690026, "uuid": "76fa1804-9286-444c-a66a-dc92c1fb7ec4", "comment": "Malware payload (ValleyRAT)", "value": "6cda6e5da2b236213b9ea69bc65b63b1c3bb6eb45af39afb04920785932622ccab7809d6d5e277e9dfa2cbb575fd6ad7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.sa", "colour": "#E6B81E", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779690026, "uuid": "2b418f74-0759-4a7b-9d69-4d75868ffa15", "value": "T18C36A7519148C467F77212E77512A604BA7C9BAF32058D8C706EE36F5F26EBA033B0E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779690026, "uuid": "a434f6c8-a335-4000-9f1e-cff5596cd40e", "value": "051a368460b338ba6044fed3b1f57c98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779690026, "uuid": "a3f9f706-2a75-4f4b-b9b9-d61d9dddb103", "value": "24576:GhJlJ73/j9J/vBL8M/6vbdfr0ZJIAfvXUt9kkHL:GT/hJRL8MYbdj0ZEtpHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779690026, "uuid": "e0cab528-b14b-4c5b-970c-a23d61ec7e42", "value": 5117952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779690026, "uuid": "b043cc89-fe53-4bed-a357-1712370a1f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779690026, "uuid": "db7a6a9e-b1e6-4a91-b3ce-721a4ad46707", "value": "wang-yi-yun-003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee70bde4-5882-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779745479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745479, "uuid": "28ba83be-989e-4f30-9416-621dbd3dd94d", "comment": "Malware payload", "value": "d2cc39ab9bbc9497abf4ef221902eae6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sivaph-shop", "colour": "#683286", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745479, "uuid": "ec71d5e3-8555-4524-b6ed-5519f4bc71d1", "comment": "Malware payload", "value": "630202e6856062a04b0eb9bd7c5100339d4d007f1a0d25519ae86a7edc4a3e6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sivaph-shop", "colour": "#683286", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745479, "uuid": "3efb7943-4b64-4938-9623-fa31ae94b8a8", "comment": "Malware payload", "value": "98f1dadd92f7d82276edaa67844a3b71eb93fe13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sivaph-shop", "colour": "#683286", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745479, "uuid": "229dacb4-604d-42d1-9418-fa63bf43526f", "comment": "Malware payload", "value": "12610892b83df926dd8865dcdbfb003e9bf66242e741ffc2641cc179f658ca9f0390cbd69e6a344e67e7bd56444e6ccf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sivaph-shop", "colour": "#683286", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745479, "uuid": "3beb98d0-a7e9-44d0-a299-17a315fc8ccd", "value": "T1D334296BC29331FCE553C078926A6222BB72B63D47709EEB0293D3319D21ED06E7D525", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745479, "uuid": "3e260a03-6b32-4f78-b816-d9e238709879", "value": "e8f2ecc61201a03998993e67bd6b131c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745479, "uuid": "148a10dd-bffb-46d6-a710-8dc697498570", "value": "3072:+3oQmWOp4o3VmiTC2NjynD1MvJsrex8Xc2W11E8XJ/JRSGHt+0ccuVyM:jQ6Co3VmiTB82varexALwsGM08V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779745479, "uuid": "05bdeac4-14ec-4122-ac2a-a860fe178b61", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779745479, "uuid": "527f7b2b-7de1-4009-bbbe-49ec10376a5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745479, "uuid": "0fb1518e-2865-4670-98f3-5cb205279582", "value": "vjsyqtvw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8fd5aa-5816-11f1-a769-42010a9c0008", "comment": "Malware payload (CobaltStrike)", "timestamp": 1779699042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699042, "uuid": "2dc1d24d-3d8a-438e-8212-f3c231075139", "comment": "Malware payload (CobaltStrike)", "value": "29bb37668a083e3b3f28e93d4755019b", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699042, "uuid": "e001abe3-a4f1-42e8-bb50-389e34871b4f", "comment": "Malware payload (CobaltStrike)", "value": "63c656b183444fd53169f82dfd69ef54cf595f74b8268aa5dc154bd99e6fbcaa", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699042, "uuid": "50be73d5-0f2e-4ca9-918e-0be045bd7b7e", "comment": "Malware payload (CobaltStrike)", "value": "c92501be9c7685d78b257b3d5963212928a70c21", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699042, "uuid": "9cf194e0-645f-40da-b1f4-4ff741837578", "comment": "Malware payload (CobaltStrike)", "value": "de52ace2a659d44c93a8332b6878b31b6fe83e5afa6fa629db831b41effe742339be1c1ffd001e55a282059a9a2b8ad7", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699042, "uuid": "d1146d02-d7a9-4ee2-aca2-1a5de5f1984e", "value": "T17FC72303F89655A5C4ADE23486239163BEB27C496B3133C32B90F7686F77BD06A79710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699042, "uuid": "6dee5d49-298c-4d5a-9c55-ef4943d305da", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699042, "uuid": "87bb43ef-9f9c-485e-be95-6c917409a1cd", "value": "786432:KgKdmwOIG2UsvY57xtdeWlqHu/RdjaUAWczERJy9weygI0fpCT2aWw05CNHeFj7k:ymwOdYqxb/+u5I8czaJ0I9vGCoFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779699042, "uuid": "998f1e2f-6d46-41b3-b411-6a941a17379e", "value": 56483488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779699042, "uuid": "15cbd4fd-565b-4df8-a89e-48134722f696", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699042, "uuid": "7cb46f31-4f06-423e-ae83-dd1d69aa979e", "value": "29bb37668a083e3b3f28e93d4755019b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6da2c65-57e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779678035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678035, "uuid": "9dcd2b89-6c92-4c59-949f-b330ce282e0f", "comment": "Malware payload (Mirai)", "value": "b153c6445608b41bf418c80b8546ec7b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678035, "uuid": "9d9c5bf7-bb5e-49bf-bc37-c707d99077bd", "comment": "Malware payload (Mirai)", "value": "65dee36549a3f28baf0346b74d1fc94431fd0f11de2e3f4f4538f449cd359c54", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678035, "uuid": "d1b27f37-6ba4-46e2-ac88-f288ea3ee52c", "comment": "Malware payload (Mirai)", "value": "15876aee5a306b7c5ed5f5b02bedd1bba0b15319", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678035, "uuid": "4eaad305-4e33-47cf-a2e2-dcdc637d0151", "comment": "Malware payload (Mirai)", "value": "3569a70a15ca11200976861efdacb637d2ba2f811e05a6be7fcaf33e88fe3198b4fac25c2b0429a81bcef318d25b8e10", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678035, "uuid": "60aab42d-de18-4395-ac0a-d9404dfe3a4c", "value": "T195D4AF9CBB8F7D03D287E33DDF4A8671322B75E49352D2A27401425DE4C6EADCEA0A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678035, "uuid": "15ffbaf5-a3c8-4c09-903a-19b5ff35a4bb", "value": "12288:Df+8wGsUpjvXehUofuA6y1CxF4x/r+P1bbhEyGdyk:Df+FajvXe5RCxuxTtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779678035, "uuid": "5b42682a-59ff-4aa5-94e2-85960bf48925", "value": 639520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779678035, "uuid": "61a8bcd9-9752-47b7-8dc3-66d35374d1d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678035, "uuid": "50c7f25b-b5fc-4a5e-97f0-deab098bbd41", "value": "nuclear.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0ba738-585d-11f1-a769-42010a9c0008", "comment": "Malware payload (PlugX)", "timestamp": 1779729475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729475, "uuid": "facaf120-ad68-4ddb-9227-f6b66b7d8c29", "comment": "Malware payload (PlugX)", "value": "e5f99f39b90666e0f5b619d90caf9788", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729475, "uuid": "05ad04ef-fcb9-40f5-aaaa-68ab1f736a3f", "comment": "Malware payload (PlugX)", "value": "6816bdce3909a1a98c719e032690ce2b1756d9c6e82c15078584bc3dd3a55cdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729475, "uuid": "3fb2f14b-6555-430c-a005-3fe3051c686e", "comment": "Malware payload (PlugX)", "value": "f7136f10071057c024943cba6240bf13b8b2e312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729475, "uuid": "78f209e0-f6b1-4a3c-940f-07d469d9c0d1", "comment": "Malware payload (PlugX)", "value": "c983898a67cf19602c13024ae05deeb6b2524b43dd89e957709a3507748e51a41494d7821d3bc449b38197d2e03bc6ab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729475, "uuid": "fe26bedf-b7b1-4aac-980a-1a7421bc2bdb", "value": "T15F64230A71F1C87FE0EA183401B0936BE7F953436D630A7B6725DF4BA659087DAA05C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729475, "uuid": "805aa024-c765-4ea8-8a5b-84c0252eeb88", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729475, "uuid": "47d84b8b-bccf-47a3-9473-42092a9ac136", "value": "6144:NsKVQdetZaBRciL1t/qCH5kqEwbfPjjmErneWFJtT4GpAukWHRVA:9ZQpL1s1HKDLT9fti", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779729475, "uuid": "2cdd21e6-8e3e-4bbf-ab7a-530a86db8a3a", "value": 331886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779729475, "uuid": "f4f755f8-1011-4c77-9502-65517a9662cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729475, "uuid": "d04f6a77-6fe4-4f87-af91-64d5d60239e5", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "014172ca-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779746799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746799, "uuid": "fa47d0b3-517e-45ed-b9c5-203f63025250", "comment": "Malware payload (Mirai)", "value": "055eec67909c7d426086c2bb179f4612", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746799, "uuid": "d2a0480c-b857-4ba9-8357-da749eeb7818", "comment": "Malware payload (Mirai)", "value": "6827ca41300c22919012fa5a006154ab178f9b8e255cb68b96c0b4bbe16995aa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746799, "uuid": "3a528c4c-083a-4267-9cff-94c5a18dc712", "comment": "Malware payload (Mirai)", "value": "88f3ab5a0dd3548148e214c5a9af4bd44fe1b032", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746799, "uuid": "2d7b4686-307b-424b-bd9c-b7a095dfc5c3", "comment": "Malware payload (Mirai)", "value": "fb7c8917a04f27e3c27b1645bdcd6f6ad0d1642db973fe30d56a379c07858ae2f863df08a4804aaba60713062a19fed2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746799, "uuid": "20c15a8e-b77e-4646-9123-6486bb66d1aa", "value": "T13E157C5BFE5E3C07D2D7E23DAB4AC3B0522BB590D21351667A82032C95C6ADCCFE1691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746799, "uuid": "f5828e25-64ed-4cb6-9348-3f1cf38a7e78", "value": "12288:5XtRNu38tQUimlbTZkhY845p1HlSXn8G9hioFs5WtjFP3zxxuExz4Ri6Y1:5XvkUimlIY84Fi86h1jB2ExURi6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779746799, "uuid": "ba824981-cf1a-40ce-9099-6f6430b78194", "value": 936336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779746799, "uuid": "173e840f-6f32-4cc4-a602-2c91e9f0e890", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746799, "uuid": "ab355c6f-9b14-4520-81c5-15d1ed76b22b", "value": "bot-aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b81a1f84-5827-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779706304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706304, "uuid": "9b47d142-76c0-427f-becf-4a66a7b7d207", "comment": "Malware payload (CoinMiner)", "value": "31a3d96713eed99b0bc914d83853ae1f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706304, "uuid": "dedb0ecd-8020-4fdb-9819-c2437c73e0f0", "comment": "Malware payload (CoinMiner)", "value": "683d964814e9c4b9bc456e2873a074c676a65f83ce6d1304f037efd3e31333d8", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706304, "uuid": "7accd61f-dd26-4470-910a-5ec465ea559f", "comment": "Malware payload (CoinMiner)", "value": "4b3b6d8a69f8dbb44047d6e667b147254be85d95", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706304, "uuid": "93a79718-1715-4db0-bc84-b8624d42d0e3", "comment": "Malware payload (CoinMiner)", "value": "338e6ea0a6f64dfe10eb41cae03f94a8a0608c758e48d230cf57ff2a7255273927b8de44a86cc6ef28d475eeb1fbfe9b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706304, "uuid": "8aabdd42-4143-4cfb-9ec9-2f6f62794bdf", "value": "T11B366E173B21CF2DF358D27004B3C9615BE521A32AE5905DA27CE3287E6161E295FEF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706304, "uuid": "4d49a95f-4199-4aa5-abe8-0da71aaa8d4d", "value": "49152:c7l5rbVVpLhGFS2kQeABeJPIBgJr/0CzKTE4rojx7F6977T4i0K5DJPU:Ur7Nqa/Fb03TuK9hU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779706304, "uuid": "13ef69b2-58af-4de4-8cd7-4f70817c7834", "value": 4875860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779706304, "uuid": "9ce2a4bb-f12d-4619-9e5d-ac96f694fbe8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706304, "uuid": "e390d43b-6671-4031-977a-d5306389f92c", "value": "bluefix.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fe91cf-5882-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779745403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745403, "uuid": "eec55e93-cb8e-494f-9c00-bd4bc673201f", "comment": "Malware payload (Mirai)", "value": "0ccb595d7508967e72aa3bf59c1d97ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745403, "uuid": "0cf4709c-265c-466f-9aa1-bef75c911fdf", "comment": "Malware payload (Mirai)", "value": "697e4904339fc76cc9879b7fdcd1d67d96654b33beb06769d92a78c8fa87f028", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745403, "uuid": "23ed4af0-36b0-4ed1-817d-fb771e354983", "comment": "Malware payload (Mirai)", "value": "013fd3cd4a6fbad3106cb89f496c6dbf944ae01a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745403, "uuid": "a5cffe69-2450-4629-b498-1f8953ac4446", "comment": "Malware payload (Mirai)", "value": "4405200afcad1a47256090d4fcfaf35cea18b165dc590e7efde92b2d635ba3afb307fd5eea10b8fa1635c735e41a6a4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745403, "uuid": "a5d953e2-6c2d-48ee-9792-690e9fa28f53", "value": "T144053956F8808F22CAD125B6F75F82A873174BB9D3DA710699284B343BD791F4F3A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745403, "uuid": "4cb5548a-63bb-4250-8387-d62f5a2f7d46", "value": "24576:3E882m3yuUIMrxC5rAmz/Sb9JlI0r2Ta3JepQ:YyuUtr8rAmmB2Ta3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779745403, "uuid": "26dd9c71-4f88-49d9-baf2-addadbd3edca", "value": 864892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779745403, "uuid": "5e45722a-bd3a-4050-a887-81b522cd8174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745403, "uuid": "108eed6e-3d41-4cd4-99ed-d3e38aef325f", "value": "bot-armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4300c69b-5893-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779752493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752493, "uuid": "65843c3c-97fb-45a8-9ab9-0cc8439e5b69", "comment": "Malware payload", "value": "d82775390faca9f4ff2076ddcfc558b7", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "pw-1495", "colour": "#08B8DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752493, "uuid": "9ed62562-b78b-44f9-9e7d-bb521068fbc5", "comment": "Malware payload", "value": "6d23af7d362bc1e3d134100433daab4fe43c00d94e446ac9e3b11b6d8413233f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "pw-1495", "colour": "#08B8DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752493, "uuid": "c3309ac1-c88a-4de3-bcf1-057a4b0aa55f", "comment": "Malware payload", "value": "104c2b3f60317593f51cc207a243d9b66ca9f3b6", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "pw-1495", "colour": "#08B8DB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752493, "uuid": "f0be69ec-6c80-454b-a3ec-6064a1f4b496", "comment": "Malware payload", "value": "eba5e902322a886fb9d2d1a78a7ca8168c8b127293b0c04b5a5f62b391821399f4a5dd0c65c3f43f7f27b8fc0da19210", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "flur-constzoo-surf", "colour": "#98DF74", "exportable": true, "hide_tag": false }, { "name": "pw-1495", "colour": "#08B8DB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752493, "uuid": "b5de673e-be20-4143-8cb7-818d18c13e60", "value": "T1FD16332126158A47F9B89F2B91A048027F26A2D5F097FCDC026F1CB984D65FEDF8CD64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752493, "uuid": "22726187-d366-4f2b-aa84-05bf804eee96", "value": "98304:UC2bP8TGtbAvMGKX5xdgtk5CwVqeQma2H8xPWH7vEZwLwF6JSuwt/o:hMP8N4zgIVWma/xeHALEJSuwxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779752493, "uuid": "3da77a7d-4080-4b83-a67b-a561f2cd73c6", "value": 4347683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779752493, "uuid": "7812aca1-7eec-4c5b-976a-98eff506df2a", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752493, "uuid": "90f231ae-3764-4e42-ae9a-3028b1374e0f", "value": "file.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3cdff1e-57d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779672420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672420, "uuid": "7e6a92d0-f0c3-44d7-a7c1-9007cc824679", "comment": "Malware payload (Mirai)", "value": "389dd1e5329e8228e064d0135365d821", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672420, "uuid": "93d8d40b-9661-4408-9b05-5d2bbeb65438", "comment": "Malware payload (Mirai)", "value": "6dc38b615455dc8ea8ad15beec4284fb5be1d70c5165e54f8f8bf0739b51f5dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672420, "uuid": "e7f85a01-6803-4ed3-8e9a-0b3af258e760", "comment": "Malware payload (Mirai)", "value": "d69630d94710e85e65c7ea0175366bb5f4828aba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672420, "uuid": "b632a39a-5011-42e4-8c96-64e6a6fac310", "comment": "Malware payload (Mirai)", "value": "2f0863497aea740ff59f73040d8ed25bbb37d575ecc141a543ff09223169514553ed025752eb14736248182f6a613d29", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779672420, "uuid": "f47b0249-e4ca-4366-a1ec-fecae692f9a0", "value": "T15A444B46EB404E13C4D62779BAFF82453333A7B493E7B20699246FB037C775A4E62A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779672420, "uuid": "fedfbef4-046d-4ef0-8c71-431dbe4bf7e9", "value": "6144:2CYe6RK8unxs9+3ZaLYAKaE8LtOGoMY5VuWuXh7V/GX:2deI9+ALY3aE8LtOGLV/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779672420, "uuid": "8d5fcb3a-63ba-480c-9cbe-732cdac9001d", "value": 278466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779672420, "uuid": "f36c8157-727e-4af3-899d-b1a66df8f865", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779672420, "uuid": "fb8b67a1-0fce-43cc-8cdd-c26b594271db", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55be515a-587c-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779742646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742646, "uuid": "7519df99-6f19-4218-9b38-b0eb410b765c", "comment": "Malware payload (Efimer)", "value": "939a599d7c46330306f232007a4882ab", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742646, "uuid": "f19b0a34-cbe4-4350-ae7e-be08a8c42257", "comment": "Malware payload (Efimer)", "value": "6dcad40dd90f5195a688ed6656ff46840a9a859e73471252e95d5170ce7a4a20", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742646, "uuid": "cc164694-efcf-4edb-9fd7-b5fc5aafcdbd", "comment": "Malware payload (Efimer)", "value": "406bf37d913c1061fc47250f0514340366dd445a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742646, "uuid": "0e4ed972-66df-4a3e-847e-67cdd41ead3e", "comment": "Malware payload (Efimer)", "value": "46aa26898fe5564a06036542998719724a26d311b54cf774deaa948cd1c5013d35d8dd04d19736efa5dff89802186ea3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742646, "uuid": "efde4022-2fde-427b-9265-013206393c3b", "value": "T1F5D6335DC1F351EED5E180F8BEF16BB8BC2EB435063598766908C3B0BC9302599B8997", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742646, "uuid": "2a8fd5b1-ef7f-4223-8983-51a6ed877dba", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742646, "uuid": "19f501c1-b088-4218-95f1-3ac4e3bdc3d5", "value": "393216:IO3YqnS+1ToVwndwPFXMCHWUjXNcuI3/PGTAI:IOo0TGxFXMb8X6H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779742646, "uuid": "3d8c3549-a833-42e1-9215-dd1ec0d66201", "value": 13811845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779742646, "uuid": "bc51e659-2c6b-4be6-93f0-5803499ab412", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742646, "uuid": "97afa4b3-d98f-4fe1-a1aa-d0fc1f96b5b3", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e93d841-57ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779679847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679847, "uuid": "1012479f-9238-43b3-9445-de984c44a03b", "comment": "Malware payload (Phorpiex)", "value": "1afe41b64f46b746d56f6ae955abf777", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679847, "uuid": "65c10a78-6767-48ba-9017-187ca144358e", "comment": "Malware payload (Phorpiex)", "value": "6f0562f6b82cfa2b905def04d5b0c3ba2dea88363ae29f74c2a6d757672183c4", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679847, "uuid": "7fe98d6a-c6c2-44ed-ab12-ff73dd74a58e", "comment": "Malware payload (Phorpiex)", "value": "740639f98476eafd630533c85200c519e7758b31", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679847, "uuid": "da40c280-d00a-4dc0-ad8b-2c32231b13b6", "comment": "Malware payload (Phorpiex)", "value": "43bd478f476267c98181aeed40529304cf769b378dec628aff7ef981b7d80678cbbc29a2e74416ca2109725f88f96321", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679847, "uuid": "ffbe94bb-4ac0-47f5-ae68-e2fe0928c810", "value": "T1A7824B0FF9814216D1E100B05676863BDAB99C72338454EFF7D48A990BA86E6FC3211F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679847, "uuid": "34d8087a-45b8-4cfd-ac46-c7107e927304", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679847, "uuid": "1f0b7dc5-af0b-4949-8e8d-582058a5e61a", "value": "384:UjKIJlVYeryskwEd0ZHu9JgiG7QWav8U9cTX:e80w9wa0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779679847, "uuid": "450e9fc2-dee4-46eb-badc-10d4c26643c2", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779679847, "uuid": "a2c494ee-d831-43b8-b52d-0351991b6162", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679847, "uuid": "da7feed4-0960-4aef-a62d-35348d83d490", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a2dbc7-585d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779729274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729274, "uuid": "0c96b25d-8e2f-4d54-abd7-d50b644383aa", "comment": "Malware payload", "value": "18620f2006df97c2f49b59074c957252", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729274, "uuid": "7f1513ce-a82f-4584-a473-46fd1fd73f5c", "comment": "Malware payload", "value": "6ff6844e43cca715e658fa5e3714dcd439a8aea1195df544f0efb7a00dda6540", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729274, "uuid": "bef9ee98-7721-410a-afcb-daa0bbe6bbd7", "comment": "Malware payload", "value": "a36301910eb0d11c415aa0896e8ca5aa7000aa6f", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729274, "uuid": "a717c935-2048-4bf3-b957-bc4d16145b31", "comment": "Malware payload", "value": "5d44381989c69a81e9ae4c861a41dec71b2b5998d5141e79ce6e8335a4996394b6892bdb7429645f5442a42bdd1f8641", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729274, "uuid": "b00346be-4fe4-4488-9767-da4c5a49c953", "value": "T1A9D4D042F5E5EC31D463093D08E0C66F663CBC31ABA2E98B17A5A7A71CF52E08576707", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729274, "uuid": "d1089426-652c-4101-820f-614b6c64c0fe", "value": "12288:93cVAOjj6UT5naDKk6+s7rR04bqDY001b7undDGd:9shFk6+s3R04bCI1fuid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779729274, "uuid": "b656634f-f74c-44ae-8414-9b0a716ec668", "value": 654417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779729274, "uuid": "a8ecf642-9805-439b-bd82-2a11ace35c18", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729274, "uuid": "f7e457d5-d082-4b42-9f11-65cc290bc04b", "value": "09052026_1606_TINB.docx.lnk.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b56e2df8-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747101, "uuid": "27b3b35b-6e9f-4c8b-bc13-60d8046c2f17", "comment": "Malware payload (Mirai)", "value": "8c720c62b3a39ca4dbeb9f5809f75ac0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747101, "uuid": "658ad50f-84e8-4001-9109-975730b103d6", "comment": "Malware payload (Mirai)", "value": "72b21fbc5dfec2427ed8de05f3c166a3d661e63351df58792a037cd7beffc188", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747101, "uuid": "d47e1288-86e6-44d1-b771-f2f8605178f2", "comment": "Malware payload (Mirai)", "value": "0c7d56a84e2198cfc61cecf90e4b4fdfd240396f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747101, "uuid": "ea429b8e-26c2-4675-ba53-5f4906982e00", "comment": "Malware payload (Mirai)", "value": "be7616731017712f0dbdc59690a019ee4bdf51d95e07593ae6cf14c070dff442657ca29a23d62ac8c076d9cb4ada4e86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747101, "uuid": "9f429044-40dc-4640-879e-76b495419235", "value": "T1D8041916BF110EFBD85BCD3B45B92B0124DC585A22E97B3ABA34C418F54B25F2AD3D60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747101, "uuid": "944b0e32-331e-4e5d-9d80-3fc09792989c", "value": "3072:fiN3JMJdXC9yVGNOjyqHtzfTZQ22Slfx2Bncipj:fiBJMJdXLxlfTZt2SRx7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747101, "uuid": "2b4775b8-8074-4826-89e7-8457591ca1d9", "value": 177004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747101, "uuid": "8e3ac79a-7271-4711-bfbb-304ccb20cad1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747101, "uuid": "57298b93-7b4e-4fa7-95c2-955e9ec9888e", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b27eda-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747281, "uuid": "a0e04fc1-bfd6-40e5-8af5-edb3807c3927", "comment": "Malware payload (Mirai)", "value": "233ba183387974844050bdb328a86733", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747281, "uuid": "66bfae0b-f522-4bfa-816f-7e50931dec6f", "comment": "Malware payload (Mirai)", "value": "733a3044ec0d4dd976958c38ea9c4536994eb170c399e4456bd5cd091452f415", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747281, "uuid": "5229cc76-ca0c-4c50-b98d-12939b1e94d4", "comment": "Malware payload (Mirai)", "value": "715c2dd6b895f0af4ed9cd5575cf3bfd5a9843c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747281, "uuid": "42bab6be-d5f2-4420-adeb-0a8b56d8d23b", "comment": "Malware payload (Mirai)", "value": "248a6fb7203704bdc6e7ec5e90f9482dc561711ec95c53719eac607d6a96f3f6fd108ce43133568713dfa5ac7ffc0a48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747281, "uuid": "9594e0f9-0544-4797-a2da-7d751a88d47e", "value": "T1F0539C73C8296E54D19582B4B871CB781B63B48082471FFA5BD9C2BA9083DFCF6093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747281, "uuid": "81ad2c3c-523e-414d-bdc1-23df39a9d298", "value": "1536:JaDwtqKcomlIFZCXaZMYfPkYP+gpK2mP5A/iabC0c/v38Bs/n8a:JwacomlITCXaZMYXkYWgQ2mgiabgXMla", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747281, "uuid": "9c4241a7-06fb-4f2d-b7bf-9c46fb513b77", "value": 64464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747281, "uuid": "27c8d9ea-06ad-46a5-b4fd-9162b05529ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747281, "uuid": "07f4ae19-3b13-4960-99f6-bdf6685309f1", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bc4220-5865-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779732977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732977, "uuid": "2d6a0bcb-b85f-4065-9997-a14720b3a94b", "comment": "Malware payload", "value": "e4eb25f8a2e0e95c0a24be88828ae97e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732977, "uuid": "fa34a906-a18a-4ce7-b06a-86ef4df423e6", "comment": "Malware payload", "value": "73ec75c1da8fea99f1b872d8282f0c74acb21ecb12b054d6e88fe8edb60035f6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732977, "uuid": "df6136c6-8deb-4eb6-8359-9aaa1c621d07", "comment": "Malware payload", "value": "345ad961d5a9d6f87e8ec7f76f4c734307cac4e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732977, "uuid": "73feedc8-74cf-4da3-946f-4ee3a9067c5b", "comment": "Malware payload", "value": "83b1a20fca7dcc48882b06be8801b730f136c40a161a5618db803993856d549fed6fa85f37bd72dca7ec4faf81b93b47", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732977, "uuid": "1e1d40f0-ada8-4a83-9bf5-b47f7011e7ea", "value": "T18175235C7A107A8FC94BCD334EB50D605730E2B66307E703988756FD5A2DBAA8F09963", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732977, "uuid": "a8361e63-d034-4cb0-9ef2-4d20209c1e1b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732977, "uuid": "927f1c79-844c-4c0b-9261-2183b0b1b1c3", "value": "24576:9QlXWrnIN0nhDZO2dzMmFX9YiwyM+uqaz1o2/bsC9KkKFWYBtxje:8W0NcDdBXC/zmG/Kl8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779732977, "uuid": "be3b07cd-17b6-492f-8a30-ba0593201828", "value": 1568256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779732977, "uuid": "6b4505c9-560e-4077-9a6b-29cc22f8b486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732977, "uuid": "02bb0bb1-0b66-4545-9392-884c77dbd9ee", "value": "73ec75c1da8fea99f1b872d8282f0c74acb21ecb12b054d6e88fe8edb60035f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832107ed-5886-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779747017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747017, "uuid": "ccdad54e-4535-40ac-9045-a85ae215c8fa", "comment": "Malware payload", "value": "bdc8e50a12d56158bd130f0baf68249c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747017, "uuid": "94c057bb-ace2-4377-be10-484fead11eee", "comment": "Malware payload", "value": "7838d00279a76a47da2f76cbbe87382572bed5c35af277a08b5c9485ef07f782", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747017, "uuid": "0d66cb3b-da54-45ce-b55b-11f11441b066", "comment": "Malware payload", "value": "47545f88a6aeacefeabaf76a6324ebb7fe6b2a1e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747017, "uuid": "d2715522-c1f5-444e-b8d0-61722d3c12fb", "comment": "Malware payload", "value": "0a157c484cc349ef84df18c7693fde675cf8e34f96e45dba85a02b517795edc84aa3fcf002201db956a8d901937cda1c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747017, "uuid": "0b4c541e-47e1-4b98-983f-9fbbd19dff05", "value": "T144F0218BF65300B787C100399F7BB110A1B3808B5A62DD9C7080FC548FA8EA8AC52626", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747017, "uuid": "80a3218b-6892-4699-a9e5-6b4a934ece1e", "value": "12:Yj52S1FnNg1N/1Osoqy4FaL/Vz5J/ua0UsIsrabBztEYDWizFj2DWwce8:YAmN6dBBy4IDVzvTxsIs2bBz+YDWizYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747017, "uuid": "48a57281-9abf-4fba-a1b6-634be94ac32f", "value": 649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747017, "uuid": "c9bc809a-2dee-4eec-96d0-e1b8144c79de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747017, "uuid": "22bb36b1-b3c5-476b-902d-29e02cc18137", "value": "anti.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb898a8-5867-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779733558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733558, "uuid": "049b74b0-b99f-4152-8ee6-6cb958549a58", "comment": "Malware payload", "value": "3fd4bc60daf5371af640e10f661cff3d", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733558, "uuid": "b7c9a54c-fe8d-4f4b-9b76-1f8a7b264be5", "comment": "Malware payload", "value": "79f3bf637493dd999c0add52ac4920b82a57da781355c375d807e409b4ac1dcf", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733558, "uuid": "6e7242dd-7b62-47ed-afad-5bf1af50952c", "comment": "Malware payload", "value": "e86a7329d05481109cac920bc8b2ee4e3352d2d8", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733558, "uuid": "2a0beb7c-66dc-4378-b9f5-fa8c6c608688", "comment": "Malware payload", "value": "80e946bdeec0c9550ff39bd2c11cd811e27b64dd6aabe90bc2a093a2e239b6794b63f104a068de376e0cbc6cc913b2d2", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733558, "uuid": "b3324fc7-089a-40a3-8b0c-ed0897889a57", "value": "T1B62523006151AE5FC00169F1ABABF69A635EFC78B6C54543322DB35E1374F76E083B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733558, "uuid": "5b66c09d-41b0-412d-8508-8e8d7dbd8010", "value": "24576:QX9rUoadQdOHX6ud05NOtce4vDs1zCIRefr/+8h0Qv0y:QXNUZdQM3HOD+zCIKJs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779733558, "uuid": "6316f4eb-1ef2-4b29-980d-483bbb23718f", "value": 990720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779733558, "uuid": "1de3857a-157a-4395-9a17-e679ae96f745", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733558, "uuid": "8d6341c5-852b-41c0-ade6-8ded68105992", "value": "SecuriteInfo.com.X97M.DownLoader.2343.7123.19647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ad04616-585c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779729018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729018, "uuid": "cb123783-e2d0-4503-a6b6-ec270cedadd6", "comment": "Malware payload", "value": "5b9de713c314c77de51f863954a44df8", "object_relation": "md5", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729018, "uuid": "00de71a5-03f7-4d11-873f-e4e4dd5acd16", "comment": "Malware payload", "value": "7a7f5a9fe72d80ff53a1f2c6af50d022d49695e29e423b76e318d264f3b0dd14", "object_relation": "sha256", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729018, "uuid": "499054bc-892d-4d14-8cc3-7aed5da45477", "comment": "Malware payload", "value": "8004af309c7c1263f45ee19f3365287e24f91d74", "object_relation": "sha1", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729018, "uuid": "6873d3d6-740f-494b-a2fa-6a3e766b0ff6", "comment": "Malware payload", "value": "5d8d9f95aae9565b8c5560eefa2dc816f9e9086760fec9092491c955fe7cfad1b45991942b27d289acd1c1e2cad41f39", "object_relation": "sha3-384", "Tag": [ { "name": "Plugx", "colour": "#E3F57B", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729018, "uuid": "cbeeeed3-7ca0-40ae-b9b2-346fb703dd98", "value": "T1626533AC03B3D74C18FA7CB9A7031033D5AB6D96EA749B1AC125967FE7224B4C5860F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729018, "uuid": "4845d4b8-f50d-4a5a-9b10-2458e7b93758", "value": "24576:r4zyZnvquhcyTeE5DSxkJK8v1LucKUdO+c6SIh2vQrSvoPnV+wzgpY0:rcyMxq1rO+c6XSfwfX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779729018, "uuid": "feff8a90-68cc-48b9-bb8d-5a0567f6f0c7", "value": 1510130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779729018, "uuid": "9ec5010e-8ecf-41ea-8b3b-c016e609c15c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729018, "uuid": "87eb8384-b608-4d77-acd6-d2161573968f", "value": "AspexHelperiWD.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68bd0d6c-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747402, "uuid": "50659018-c681-4a4e-930b-bba5144d3b9a", "comment": "Malware payload (Mirai)", "value": "6333ce711100f11717b5c32231a1552f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747402, "uuid": "db0004d1-5627-44b7-b6ad-9abb7dbfeff9", "comment": "Malware payload (Mirai)", "value": "7b532175be565ad6da5bda8d6d7bc2d57460fb49fa4c8434f57d46848d541e75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747402, "uuid": "d85f5d53-2872-4189-bf3a-b090f51784d5", "comment": "Malware payload (Mirai)", "value": "cdca3920c1135d33fee1ac1c90034d25da3d50cc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747402, "uuid": "5b4d7ade-19eb-4a3c-a092-874f55aadda6", "comment": "Malware payload (Mirai)", "value": "b1cd1619dbdec21d427a35a5153dec5d74106ec52af37f3ff1c11a3fda1aedb993c76156bdab1627163678f1c72f66fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747402, "uuid": "66dc6ea0-885e-4b17-82c7-c6c3837ef316", "value": "T1F5535BC5AA47D8F6FD5602711173EB378632F13A1129DA87C7A9ED32BC52900EA1739C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747402, "uuid": "66a84274-f3ae-41c5-bc8e-63dae7856dec", "value": "1536:ahZerRy3lVDKvfb9IZG4R9bdx6vQlP++CMq32UFSTGhk15uJnaroXf:ahqo3lVDKbd4bZP+zf2UMT2M5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747402, "uuid": "396703fc-457e-4717-99b1-7cc08f3f1e14", "value": 62928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747402, "uuid": "54b7cfd2-082b-4d1b-8f11-891f3c8a7b74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747402, "uuid": "b67cfdb2-bc03-4048-9e68-421408d157b9", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036b20c3-582b-11f1-a769-42010a9c0008", "comment": "Malware payload (WannaCry)", "timestamp": 1779707718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707718, "uuid": "5b54c82c-f093-491b-bfb7-58e9e5548acc", "comment": "Malware payload (WannaCry)", "value": "1e77c609fbcc2c7d61b84a843b5322ef", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707718, "uuid": "7a4c3689-f934-41bf-81fd-ff7ce2d9e049", "comment": "Malware payload (WannaCry)", "value": "7b72e13e504b6a8855b440ddbd9df4ac1d5d0559288b4d5bc34e78909d901633", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707718, "uuid": "51dc9954-3e9e-4290-8b4f-621ed1519f4c", "comment": "Malware payload (WannaCry)", "value": "f8aba1eca44b9d4aaabd9d0b6d43d75b73e9f413", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707718, "uuid": "699d9b59-21c2-44ce-912f-57fc0414870f", "comment": "Malware payload (WannaCry)", "value": "501c0dcb0702e94400efeb1d2831666ee7d19b4166cddbb9f7c1b8937b105aa886d10eb9ac78f6fd515de4defad0dc4f", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707718, "uuid": "30177fb0-41bc-4ea9-81f0-9b960cd4c715", "value": "T1C636F126FBC2AC18E40E8171A561DFF76863B5F2456B833BF89343DE49B52A17F10921", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707718, "uuid": "cacc86f0-fadf-4245-879b-ff122849a222", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707718, "uuid": "e8e3a5ba-de84-4a7b-81ef-1e743b9ea1e4", "value": "98304:DXDqPoVaRxcSUDk36SAEdhvxWa9P593R8yAVp2H:DXDqPaCxcxk3ZAEUadzR8yc4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779707718, "uuid": "a80d14e7-803f-495a-9360-f79e876bd7ad", "value": 5298176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779707718, "uuid": "ca938c60-32a1-4ddc-944a-b91bb0e1d2e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707718, "uuid": "a4bd976e-f14f-4c43-8c0a-e16c292c4d77", "value": "7b72e13e504b6a8855b440ddbd9df4ac1d5d0559288b4d5bc34e78909d901633", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3159ce85-57ef-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779682026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779682026, "uuid": "e67cd04d-2534-4ed0-99d9-c3866dc337b3", "comment": "Malware payload (AsyncRAT)", "value": "f117e94a073152ac231150808a4cd198", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779682026, "uuid": "79afe1bb-0982-4386-8b9d-1410d817f5f0", "comment": "Malware payload (AsyncRAT)", "value": "7b8787d64d8a0349bb302fca1a76267de0d2273deb069016c2c019271cb8115d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779682026, "uuid": "e38ec08b-e77a-4500-a661-2be2899feb7d", "comment": "Malware payload (AsyncRAT)", "value": "73c176bead50dfeabef02558de214e01210cbcd8", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779682026, "uuid": "021b4938-34dd-455d-8be9-abe13a0a3621", "comment": "Malware payload (AsyncRAT)", "value": "9f1383e7e2a53fa4375063b5b782420746552862f10f7b9ae95d95991793eb6e816284a83a43f838c20c1f4d71c4214c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779682026, "uuid": "210069a4-46a9-48b1-bc50-dbe490587fb8", "value": "T142235C4037A88136F2BD87B8ADF2E5458675D2672903CB596CC814EA2F13FC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779682026, "uuid": "759a250f-9bd7-442a-894e-1adba35d6921", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779682026, "uuid": "3fcaedbc-ca58-44ac-8c18-eeb5fdc32e38", "value": "768:ABUQgNIL4+M0+LiZtelDSN+iV08YbygeAJeQvEgK/J/ZVc6KN:AB1gjsZtKDs4zb1bdnkJ/ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779682026, "uuid": "41ba9c81-5190-4629-b2ed-3883463d7fb2", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779682026, "uuid": "a4db0e1d-f7d5-442a-adac-4540fbf9ebb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779682026, "uuid": "72a9758e-e3a1-4592-8842-eb49907278c1", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f152ff-57ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779679856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679856, "uuid": "57cca2bd-186c-4541-9e23-e3f971246eae", "comment": "Malware payload (Phorpiex)", "value": "1cf72933544a7b4aced108cc2788b228", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679856, "uuid": "7336427d-7e14-4172-b654-42af31d56cd4", "comment": "Malware payload (Phorpiex)", "value": "7cc61e7938e01ffdad7328af3a313006b0395082d9d9541d3a54e32ee7377478", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679856, "uuid": "50d972ff-d556-4979-ad8e-9b4c7201f8e4", "comment": "Malware payload (Phorpiex)", "value": "7b533fbce680bc3596304b4f18ec4d8d29dc8dc4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679856, "uuid": "86e66583-2264-4472-9330-78f4236c0b60", "comment": "Malware payload (Phorpiex)", "value": "a5b60eeb38cea3fc281258e3da2d25938c40e69af1b996ea6929fccc2b45db7cecd5df5811318c0dd3733dcdf0e1d9fe", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679856, "uuid": "a0ce05f9-3da8-48ea-919d-808e3d5cad73", "value": "T16C824B0FF981421AD1E100B05675863BDAB99C72338454EFF7D48A990BA86E6FC3211F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679856, "uuid": "abef40d2-205f-4dd9-9823-77ab4d6247b3", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679856, "uuid": "83dbc690-9271-4f70-b171-569c52f1df37", "value": "384:khIJlVYeryskwAd0ZHu9JgiL7QWav8U9cP:dw0w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779679856, "uuid": "e02587ca-1cdd-40e7-b16d-1062f5b6ce03", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779679856, "uuid": "8a6ec8fa-660f-4ca7-8170-47e8d73a0da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679856, "uuid": "7d89b2fd-551b-4a7f-aeac-8b2788f420ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7362498-5882-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779745359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745359, "uuid": "3e23d16b-c53a-4a7d-a549-4272c08588fc", "comment": "Malware payload", "value": "515d552edce8f178b88e63c709bb7074", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745359, "uuid": "b3558689-70cd-4be8-ae19-faa16fc6e483", "comment": "Malware payload", "value": "7d4236cb1086869a7f2b1afc96bfcd45e0f9da4970427f57f2ff89e0f533e422", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745359, "uuid": "6f4d5955-46e2-4cc4-9cbb-777cdc634dfc", "comment": "Malware payload", "value": "0b57591c84f69fbf1759497ca57d85ea051b8bdb", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745359, "uuid": "56ee978e-5ca7-4de8-b53a-d862c3057f33", "comment": "Malware payload", "value": "74d2f3aa53fe82ce7edb713c4545c54a640e5f562f3e302490c81f6721a6a9f87ebae452b541e273e020d89aa0f4183b", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745359, "uuid": "5445fab0-95d6-4a79-9330-b0df53336b8e", "value": "T1EF360896044D40E308F9DBB2F825AD8A7B9E02FF5012959C35D0DCA85B6E18B46FF1DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745359, "uuid": "6805c922-d165-4f1c-a6e6-0f2376e3462e", "value": "49152:rtGyJUjZfIu+WGQiITSv2zeH7lN6UzN5AgR7ckVfSx7zL2dZA3F5lAG0X:hcGrzN5bR7ckVfSx7zL2dZA3F5lAG0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779745359, "uuid": "5998d2b1-b3f5-44b8-ae93-fef6bfbf6a01", "value": 4911989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779745359, "uuid": "510bdd47-6671-4088-a7eb-f8fbbe9a31c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745359, "uuid": "b531aaee-6cd6-4429-9749-84ccd35e156b", "value": "small.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba7325c-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747273, "uuid": "86b53bea-f883-414d-aaf8-9ace4912a2be", "comment": "Malware payload (Mirai)", "value": "c677bd5f1d1e104ebc98cd30e2e8f4b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747273, "uuid": "70701a1d-4886-449c-ab02-7aeb0d2ea531", "comment": "Malware payload (Mirai)", "value": "7d866c3b02fd3a8f3f270c3a53c625fa980e6e3db6093acc5d564d5549dcdc16", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747273, "uuid": "499247b8-ff19-4b10-a1a7-7128ed8b4eeb", "comment": "Malware payload (Mirai)", "value": "407519347fd8ba19e8d698b8ed3e53055fba7328", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747273, "uuid": "9105251a-1c0a-4c65-bd35-96d6962ed159", "comment": "Malware payload (Mirai)", "value": "0c976d190492aec331d64e0169e945c77fef1fc658d236c0f15b8de6771836e99a8deb29fd0e3d5843e3291cbd56225c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747273, "uuid": "55eaf231-f8dc-401b-8d5f-6ed3db9ae371", "value": "T1F4430236170376D1E9273132E4A42D4AAA505FBFE0DEE41512A94BD4B3CE99B13782CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747273, "uuid": "4b65b4d3-b095-40dc-b79b-6447ceb6948a", "value": "1536:VbYeB+ErQiDLQSbWjYF97cVgGaLuy6tlV1nL+:3rVPQSyju1Ld6tlHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747273, "uuid": "08a20a2d-7889-4473-8c95-837944ce5cc6", "value": 60144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747273, "uuid": "fc6f0974-f887-4039-92c0-0c990dc34a14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747273, "uuid": "fc5d2475-dc13-4c51-ae67-1a370d682721", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b4e784-57de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779674965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779674965, "uuid": "f7dedab8-0805-47eb-8802-541ca63bc02d", "comment": "Malware payload (Mirai)", "value": "fa8bf0b2e08783dab3f3feed847e9ffc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779674965, "uuid": "05ee0bc6-c8d9-4f5c-8708-b449257d0c7f", "comment": "Malware payload (Mirai)", "value": "7e0162ee12ff8d847dfa96e93a27881b3df9da285e3309b176fedbefb4a42a27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779674965, "uuid": "9c1e0e5b-325c-4fd3-876c-bc9749440adf", "comment": "Malware payload (Mirai)", "value": "877556236cfba258b3e85f5f75e5faa046a5b921", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779674965, "uuid": "b6bebe7c-4586-40e8-80a5-5d480214610c", "comment": "Malware payload (Mirai)", "value": "e2a91b36afbabcf65af5017e075e390b5b55f77f4a38f81fccb11eea96b01460584c422dca83b80055c699c8e4755bf1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779674965, "uuid": "b963db1b-b69e-4218-83a0-990757fd6f9d", "value": "T109440A1E6E229F3DF768877047B78E25975823D627E1D684E1ACC2105F6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779674965, "uuid": "1981bd13-a88b-4a36-9bb3-f2ef26258441", "value": "6144:eGfUXg6g5LyMx1iLXrKnX/hE6VYPnxOKCsFX:Z8qyMx1iLWX505OBcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779674965, "uuid": "2fbb51f8-73fb-4f78-b6b9-94c5efe7117b", "value": 265128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779674965, "uuid": "6d53d205-3ba7-4121-9753-14c7d6494b70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779674965, "uuid": "4baa2dc5-bfde-48b4-aaa9-61d2e9840c60", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03b2a174-5871-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779737784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737784, "uuid": "83b59224-cb74-498a-8668-5fc496a0a568", "comment": "Malware payload (Mirai)", "value": "cd71bf2ebc7fa504711e4fdd68a47877", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737784, "uuid": "7f973a17-0a21-40a7-a1b2-ae1258f77762", "comment": "Malware payload (Mirai)", "value": "7f243cc41f37b3189e7474f778af3fd241f258174fe68350a9a57791bc5d8c15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737784, "uuid": "57a7dcb6-30bc-4536-9b03-fcca59655c17", "comment": "Malware payload (Mirai)", "value": "6fdd403702357d46452ee3adbb8897d8561af8b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737784, "uuid": "155ed672-66e1-4f9c-a727-c284c30f3f72", "comment": "Malware payload (Mirai)", "value": "6c85005f729440c504d7eb1bc2a924d86a9f6ea95cbbc3227fcd473ff8aaed5b63ff4b49ef41311cc21d9481764a3d4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737784, "uuid": "bebf6c20-ab22-46dc-b448-33e5fe456560", "value": "T177564A03ECA545E9C0AAD6318A629252BB71BC485B3523D33F60F3386F77BD06A79750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737784, "uuid": "a530db78-c46c-40cd-9d48-9f02083d3615", "value": "49152:iXJTdJtl8cQUVcxpbubkcAPA1H46r7bN1/f8Fy0k7DEj6NXW/T/bv62LstRMZ8de:ibJQb002A8YA1wy0CD0/LlQJsnX1Em", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779737784, "uuid": "872f95fb-bb31-4319-8b5e-56243b1c81b3", "value": 5902628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779737784, "uuid": "77e306e6-143d-4089-8105-051117879863", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737784, "uuid": "0e4c7b57-02d6-4773-9a17-a9398bf3ff59", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20039be0-57db-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779673407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779673407, "uuid": "73529925-d3e3-4d88-a806-93c006b5a8fc", "comment": "Malware payload", "value": "8be73df5a021125a2b4f2adf410507b0", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779673407, "uuid": "f71a0ce5-27e2-446c-9556-ddac1f08af40", "comment": "Malware payload", "value": "80425726b7cff2b9e76389a3dec1f67f1a03356c584e2652ed816981b1bb57e6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779673407, "uuid": "00f3d2cd-59e5-4e58-940e-ed9381e2e78c", "comment": "Malware payload", "value": "b57fc46012dbf6c364125e93a3ede6b18fde19fe", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779673407, "uuid": "70be585c-c67e-4a0d-97b2-3537db2dc457", "comment": "Malware payload", "value": "93675d6952a86e58ad3433e93c3c3c972332405a0181615ef2674b1e8ab3e889f4581c21e79ab385663a89a59b9d7231", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779673407, "uuid": "bc9c5087-5df0-41f7-8689-0609a8d51f79", "value": "T1DA136D6566913C24AE9998371D7E1F0CBDAA83E2310491DDBFCB3CF18C19A9CD21971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779673407, "uuid": "399b7ec5-778a-48c2-8a70-e0487680f5d2", "value": "768:mXRWNGxVE9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:ClxTco", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779673407, "uuid": "1aebb2d6-f06c-425a-acfb-dde0e1915644", "value": 45525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779673407, "uuid": "3b216d3f-7925-4cfb-ab35-5d63696b7053", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779673407, "uuid": "301f5483-728a-4473-a707-43e5208bc5e9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62462c12-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747391, "uuid": "61f2128d-9368-4121-aee6-1a798cf55b0a", "comment": "Malware payload (Mirai)", "value": "055ce75555ca493ccb7f8402bcdee7fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747391, "uuid": "6d8118cd-d532-46b7-bf43-52645515d1a6", "comment": "Malware payload (Mirai)", "value": "80a5d0353ae0e4a667b0d5c102c1197ca4599c9209505010b8c6f1ddead6ed08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747391, "uuid": "69f77100-8b78-4968-95cb-978912c9072c", "comment": "Malware payload (Mirai)", "value": "84b2bfccfc71c81f873db9c46fcb7fa9fddbdae7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747391, "uuid": "6310e845-7fcc-4212-8879-01c36d197674", "comment": "Malware payload (Mirai)", "value": "004afbedb571ec52f7585fe5c0be2afc6a66ea8419b9f2c044b25b2b12a0b5d7ba688a498d1012e703351a7b53e966c5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747391, "uuid": "efced7b5-c756-4c03-9ff3-b5c09e590aa6", "value": "T1AC043BC7F901D9BEF80BE77648170915B630B7E210924B337257796BEC3A0991927ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747391, "uuid": "0869b1bb-4c65-4578-90c6-ddb36f4946f0", "value": "3072:BptxC/QIuc9Uck8m+9V64KJ96mVNKVijbi+L64ASMyGyJ/uh/FESf:3txC/QIuum+9VFK7jVNXLOyGwJSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747391, "uuid": "0104b02d-a3d6-4025-a450-1d7707a076a4", "value": 175744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747391, "uuid": "c2f71832-7837-4055-a464-5cce71c5db96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747391, "uuid": "7afb8c8b-de93-4b1b-addc-57d27cccc1c0", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84aecf41-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747020, "uuid": "4ca9aa0b-d229-4567-8b79-1916b360a45c", "comment": "Malware payload (Mirai)", "value": "7b07e62c27041811c74905fc13f634e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747020, "uuid": "55515e9b-d58d-4df9-8e28-d485e1e0555b", "comment": "Malware payload (Mirai)", "value": "810e3a4668a64adaafec2fec71c88096c096f77deb8468012c64e5b8732457db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747020, "uuid": "aaddb0a8-0f8b-4dd1-9569-d3bde2cdac90", "comment": "Malware payload (Mirai)", "value": "37cb25d7ac63ab9b9aec8d62d496acc06cf9b2d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747020, "uuid": "9eaf615a-f8a0-4e60-9613-8fa58241e493", "comment": "Malware payload (Mirai)", "value": "f34b2f6657fd0f28297d782fe7bb9644df121bf9c11887f024a01c9488358954c4b2c279ee45130490df7b051d493416", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747020, "uuid": "a0dfb843-31a2-49d6-a2a3-9377c277cd86", "value": "T11724A51E6E329F7DF368873447B74A31976922D627E1D644E2ACC2145F2034E582FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747020, "uuid": "0e1f1864-e7f8-4e07-9c65-5680eec3c3d2", "value": "3072:SHFpP1IlI1qWub4BN021NsuOBt5FbnmcvPhFpC5rftUT:SlpP2lI1qWub4r02ev5FbjPJC5zOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747020, "uuid": "7c7acda5-3bad-4ad2-9501-5893683f47eb", "value": 228440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747020, "uuid": "fc67dd17-7b92-42c5-a70a-f1e09e20c0a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747020, "uuid": "228d11b5-9ce4-4747-8128-56404c8705bf", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d0195f-5824-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779704771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704771, "uuid": "4949c92d-179c-4d55-91b9-f16fedf48d5a", "comment": "Malware payload", "value": "b62925c5d2188273abcd2420a9cdbf47", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704771, "uuid": "eaebab48-ffec-4130-b318-7bb0f0008518", "comment": "Malware payload", "value": "815ad995f38f32335a5605e4097bcaf7956b4c704b7be04fb171d964373e81fa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704771, "uuid": "f3de6e38-66d8-4f1c-86a6-5b46e0495c87", "comment": "Malware payload", "value": "ee93340dfffc8dfb3de00fed02bd1dee945097db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704771, "uuid": "d3c72667-7438-4890-a101-5403f97220df", "comment": "Malware payload", "value": "bac7b28fe9e16b6b2cbeb685d36aa63b05a732774bbf60db187ca6d1e52167ff48fc32b126cc0eb6ad0441a667c83e19", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704771, "uuid": "6bae3b01-0dc5-4f76-b563-aa292cbea914", "value": "T1FB35ED25CBE505C9F1F39B2CBDB51412A8777F522A3DC94D11880E8E0A7390DADA972F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704771, "uuid": "29e5c7e8-be52-436e-8f7d-fac503aecdb6", "value": "6144:ylrPgz2+tf/WzvQ4wyhprnAvJ6cJ0ZrdCCtdbijlEId9a2oanjtaxF:yEf/J4warAc5ZRfXbijl7KRaCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779704771, "uuid": "ec6eb49b-41c6-456d-935d-2e16ed94db05", "value": 1100086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779704771, "uuid": "1192f286-c599-41b9-bb5f-f82915f5cf40", "value": "text/x-Algol68", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704771, "uuid": "ae9542e1-0780-4da3-9fe1-4946d7d871f8", "value": "New PO attachment product_list.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "122a87db-57de-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779674672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779674672, "uuid": "b164beec-5c04-4550-b415-42b75de57664", "comment": "Malware payload (Mirai)", "value": "4cbd3c14ab7427e14735d621301d8235", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779674672, "uuid": "17ffb5cc-ceae-4bac-96a7-763459ef2e96", "comment": "Malware payload (Mirai)", "value": "823e316a3a68196d83e833f234c566b76629d73b3b6c6f29970f47914c305551", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779674672, "uuid": "8b909c3e-448b-4a87-91b7-6078e230462f", "comment": "Malware payload (Mirai)", "value": "305a64551aa1e63e7834de6589b8d9065eb9e5a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779674672, "uuid": "b81d4aa8-926e-4a90-9231-a904faaaf6df", "comment": "Malware payload (Mirai)", "value": "d0ffa843cbb887f77b3a4386c57b0eb7820af35e7a9c66bc0359ec73285a69f325c59eb902bf9d1abcaa8d1b811c5923", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779674672, "uuid": "574ee0a0-31aa-4f2c-a2a8-684069eaf3d9", "value": "T15E440A06AFA10FBBD86BCE3346EA1B0625CC644722A53B397574D918F54E60F49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779674672, "uuid": "a65b44ab-e063-4785-b390-8fb44742c9ae", "value": "3072:nNNx8xcD+KgxKRmu2a13bv5ZNLD4OLp7cjDt1HieVfgfUDX:NNxeM+Kgkbv5zD4OVwjJpGmX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779674672, "uuid": "2c1167fb-4f5e-4b0d-ae07-0f5382369939", "value": 269224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779674672, "uuid": "72a3f05f-cf79-4261-a434-33e6a5308910", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779674672, "uuid": "65ec58f6-8226-422b-b9b3-4f24a3602196", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9d8a25-57fa-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779687064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779687064, "uuid": "605bee00-22eb-4432-a575-45da36158b81", "comment": "Malware payload", "value": "cb26bdc7afb26e6076668ed4a4f182ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779687064, "uuid": "03cc43ec-fe2e-4fd8-8d5d-59438fc064c2", "comment": "Malware payload", "value": "825dae63e1fbe21777b22008cbe8721bcd332e264fda561f63ffb625b2109ca0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779687064, "uuid": "cd6464c9-d8c3-4fd1-b185-b16e532a8cd2", "comment": "Malware payload", "value": "63141cd3104d19b9692808c0eb311a9fab43e422", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779687064, "uuid": "0ed15f7e-06f8-4e6e-9f28-9ee13a1d6202", "comment": "Malware payload", "value": "20dfbfe52b1d9f9f0ea71bf8068d70611d3b30864ec6cf86ee4bee3b46ede747ea8f4e5ae66448bb0aeb3fc7fd7a1445", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779687064, "uuid": "265c11e8-8c47-4a24-a445-e6e0980034f2", "value": "T15CC68C73905334D9E5A88DB4D11416526DBC388B5738A3CBBAC471F667BABE48E38730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779687064, "uuid": "8b1c5b5f-4f66-40fa-adc3-327e3f49f373", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQX:cqYUQuVDt0TZE8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779687064, "uuid": "8567b274-d670-4688-8474-63770dfa61e4", "value": 11763712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779687064, "uuid": "f138ea52-88b8-4245-8c79-ce4a5ab2e912", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779687064, "uuid": "fd3fd176-2346-4b23-a04c-b53437aa2bc4", "value": "825dae63e1fbe21777b22008cbe8721bcd332e264fda561f63ffb625b2109ca0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f481e0a-5884-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779746044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746044, "uuid": "3e601243-c788-4357-b6aa-bb75cba3b1a1", "comment": "Malware payload (ValleyRAT)", "value": "1b90923bffb9131a5ced3beea85ff532", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746044, "uuid": "f01bed62-4b60-440e-b52f-e8bbbb496f3a", "comment": "Malware payload (ValleyRAT)", "value": "82d425516199d497c3a25edc4c3ad05c14469f697230f3ad17fe03ce73cd0216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746044, "uuid": "cca5d907-9a29-40f1-b673-86ea2aedfbcb", "comment": "Malware payload (ValleyRAT)", "value": "71b87669ac14c50c35e95944708c508b68bc004c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746044, "uuid": "4f7c6709-3eed-43f8-a136-7c82784afe0a", "comment": "Malware payload (ValleyRAT)", "value": "371b4df6578d917bb061130cbe1f3f4c5911cc5e35aa4a8dbca8c6560e91e0acdd8f83b3dae5f0eac946951e24585cff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746044, "uuid": "823bb433-ff38-47c0-a717-a6013f619cec", "value": "T13133227B8B919592C36B80F3EF6A6666D6BBF0301084B917126C7D24652F4A13F7C07E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746044, "uuid": "35fe21be-a4aa-4d45-9598-90b5c709eb4d", "value": "61aee1efa149f59d7615c8dc7392ffa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746044, "uuid": "72ad92a0-a001-4354-a257-f182e3f0a341", "value": "768:LuiZJuq1l8sKTDnxxJSp5e7r43uKhe8BOiLk9Cs:TZJuq3WD5yT3XhO4fs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779746044, "uuid": "1eb2ba8e-572d-41bf-b327-892f15cec633", "value": 50176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779746044, "uuid": "bf434a08-3668-4b72-b8bc-10b0da7b9ca0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746044, "uuid": "912447ac-37e2-4e08-98eb-242c456b7a49", "value": "2026\u5e74\u7b2c\u4e00\u6279\u67e5\u5904\u4eba\u5458\u540d\u5355pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06092e85-57ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Prometei)", "timestamp": 1779679806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679806, "uuid": "9d46478d-18ff-4d8b-b1f4-753642d3c094", "comment": "Malware payload (Prometei)", "value": "5eef8e40ee97fce0baec4228b7ed755d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679806, "uuid": "e72d62c1-ee81-4f1d-9c13-ce03190ef0ea", "comment": "Malware payload (Prometei)", "value": "845964c32569452fc889f1c4a03ee56a04b524314252a1306e8d1adfed51f086", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679806, "uuid": "94183405-4275-404e-b66f-6babf520b6d1", "comment": "Malware payload (Prometei)", "value": "56a397d993f1e230fa6e54acbc80f0ec47bdf08a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679806, "uuid": "1979f933-e7ac-47e7-8a62-9b029c393318", "comment": "Malware payload (Prometei)", "value": "cb9c156303c4fa3df3fc5e60c15c4afedfed56cbeead5792080b2bc59802de6347fdb79bd207fe44f24e3f428acbfb4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679806, "uuid": "9f14b366-3bb8-4724-b2fb-80026ce4baad", "value": "T18967CF7791067CE9E9A94DB4841015816DB87C874B78A3C7BAC8B1F666FB2D08D3E730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679806, "uuid": "6251e750-dfee-423b-82a7-03519ee2ca1f", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQk:cqYUQuVDt0TZEAo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779679806, "uuid": "a236ba12-2505-42f5-9e5f-c500391ee0ee", "value": 30146560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779679806, "uuid": "b4490aad-5cf3-44c3-92eb-735c6ea32798", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679806, "uuid": "18db39c1-33f5-40ec-ae0a-a0c6b04af889", "value": "845964c32569452fc889f1c4a03ee56a04b524314252a1306e8d1adfed51f086", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ecee108-57ff-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779688867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779688867, "uuid": "5253d50e-7403-488b-a938-035c97f145d3", "comment": "Malware payload", "value": "9dd016fc0b95969c7b13e850890d606c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779688867, "uuid": "0a084822-f6da-494e-840a-99e88942b89d", "comment": "Malware payload", "value": "84b423706bd14647300e5a5442f5451f91ced636a05f191b81fabdb1e0131642", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779688867, "uuid": "f7ea3eea-59e0-44fa-9501-be287832bc38", "comment": "Malware payload", "value": "ca43a15172f90994ed6ecda69404784a6baedf94", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779688867, "uuid": "44535582-a911-466d-8e46-01368c21380e", "comment": "Malware payload", "value": "29e0136e587d1bd9e19e19324fb6cf15a7a7b4bf940b50cfbbc9c6691b1b309c9899ddd2b8a5dbfd8d8f66912be9a30a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779688867, "uuid": "a29732eb-7906-4265-b067-3c52074873b1", "value": "T11F07AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779688867, "uuid": "e42a379c-2d6d-41d9-ab7a-c21e07da5b55", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ5:cqYUQuVDt0TZE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779688867, "uuid": "a4f693c9-48ec-4766-8e1e-d81056241297", "value": 17072128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779688867, "uuid": "8d397420-7fdb-43c6-af43-688f863da150", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779688867, "uuid": "9be14d6a-74ad-4e49-b89c-58b57498e5b3", "value": "84b423706bd14647300e5a5442f5451f91ced636a05f191b81fabdb1e0131642", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b217fb-57d2-11f1-a769-42010a9c0008", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1779669903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779669903, "uuid": "5a497acd-f733-41ee-ba74-f41a56ee7354", "comment": "Malware payload (MaskGramStealer)", "value": "39823de2b5957473f676639e6181e8fc", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779669903, "uuid": "1c126aa1-a704-432c-922c-8d967e023af7", "comment": "Malware payload (MaskGramStealer)", "value": "84ce9564ef826922137dd56da0a9d3ef347eb35c7164018cd48a1433926fade6", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779669903, "uuid": "985d7fc5-9eae-4503-997e-f79b090b2db2", "comment": "Malware payload (MaskGramStealer)", "value": "6da10e8b9480c880444444c75aeb773e12f32194", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779669903, "uuid": "c33486d0-a536-4bf0-9fe7-d5b2e210b411", "comment": "Malware payload (MaskGramStealer)", "value": "75a564ad49d058229eaa213fb50d30dac30820d93bc12b3341774515f70175de6af6175754bd52f0e5a8e4faa34865a0", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779669903, "uuid": "126cae2f-2130-42d8-a05f-d432c1ae1f1e", "value": "T11C044A1BD9D141F9DC19C678869AE237A4F3B84A1936BA4F2B60EF151F44B30B71AF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779669903, "uuid": "71d0324e-e445-42c1-a1ec-d963845f74de", "value": "ba456e94eafa9e6a7757d90b7ff6310a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779669903, "uuid": "2e608a25-baad-4516-9cfe-faefaf96c59b", "value": "3072:pPRMJ6ieTN8RQZeJrVQfgnIythD3+B5RlWhW77/OU1r4q7mfno:9SjRKGrS4nIythD345RlW8vnD7mfn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779669903, "uuid": "420a64fc-a52a-4581-838c-026b9655e21b", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779669903, "uuid": "a4a015f9-93e0-4034-8645-71c9e5759e46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779669903, "uuid": "f62b5055-0279-40e0-b8ce-24e9bffdc8ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1bbe3e-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747275, "uuid": "803e6ffc-5ed5-48ac-9545-8af3b0eea305", "comment": "Malware payload (Mirai)", "value": "8166a0179a909bd4883ee5cd02f95546", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747275, "uuid": "4ad95030-b686-4e26-aada-999fa3ebdc32", "comment": "Malware payload (Mirai)", "value": "85201b221ceb454802192829933560ee26a82aaa7bcc03cbe4f355bcdd44ddda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747275, "uuid": "c043dad6-d01b-42d1-af07-472469a2ef04", "comment": "Malware payload (Mirai)", "value": "6ca90b5da8abcd263aecc06fd3ef8591d4f0b1cf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747275, "uuid": "0a797480-37b3-4506-91d8-6a39356c4157", "comment": "Malware payload (Mirai)", "value": "aa0f21018f072d5e11eaba759c602a60334ff9c1d00a5424f2dbd92daf6c742f5b878ab7f65674947512542d749b9406", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747275, "uuid": "0ce8ac5a-6b04-4bc3-8c1f-a1a12500b51c", "value": "T13303E06FE5C8B8EAC69D88F545EF43706F61344033AB0B8C92458D8D7F3A56E705A024", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747275, "uuid": "4020962f-862d-4b86-ac20-6d65c85a18f4", "value": "768:jVyIwYjG0JFyGMCucqO8X5SNrV/J18mFUxdCv69C/W5:jVyYjXJOCuLOe5Cnhv6Ac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747275, "uuid": "ece2da3a-861c-4762-83c4-64e51c5ad96d", "value": 38104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747275, "uuid": "b8c9792e-5535-49d5-b263-42703f807592", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747275, "uuid": "6fb21219-2ade-404c-91c2-4c7757fa2c57", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d5d661a-5813-11f1-a769-42010a9c0008", "comment": "Malware payload (WallStealer)", "timestamp": 1779697508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779697508, "uuid": "27e603cd-79ca-49bd-a3a8-5eca101dbdbc", "comment": "Malware payload (WallStealer)", "value": "151bd8e65d03ecfa4070516a089f1ee1", "object_relation": "md5", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779697508, "uuid": "6a941a23-93ca-43d5-be13-f30b187a4389", "comment": "Malware payload (WallStealer)", "value": "8672d109eea8f93d3709e72a8ee821f424bfda7f70ad82048ea2d1387b31c1b0", "object_relation": "sha256", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779697508, "uuid": "45379569-9182-44d0-885f-72684e184aa2", "comment": "Malware payload (WallStealer)", "value": "1dc49ebdb3ee64e82323bfc4bc5a90db22fc038b", "object_relation": "sha1", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779697508, "uuid": "6472d1b2-31d7-494e-8449-186e0267b1d9", "comment": "Malware payload (WallStealer)", "value": "8886b2ccaf54495017d0e0c86a3d945b93555e06c916d60b275035134f1b2fc9859da39f0b0dd1a2990c09c852f39f42", "object_relation": "sha3-384", "Tag": [ { "name": "b", "colour": "#F817F5", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "WallStealer", "colour": "#54AA37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779697508, "uuid": "0cc86058-af88-425c-974e-62beb3bb925e", "value": "T1D1B59E02E69649DDD47BC0F4C9117A67F4BE38240628AF376AD80B647BD2B3057ED34A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779697508, "uuid": "720b7ec0-174c-46dc-8509-bce1be6d85a0", "value": "0a60e5c14c8ed8eded1ae63abc2ca390", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779697508, "uuid": "f3ed1342-08eb-498b-ba37-505bf096ea4c", "value": "49152:rEXoJaQM3ZR0yEZCejniBShZpHuPFWz3TBEkujyukVklFM6ek1rf:rGoJ7r9mPpXkKlFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779697508, "uuid": "19ea203a-3acf-4be7-b841-8e628ee69e3b", "value": 2473984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779697508, "uuid": "736d0ad9-07e8-4e4d-9ce3-db3b36a540b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779697508, "uuid": "d20e5228-5d2d-4004-8f53-8c477d6b82ba", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e189cbdf-586d-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779736438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779736438, "uuid": "a2fec9d9-e0be-4b43-8b7a-e58c37f4447f", "comment": "Malware payload (Mirai)", "value": "6f4407cdddd84e1e2b28244d10122dfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779736438, "uuid": "e917bc33-9b5f-49ed-bfc8-7dcdcdba5baf", "comment": "Malware payload (Mirai)", "value": "880cca1e1ab0bca35241533bd176e98998f68dad06f03ba5b8983d96902f806f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779736438, "uuid": "460c09e2-0c08-4fdf-b91d-8782a372ff9b", "comment": "Malware payload (Mirai)", "value": "f6630702e1dd366acc646c8233236dc91b52a090", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779736438, "uuid": "78c7dee8-c1de-49b2-b58d-c5d865a175b7", "comment": "Malware payload (Mirai)", "value": "f620cfbb7c5ee4e61d96e7667cd5a19d2ae6dcb12c204d5d95268cb3b2024db0858319cfae5489777b94924fef0edf2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779736438, "uuid": "5d6cfae4-4e68-4beb-8eeb-2b3ebdcd67c6", "value": "T132A33B416881562BC1D533BAAAFED18D33A233F8C3EB342BCD155B11768912B4EB6F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779736438, "uuid": "eb5f15ba-6a46-451d-9208-263a56da503d", "value": "3072:Nf0Rvra2k1PA8WqBmKL8Qc0NTezYuC0+zuv1b:p0Rvrr7K8Q9NTOCdza1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779736438, "uuid": "74377a03-d7fb-42e9-8e10-551c2cf9ee82", "value": 106484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779736438, "uuid": "acf66e5f-d6d6-4a45-bc03-843bd8375874", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779736438, "uuid": "9c4befe8-c9fb-4853-98ad-468179ea3050", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235eb70b-581b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779700900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700900, "uuid": "ec04988d-f966-4550-877b-faee376f1463", "comment": "Malware payload", "value": "5f3af9f6756631a1097af707fd15e789", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700900, "uuid": "41dafc1c-fe2c-4789-86f9-874e3b7bf92a", "comment": "Malware payload", "value": "88f41dbd50a4612eba604019348b927d12a734a0794518b9b6a6924af578e815", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700900, "uuid": "d6ffcb9a-6bc3-411f-a8a5-7d248ff565bf", "comment": "Malware payload", "value": "75baf6417a2cdbeecd5c62e4f3424e9faebc7f7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700900, "uuid": "a3912bcd-4acc-48bd-9cf0-df165f0d543f", "comment": "Malware payload", "value": "167f627320e378a267f90126a0142ecc0404969ceb7e608a915707213f445f82df80ef282f7b2a9e0d303f3ac7498bad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700900, "uuid": "32c576bd-e5c8-4127-9a7d-2a14b8670839", "value": "T11E747EC5FBC65DEACB164235899B43793338FAE106575B2B0928B3341E23AD1FD86607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700900, "uuid": "b3ce25af-abc8-47cb-8f6b-e24653f9c7f9", "value": "9a78797655f20323514e2c9c23822dfc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700900, "uuid": "0a439f46-6b86-4d82-a3cc-3eca962bf4c3", "value": "3072:ZnSCuKqhmpakwx+ckmJm8cCpsSeMq3AC8007O7BRQ4q2Lx6mwDcFWM4Tr8ibSKHH:ZkPCCpBqo7O7zMH7bSKHSUjFvJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779700900, "uuid": "21ba0566-b373-4b46-b847-a2d630baaeb9", "value": 357928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779700900, "uuid": "e43af8e2-3561-4a1c-8a92-b108f89fa049", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700900, "uuid": "065c7bd5-858c-4e4c-b2fd-dac9a6cc8daa", "value": "88f41dbd50a4612eba604019348b927d12a734a0794518b9b6a6924af578e815", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe98c6c7-5862-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779731762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779731762, "uuid": "6b0c9ce1-48a7-4fe6-a4d0-f8cd3146d7b9", "comment": "Malware payload (CoinMiner)", "value": "d947b3d1160ec3d645786ec7695ade88", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779731762, "uuid": "a8b7c4d1-83c7-47bd-8041-8bd25bda40d6", "comment": "Malware payload (CoinMiner)", "value": "88f4b2193b87a76bbf56fdb7c282438f2d07a320784b2fa663ac45776ccd8bec", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779731762, "uuid": "c1110393-2930-47ef-a450-4e160f58e946", "comment": "Malware payload (CoinMiner)", "value": "b3ab50cafd56e929d8ed9cc1410325f9feefa280", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779731762, "uuid": "96be0d21-c7f2-4c86-8f52-2648bae3838a", "comment": "Malware payload (CoinMiner)", "value": "93338c0890d498653ed538fa8d34ff123216117404f2e3cc1175a9dd72ed54d8f6d6a43999a3b23165758fd1b696ac6b", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779731762, "uuid": "d6033ba7-e1a0-4617-95f5-c502899c8c24", "value": "T1A8458C0633A2C4F8FE67D0F1C6255223D672781007A89ADB64E8592DDFA3ED15BF6720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779731762, "uuid": "0f3397a5-1d4e-4446-8bae-d7bf1a7959b9", "value": "8ebf8cdff0edfb71b612fb21cbde3410", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779731762, "uuid": "fecd4b1a-db39-4c2e-b775-262fad7deff1", "value": "24576:3UNxvqF6FGYJf6yjNQpNONZNlTX5PlGPgquLEIWxUc7N11QaSYx7GqVSBj:3UNxvC6FGYJf6yjNQpNONZnTX5PlGPgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779731762, "uuid": "97353730-34c3-4057-865b-31742094192d", "value": 1269248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779731762, "uuid": "fcff1364-89c2-4937-8966-5c4fa9a9c12a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779731762, "uuid": "ce6f27d5-2111-4da0-ba63-eadc27dece27", "value": "Microsoft Windows Health Service Diagnostics.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4322a07-5895-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779753569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753569, "uuid": "a8057dfe-61c0-4c92-bead-8f3cef29e050", "comment": "Malware payload", "value": "47d39f4ed6e2ca3773cd777b77354bec", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-cont-co", "colour": "#3148E6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753569, "uuid": "70d42373-6368-4fb4-86f8-dfe67874b878", "comment": "Malware payload", "value": "89dd9159d7d1186f24c977854f9c4b89f6c608e5b1c5848aca574918e2d24d70", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-cont-co", "colour": "#3148E6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753569, "uuid": "0de1787b-ec06-43ef-a143-ce36837f7694", "comment": "Malware payload", "value": "d74bc0a2f2ea06b49549f5fecfe451b5aa632651", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-cont-co", "colour": "#3148E6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753569, "uuid": "6eafc587-c1ec-42da-b989-988d17bdf65e", "comment": "Malware payload", "value": "a5d9eb60e6ff58bfcb9afec5e37b15b146847639f379d567152e64c5c2853b9bac4b6245cb0e6b3daf66582785acff15", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-cont-co", "colour": "#3148E6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753569, "uuid": "586215ad-d324-408c-a1a6-1d4cfa15f0b4", "value": "T1D3D63398C0F2151FD299543135182912EF6990A6F681ADB3FD69A3F11CCB31BA078EDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753569, "uuid": "9ce16b8f-c3dc-4879-ab3a-0c1ca2824742", "value": "196608:e0jRgihrmx/CPvr/+FulyYbfwqFK5jpa6o38pnRuhgNLz7PO1QSRAIt5k:67CrCuHzwqg5jpW8/DBnPO1yItq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779753569, "uuid": "89f7cc1b-1b12-4fb5-b4c1-c8883bf3e1f2", "value": 13280119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779753569, "uuid": "731dd88a-50b1-4849-8dc4-e8ecbc26f002", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753569, "uuid": "f2e9fa5e-fd2f-411e-a26b-1f51ec44d64e", "value": "mbt3h2b4si.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf5e76e-57ce-11f1-a769-42010a9c0008", "comment": "Malware payload (MaskGramStealer)", "timestamp": 1779668165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779668165, "uuid": "e85b6aa9-f27f-490d-b25c-2396a02379f7", "comment": "Malware payload (MaskGramStealer)", "value": "91ecfb6b7b2c09f1dfa5a36875a997ac", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779668165, "uuid": "ad772346-6ff5-4a12-bcbc-18efe5e5974e", "comment": "Malware payload (MaskGramStealer)", "value": "8a98fbecbec0917b637a2c364a0caa4b311120d7bb3f7208c9f1fc021264336e", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779668165, "uuid": "389b849e-c923-421a-865a-bd9c272e4e75", "comment": "Malware payload (MaskGramStealer)", "value": "e2d695ece4aeed72ebbc7b02836b80bad952b47d", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779668165, "uuid": "9f45b9a3-24cf-483e-92b0-3f0ea00a5a0d", "comment": "Malware payload (MaskGramStealer)", "value": "e188c5bcae9c76b3fbcb67467cf1fad27bf0db47ee3f4909dc6aed50a1a34d526af1f605af321dd2ee557431a82f929b", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MaskGramStealer", "colour": "#20B735", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779668165, "uuid": "cc5bb0cd-3a5e-4869-99f6-036f78f768e0", "value": "T14D043A1BD4D140E9DC29C678869AE23794B3BC591936BA4F6BA0DF151F44B30B72EF04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779668165, "uuid": "46c12b90-af6a-4eec-b6fc-dfa79a288ca2", "value": "ba456e94eafa9e6a7757d90b7ff6310a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779668165, "uuid": "b94a8d53-a2d7-4de7-81ba-612238c2998b", "value": "3072:smDp9auNrb7xjEs5M92bq+UKp1vmk+dl5I/j5uL7QOJ1r4q7m0:TpFx7NW92pp1+k+d050FD7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779668165, "uuid": "990f2d17-3ace-4b03-90a4-6b00b6c2c580", "value": 177664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779668165, "uuid": "2698bf3f-e0b5-42ce-a063-e71d5764caec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779668165, "uuid": "53edc8ff-acdb-4ee8-b69f-d6104b2aa07a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fca5b58a-5885-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779746791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746791, "uuid": "26a3d747-587f-4d7a-9579-3695788ee009", "comment": "Malware payload (Mirai)", "value": "8fb93d5e6bd432171805ac76f4f3349a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746791, "uuid": "04ad5719-95cf-4a51-95cd-809ba9121c84", "comment": "Malware payload (Mirai)", "value": "8aac8d17bc0fb3fc167b1cd17abcbbfcd925fda8eb7909bea7004dfa5328edbe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746791, "uuid": "93dcbbc7-e241-4ad6-b1e7-927013bbacd1", "comment": "Malware payload (Mirai)", "value": "04c0795867ceef21f687162debfe6e85fab1a389", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746791, "uuid": "83a71eb2-c467-4b24-8321-ab6c5b587ba2", "comment": "Malware payload (Mirai)", "value": "8c1e6440ca2b32e4975285260838e2b6ccb00e086108bd3d75639c0d4fb0c89575f82c6e2010da57a69065f2700a6fe9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746791, "uuid": "48ee1513-49ba-43f0-b0e2-6c80bc3211ae", "value": "T1E4543C05EA504F67C1C11BBAFA5E438D33335F64A3DB73025E24ABB42BC6B9D1E29115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746791, "uuid": "d5504b49-59e0-46c1-8570-e7668785eeb5", "value": "6144:62/PZI3f4liazG01YERQKdC/NJcCTx6LmW+Hb1ZKjPnais8:p5+fEiaaaYEn1hLmW+Hb1AjPnais8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779746791, "uuid": "c66c81fd-61e4-47b7-8321-1022fecd7f58", "value": 295172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779746791, "uuid": "d6e6708c-ceb9-4230-9ed5-b48f5486036d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746791, "uuid": "c05bce65-34f6-40eb-8fc9-da5cddb62c40", "value": "bot-9b3cf5ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75862e57-5894-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779753007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753007, "uuid": "22c876c8-7294-49a4-ba11-7ee5ce7f5536", "comment": "Malware payload", "value": "ef42f456798492094dcc0e743105d114", "object_relation": "md5", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753007, "uuid": "0ab08a6f-e4a1-4ded-82e6-f457e1650ab5", "comment": "Malware payload", "value": "8b87bb3b61bc774d9906711ed6f0f85764ed1dbccd8be19bc36a9229b47c4dbc", "object_relation": "sha256", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753007, "uuid": "b59cede5-d66d-44e4-9c7d-304807652661", "comment": "Malware payload", "value": "4b64b03063fb6b2b9dbdf1d946f3876bbe04ff19", "object_relation": "sha1", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753007, "uuid": "22baf818-3884-42a0-a12c-58d5a30d24c7", "comment": "Malware payload", "value": "9ee19e8785ae2c4689d8b344b91ea093c55e2a8c88693f5c2046954201713f05571bd0628b64044bac75b2deee9462b7", "object_relation": "sha3-384", "Tag": [ { "name": "akmuniverstall-top", "colour": "#9B9878", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "OnyxC2", "colour": "#374BED", "exportable": true, "hide_tag": false }, { "name": "pw-2026", "colour": "#4CE282", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753007, "uuid": "0612fe33-f925-4bfc-9b3a-8666eccaf105", "value": "T1A59733511EE0B71BCF5B63C3AAD9B4A40887A32C7EAC7320CC14A44559E98DFF5A171B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753007, "uuid": "c4a24f1a-b8ad-4ecd-a395-c1ddca25356d", "value": "786432:FCUClfqWX381vozdr+RozKp2qgs3JkuNU9T/nAKuOXoFXgn6UBBrxzpsQqg+Xm:FmCv8dr+8KhNU9T/AKnXoFX+6ABrxzNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779753007, "uuid": "437d8cd4-ffcf-4c9a-8911-32ae30768934", "value": 43240069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779753007, "uuid": "0e134824-797c-44ef-9fd8-18d978a58d46", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753007, "uuid": "0bec1623-08f7-4e71-bbb5-8b8de25dd67a", "value": "Setup_File_30.723.8031.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9ab40a-5856-11f1-a769-42010a9c0008", "comment": "Malware payload (GoStealer)", "timestamp": 1779726340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779726340, "uuid": "835858a3-d2b5-4a5f-9f3b-9f83129fefee", "comment": "Malware payload (GoStealer)", "value": "c9e70b40e5b9009813b35c4204538c0e", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779726340, "uuid": "9f49761a-da4e-44b1-8a2a-88f4f3ca396b", "comment": "Malware payload (GoStealer)", "value": "8e31d8ea218e372cf5c90398aa91c6d8bf77fda473a8d5d645f2812e846232b7", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779726340, "uuid": "3ca4b332-d901-4740-b355-5298300d067a", "comment": "Malware payload (GoStealer)", "value": "32eb5dc69591433a8eb4eb2ee00131666685f3b6", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779726340, "uuid": "b140aff6-4332-4efe-a2d8-82c9ff9b3afb", "comment": "Malware payload (GoStealer)", "value": "6240a89139c406aab5e15860bebd389e0dfa2850460f3c0e1546815b8c44faa7f906db9f7f70644cf50fad9a3b65f0a2", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779726340, "uuid": "eb3086ea-4f20-4c44-9f7f-892f4004a7fb", "value": "T1CE855C1B6CA005EAD4A663328DBA22917B75BC0A1F3223D72E60727C3FB67D49D75314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779726340, "uuid": "916f3f58-5d07-44ad-b327-71064c2d1251", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779726340, "uuid": "d38bc4a4-c229-4c1e-8d62-e414023ab501", "value": "24576:+VTjN9u2b5EyncjeaCThEpXDdKWahOIn8G/NBele5yK2CxJoF6YP3UPZt:+VfNw2SynaC1sDdKWahOC8lkEF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779726340, "uuid": "fd8d9ca5-2fa7-4cb9-97be-c9a8f69c4928", "value": 1854592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779726340, "uuid": "afe4e0a5-a5f1-4c51-bd13-b7efe24f9446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779726340, "uuid": "76a39ae9-cd1e-4049-8967-46d2e51a7c60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd4761d-5858-11f1-a769-42010a9c0008", "comment": "Malware payload (BlankGrabber)", "timestamp": 1779727067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779727067, "uuid": "cdab5516-a696-45f2-8377-19a9d91a32b9", "comment": "Malware payload (BlankGrabber)", "value": "e6607bb2bfd01716c6812e505d27cd62", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779727067, "uuid": "9bbb16f4-974b-407a-b5a6-a4ee477b5283", "comment": "Malware payload (BlankGrabber)", "value": "8e5b53e2af883ee9bb0b9b4c133db2b7c5fad9ce63234126cbdde40ea2798e02", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779727067, "uuid": "b5866bb0-abc6-49e3-8ab6-db3f4d688f81", "comment": "Malware payload (BlankGrabber)", "value": "eee8d664fe0d0fb0128fae99db53bba596194fdb", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779727067, "uuid": "4b301e06-a318-4384-ba04-bf50808f1fa1", "comment": "Malware payload (BlankGrabber)", "value": "b07845f4f27c58001ccb76e9ca1e17147c51cded5091381e551f1d73e1a941afe13636d7c4a70f013084585cd3e28118", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX7.file", "colour": "#7F7AB1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779727067, "uuid": "021d1b85-3817-4662-8f93-e1b5ef4291e3", "value": "T11D773332E799FFB9C923E838A81315412676B8907772F8F15D888E11FC979E12872735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779727067, "uuid": "269d0647-7735-45ba-af71-cd0ce7d2b61d", "value": "ad510aa4318530074af11ba8249f6938", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779727067, "uuid": "87c2cdb7-949a-4095-a601-974bf6bf97c6", "value": "786432:JNUqBgX07VqK3LA3d6g2qyiNL+uRMLydI9JP7juj/6af:/XgE7VqK3K6guil+uWGi9Vc/n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779727067, "uuid": "c5f5d957-9079-43a8-a5e5-b24bfea5acf1", "value": 34333224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779727067, "uuid": "ce5b4ea4-c264-44be-b028-dc531bd80f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779727067, "uuid": "c177de6c-bf1a-47c7-8634-3e963979f4b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea1028e-5882-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779745103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745103, "uuid": "4e04aa65-ad73-44f7-886f-622cd4de5dd2", "comment": "Malware payload", "value": "375aceb30ec9e9cd66303d204265029b", "object_relation": "md5", "Tag": [ { "name": "208-64-33-64", "colour": "#F6FA55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745103, "uuid": "30595b28-2d2c-4043-aeb1-e869f4ded252", "comment": "Malware payload", "value": "8eddf076bf8b47cfd10dc5fbbd05588bc9bd7d05739671f6bc32a2d717e88e2e", "object_relation": "sha256", "Tag": [ { "name": "208-64-33-64", "colour": "#F6FA55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745103, "uuid": "bb359b98-7453-4ca0-858c-a3ecc5f8b99a", "comment": "Malware payload", "value": "53fb025e8d91e06e22e183d62c1fefd9e8148461", "object_relation": "sha1", "Tag": [ { "name": "208-64-33-64", "colour": "#F6FA55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745103, "uuid": "566a29eb-f691-4e26-a119-db0dcb66fe9c", "comment": "Malware payload", "value": "5a1c9e190400d8b7b640dcea44c24d536e776565c332b4c7f32c8cb21189386c724e59990efcea14c2393710940fcfda", "object_relation": "sha3-384", "Tag": [ { "name": "208-64-33-64", "colour": "#F6FA55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745103, "uuid": "d81f458a-be6e-476b-a7c0-cb8457e6ee57", "value": "T1366518AF6F6C2081D8975AFDB8903F0257607D9A7D94408F1182B7DF8E389A3CE9B550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745103, "uuid": "e1346beb-c243-4fd3-be4f-d4f1d96b351a", "value": "24576:i5okzroOCLlA0UdBGjnIDXOSNXVgQzIEW3PCoVpozKqpbardIuOh+0:iNoOC0Xz7jEdLnD4Whg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779745103, "uuid": "db0f8b03-e78e-436b-affe-575597e7b103", "value": 1498384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779745103, "uuid": "5494195a-1ec3-4370-a7f6-affd441215f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745103, "uuid": "b1a61de2-92a7-4274-afcf-03d2f0ee9344", "value": "Matchpool.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da869d1e-5828-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779706791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706791, "uuid": "fa867bfd-847b-4cbc-948f-2884d1d65405", "comment": "Malware payload", "value": "137f86aa2ac00862f87334efc04e4d67", "object_relation": "md5", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706791, "uuid": "023b7151-bb98-4c49-9c31-a3bf641664c2", "comment": "Malware payload", "value": "8ef35a9062369b6ce2e99571b0dc263be74ef888548a1072c609581b9adf3a93", "object_relation": "sha256", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706791, "uuid": "14feb4d3-3dfa-4d81-8bd8-285246ed7dca", "comment": "Malware payload", "value": "9e3ee1b400ea70c8bd291fbfa1162dde7c46296c", "object_relation": "sha1", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706791, "uuid": "651a5bd1-0e20-4338-ae03-ba92e6120194", "comment": "Malware payload", "value": "7f47202e92942b64df4746bb6b25ff603a7db1be2eb01846b07c00592bfa1ceb5ac2e2a6e714dad4b7c9356cf83a65c9", "object_relation": "sha3-384", "Tag": [ { "name": "Antidot", "colour": "#FF8D97", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706791, "uuid": "7522f79b-0a8a-4cec-9af5-1173cc13d97c", "value": "T172161209FA4EDC77DE357538729A6365A726B4A85320C3C747202E246F876D4CF3AAC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706791, "uuid": "2fd0e2d7-10b5-422c-a777-df1d6cfb4b6b", "value": "98304:cM1iROzwtdhEhjKPxwpxVNtRSNLcPxUftHmk6SR:cMkOzMhEeUBENAZUfMkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779706791, "uuid": "74ae0829-ba9b-48fd-99e3-bc17ef8c0a5d", "value": 4254293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779706791, "uuid": "e389fde1-ddb3-41f6-b7f1-b69824292058", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706791, "uuid": "f76587f7-8fa0-43a5-8b18-8166b6ec5083", "value": "Mise \u00e0 jour du navigateur_70f629.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7184d01f-581c-11f1-a769-42010a9c0008", "comment": "Malware payload (GoStealer)", "timestamp": 1779701461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701461, "uuid": "7a138c60-d829-4516-85b0-f6a8a4cf396a", "comment": "Malware payload (GoStealer)", "value": "5dd54b7b9e3f0c1255d41931e322d044", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701461, "uuid": "27a3044f-37fa-4517-ab7f-736ed6f70c21", "comment": "Malware payload (GoStealer)", "value": "91c51f6103b9664b70fdbfa2234017d89e088972aab0bf77fb4917f42f7383f8", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701461, "uuid": "d0ec6ef4-a3a7-47e9-a9d5-b458a7803564", "comment": "Malware payload (GoStealer)", "value": "89f0b5f15eb6ba2e73a9aed0d04637aac5933a19", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701461, "uuid": "9cbb435f-ec73-4219-b42b-708b5afb28c5", "comment": "Malware payload (GoStealer)", "value": "b8d2489aaa2b1eb34e60f1c4e2136cb43bf71b706828f3694b9cd9f00a44d4a953a578185fe6e9c1d8f9881a1c10a04e", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GOStealer", "colour": "#03D801", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779701461, "uuid": "3cd12862-0b27-461a-ac8b-4f4ab61197a1", "value": "T1D8956B1ABCD408F6C0AA63328DB762827BB5BC480F3263D72E90B6782E736D55D75750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779701461, "uuid": "0405e91f-ac4f-4b64-9918-09538c1ca19f", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779701461, "uuid": "69020853-767f-44c9-8466-2ef96df5c448", "value": "24576:Z/F9OuIDDewoAd5x6pHQpTMv4k1YoUHiKvefwKQrMtPO5Aj8m:Z/FwzDDewoA7xTpTMwkaomHvef5Qr15+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779701461, "uuid": "6cf736df-3e3f-4002-940e-454cf2323ae6", "value": 1992320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779701461, "uuid": "4e38a304-1bc4-4da4-8ac4-fc0d7e06b863", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779701461, "uuid": "579de4d1-b767-432f-abf9-8540340e7623", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21ed2cca-57ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779679852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679852, "uuid": "8cb4781b-ba79-467e-b9a9-5bf854ebd104", "comment": "Malware payload (Phorpiex)", "value": "57186a17234c577b359cd7201d70b04c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679852, "uuid": "9b4178c8-3723-40a0-9771-17b2aa709778", "comment": "Malware payload (Phorpiex)", "value": "92503b6f1962210aff30b9073f6302ac8d9896601cf1eafa401cb128d2a5a950", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679852, "uuid": "69c01958-b7cf-4e0b-8086-1c7551295969", "comment": "Malware payload (Phorpiex)", "value": "da26cee3b4ad560a5b13b8e1bf679735498c1097", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679852, "uuid": "11c0674e-b111-4688-bf1b-c64fd802b38c", "comment": "Malware payload (Phorpiex)", "value": "84a58e0cf91ef484ce778abb71c95f1dd4d4559af308f5262bc64295a1a8ff17e1e162c165ad9837027d71409fd3aff2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679852, "uuid": "78a77cf1-7d3f-4d86-8d40-dd79ee1a7eb7", "value": "T1ED824B0FF9914216D1E100B05675863BDAB99C72338454EFF7D48A9D0BA86E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679852, "uuid": "d6530ad5-6213-4bbc-9878-f99845ed67e9", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679852, "uuid": "298346ca-3fb0-4b86-9737-862149fd094e", "value": "384:e8IJlVYeryskwAd0ZHu9JgiL7QWav8U9c2:aw0w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779679852, "uuid": "e3d3c229-4185-4144-9446-62fe904d3b1d", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779679852, "uuid": "b23531a4-05af-4e10-ad9c-97f5c8d0ab05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679852, "uuid": "f26d25e9-8ede-431f-bdc4-2a164ba2ac9f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbcfa87-5892-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779752321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752321, "uuid": "477771fc-0d3f-4939-85f0-2ab9f2fa8302", "comment": "Malware payload", "value": "dd3593bedea696106559fd515bf1815c", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rept-seescanf-cc", "colour": "#74DA86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752321, "uuid": "90e505ce-3655-4f73-be39-8bda946db74c", "comment": "Malware payload", "value": "93a6c284a314f8f1a500828814cbaa5e9eb246c475a0baeeeba4916c3422c8a6", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rept-seescanf-cc", "colour": "#74DA86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752321, "uuid": "8146d670-b35c-49c3-8eed-15925dbc57f9", "comment": "Malware payload", "value": "a0aa21c015614aa8da01ef4f31be538a47cf51a0", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rept-seescanf-cc", "colour": "#74DA86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752321, "uuid": "8260710e-72df-49da-9791-60ccfb94cca2", "comment": "Malware payload", "value": "29655f49a5dff1191e002caa78235e5ebf372ab023cc7bd52ea30aeab07bc262addf7ef3ede7ceeb46ca90393541e873", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "rept-seescanf-cc", "colour": "#74DA86", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752321, "uuid": "ff19e77d-722d-42b3-82fc-b63b1c042405", "value": "T16BB63315EA442F50CD4E3B3C59CF4B91BBF6E3094127A24F4724A1CEADE72B2AF52506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752321, "uuid": "905bbb10-0905-4dad-8ad6-2924d917fe0d", "value": "196608:1RcjtjeKeZNP961wEenm1w80tI22FseKJVQdROcPK2+OcpH6Nx0V1Nr5Mm+fDmHa:1a9eKeZNP961tbBnFse2VOLPK2+OMH63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779752321, "uuid": "0e9b0dc3-fe91-4dc2-a3d4-9ab66216050a", "value": 11206674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779752321, "uuid": "9927bb53-10a9-47cf-8ddc-646f7b6bc18c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752321, "uuid": "74e6d854-4370-44e5-bdb0-7d2b231238f9", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f0ac63-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747389, "uuid": "f8618532-94cb-4058-8a21-11fe9a160d7e", "comment": "Malware payload (Mirai)", "value": "1d585b5359656b2a10edf32837e8c3cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747389, "uuid": "14b0fe0f-416c-48ed-a786-c82bc42a37a8", "comment": "Malware payload (Mirai)", "value": "952985a42f2e8e41ece9799565fe8b0c035a73dfefae4357822b581a27b288c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747389, "uuid": "a9275bfb-99f6-4010-88bf-b96a5fbc4fbe", "comment": "Malware payload (Mirai)", "value": "b52110d4af9e0a4fd475c3278054b56b82181a88", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747389, "uuid": "3c0f5278-5d4a-4853-b8fe-8ca704c9c33f", "comment": "Malware payload (Mirai)", "value": "400380a15ac0ffb56b85c9acad51ea2268c5f019fc6c17c03a6e36564df35e3364ac2e61195619d3b327ebaa06338069", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747389, "uuid": "eb4f5c99-c140-4ec7-a083-fd8958344c33", "value": "T1AA631991BD819B13C6D0227BFB5E428E372653A8D2EE72079D226F21378785F0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747389, "uuid": "4849ab7f-749b-4d0d-b617-c60853165143", "value": "1536:XGBQnw68oqNi5Igz//GIw+D3ohyaRdWViEs/hX:XGBBa5jz1w+8kayA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747389, "uuid": "f651dcf4-107c-4f2f-a331-e5b173623235", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747389, "uuid": "e9c28a06-3446-44d0-91dd-1b8703747e0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747389, "uuid": "edc223ab-3e1e-4a9a-8c9b-fe438d3d383b", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e96f5b-580f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779695969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779695969, "uuid": "73983cad-5b82-46f9-ae55-e5f7c93ca645", "comment": "Malware payload", "value": "dd94f04154822545e5db084b460805bd", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779695969, "uuid": "9c4a374b-663f-41ec-9e56-09d932087c73", "comment": "Malware payload", "value": "98a4d1dd9deb8738b2638122a96dfb8da2ff65dbef16af7aaea8bfb06f890723", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779695969, "uuid": "70d33e77-8fd8-4ef7-bf90-bab741e41103", "comment": "Malware payload", "value": "5502cd40034241ae66440437990a7540f8f70f4d", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779695969, "uuid": "dfff8bf8-1fa8-4c69-8982-1df9bb66b883", "comment": "Malware payload", "value": "6732975c32d9f988a721ae48aca5a7a4cf189da8cfafde6a4c55ad81512e8fa030723971879b48a4265e06d659dc193b", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779695969, "uuid": "84c66960-2876-4e36-b14f-9d195567b67c", "value": "T1481462E5E7C903A115A234B5069A52072371F153381D9DA8FEFC8F42BFB85D07AA86F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779695969, "uuid": "0fe973d8-62dc-430e-8539-8668715d4b11", "value": "1536:kbiHXr+OfwaUpJZaXYwuy2KjqwXEvtZ+g0TrBSd/4uVW4EWy6ISJ:+GrmaIwPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779695969, "uuid": "55325972-f4c9-45f9-abb5-7ad8b2ea3a72", "value": 195912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779695969, "uuid": "5a49c7c4-13d4-43f0-9003-48840306c3dd", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779695969, "uuid": "b94edc0c-f74e-40a7-8213-a19445dd5b45", "value": "Holiday_Photos_Alpha_485.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47384f0b-584f-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779723294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779723294, "uuid": "bea9e251-5d94-484c-8a95-2ca31e3666dc", "comment": "Malware payload", "value": "b43558748b6f235e36c21febeab9333c", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779723294, "uuid": "974bac85-29de-4939-85c1-28e3a26fa551", "comment": "Malware payload", "value": "99710995e1c8ed093fe10a381fc0740d89a6b95426020874ed829bc5a0c5042d", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779723294, "uuid": "aa3dc5d0-5b48-486a-a869-7521434d73d1", "comment": "Malware payload", "value": "406cbabdd47af8ea519c4292cad9ef5cc7afab32", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779723294, "uuid": "211e6cbb-315b-4793-8b2c-a3dca2a0ab9c", "comment": "Malware payload", "value": "a6be02883a47445abe97713a424d15331da1f9a1cf7229923711022c17fb2e96182858abb8bb3754c5fa6c7a943b391c", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779723294, "uuid": "0fde368f-d770-4d62-9815-68ca589d299e", "value": "T1CF96124F407444D0D5A66232E019AB0E5A29BCE9119F02DF1B723F20BEFCF9BAD1A575", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779723294, "uuid": "ed24d09a-25f9-476e-8748-d49aaed145ad", "value": "196608:8+XivChz/yUv0Sv4vMxrm2XF4+uQVvVDykv5rcO8CMDgyKxbFc:8+SZUvDvT+J2Jbv5rcOhMD1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779723294, "uuid": "64a9ac05-2541-47ef-8ea2-f536a2263073", "value": 9364216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779723294, "uuid": "a4dd5c8d-7c20-4e3b-9ac9-27d9121324e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779723294, "uuid": "dafadbe4-47f3-4148-b5fa-1743ae211a4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42705825-582d-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779708683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779708683, "uuid": "4e3b3000-b07c-4a34-b3dd-4911f74a60bb", "comment": "Malware payload", "value": "c9a48a8d9a44a753629dd1e6398f330b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779708683, "uuid": "e122bd32-0b44-42b0-808d-3c0b2d9263ff", "comment": "Malware payload", "value": "99d3baadfcd63564d59f5ddabbab7447390159c829cc34c3c17134405fa30212", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779708683, "uuid": "103466d2-26d9-45bc-b993-a1d0a9cf4f41", "comment": "Malware payload", "value": "d930044a55eaa2c1522263e4371be70185c400ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779708683, "uuid": "64ac0798-9170-41fa-83b2-9fd0178680aa", "comment": "Malware payload", "value": "9b07f9cbd2cdece84a1c119a3b387067fa836a46591a84625178463cf2b9fa720e9a3f082cc88a8fefdcd1812d100c65", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779708683, "uuid": "b6bcfd79-01ff-4803-b8a6-6e9bffc08b7a", "value": "T1A5967C73945224D8E1A9C9B4D51416527DB83C8B573873CBBAC472F61BBABE48E78330", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779708683, "uuid": "aa53fd9f-34a0-463a-88fb-a884ba575522", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQn:cqYUQuVDt0TZEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779708683, "uuid": "5691111e-45df-4dd9-b465-06ae57f6be12", "value": 8945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779708683, "uuid": "e8327bb7-5ae5-4521-9a94-d28263b713a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779708683, "uuid": "e1513c6a-2158-46c5-a1d9-b79e84095654", "value": "99d3baadfcd63564d59f5ddabbab7447390159c829cc34c3c17134405fa30212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518947dc-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747363, "uuid": "323c93bf-ce43-4b32-9d30-a4f0dedac053", "comment": "Malware payload (Mirai)", "value": "1531b98c1d0355e4f1b13308b9a58495", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747363, "uuid": "87c6f5b3-23da-4542-8431-a937645d0839", "comment": "Malware payload (Mirai)", "value": "9a1d23c0e1484ace5009f77c57ddcf63ebe750f316728a04666921df44f41c57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747363, "uuid": "7023b9eb-3661-4dab-8a57-520988006fbb", "comment": "Malware payload (Mirai)", "value": "0ab2c137c11628403478c5f4517a3f24f875caa1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747363, "uuid": "bd876941-c217-4784-8cd3-f191ae4b953a", "comment": "Malware payload (Mirai)", "value": "6772a038b6b394198dc5809a9ede87a99f3f91e2a95a7b21e6f05eba5a7a254b151ed89b9e9ba81bdca0b0734b66aaad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747363, "uuid": "94052669-24d2-4853-9342-eff6a9a77815", "value": "T1F5E32C46E6814B13C0D6177ABADF42453323A764D3EB73059928BFB43F8679E0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747363, "uuid": "c5631e93-8d64-4f56-b8c6-089ce87c07b0", "value": "3072:U+Ug9WIx0UEaK0U4560zSlzhXRzM9hO3+keLUM/9g2JCVF:U+UDIxLEaK0U456xl9RI9c3+ZgM/9d8T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747363, "uuid": "2e9ac5d7-a3f2-4510-b11f-80126b48230a", "value": 157131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747363, "uuid": "99f95b2b-22f9-4e49-a985-fb6f44df96f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747363, "uuid": "d68e1504-7f90-4786-af70-75e9a316b99a", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5e7782-5882-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779745207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745207, "uuid": "fc45f13a-dd86-40ca-ac66-01c9c063d548", "comment": "Malware payload", "value": "922dac4373274339f8b6e990172eb174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745207, "uuid": "40a369c9-596c-46f1-8882-d6bb0ceda3d5", "comment": "Malware payload", "value": "9a3c18be39571b479c7ee37d32f6000725a282abdf04643a1edfec460876762b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745207, "uuid": "9bb3dcec-81d2-4ee3-a29d-1217dc6aa0c4", "comment": "Malware payload", "value": "a88e90ed1908be36dab24a7290db1e2077426d36", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745207, "uuid": "1b7ba916-91f2-4bbd-9a7c-fa5f05ba5f9f", "comment": "Malware payload", "value": "a12d652a09774305fa163061aae837176922ac3d5e6fb6399ba409353dad4ec8ccefd3f84b1e3f79dadfff7b62b58c26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745207, "uuid": "1f4c1dd7-1043-4d41-a76a-66b5d1694b22", "value": "T19D5518FF00E8CCD1D4376672885AAA8E7A39AFB5539159CE1652F318ED38C4B4C17236", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745207, "uuid": "e2845739-c637-4fec-b869-b756e2884330", "value": "24576:8W6bSyB5z+zTv5cM8SKKvAWFYgggb8Tzq3dD0aa5uo+aV+7TsY8zuieMxW1NmYkt:2fn1reEFIX3Bth4JKeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779745207, "uuid": "c4044d6c-12c9-4529-b828-e76cb60b3c1e", "value": 1334984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779745207, "uuid": "924da0e1-a33a-472c-a6c0-b4537f55aa80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745207, "uuid": "661fd970-5b50-4f75-b0d3-cde38fad2166", "value": "Oyster.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b40993d7-5827-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779706297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706297, "uuid": "547b6904-e2b2-4d8c-b27f-7c06b1580cbd", "comment": "Malware payload (CoinMiner)", "value": "4e635f2f6e6d277079cee9e3296ad38b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706297, "uuid": "d7c6c656-bc7a-4769-bd05-8ba6b2d785af", "comment": "Malware payload (CoinMiner)", "value": "9aa1bc0360051ee2bf17aa4117cd5676ee26e87945fdee4a299f5e0633822947", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706297, "uuid": "bb0d2b78-3949-44f1-a30c-124e00406894", "comment": "Malware payload (CoinMiner)", "value": "9a5b14c5b8475c9446a2dd367c4557cdfd3a07b2", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706297, "uuid": "6b347948-b7de-41ce-b289-050b5955b483", "comment": "Malware payload (CoinMiner)", "value": "87bd43c1a045a3d50e74cf8938e50c1d99cfe125019219d6ec498e5679b517d9e30433bd764b57ee030918bbc351d07e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706297, "uuid": "7e1fb7b4-9947-494c-b9ce-d638be652994", "value": "T18D365B02AF445FF7C4ABCC31092EC30749ED6DC7519C653979B88A8CBA5A24A5FD788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706297, "uuid": "7ce6761f-8ec2-4a02-bea7-c0e7c5062df8", "value": "49152:w117JOSr7Tkpo+v5q9WV6QN6aJ5U1wr/h5S:w1Iprn58a/Owr/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779706297, "uuid": "05f40005-41cb-4893-ac5c-ec4d491a7504", "value": 4875828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779706297, "uuid": "cc41e2c2-d73b-403a-9498-2ece68d01bb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706297, "uuid": "70d423cd-924c-4346-851d-cb2decda8a44", "value": "bluefix.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdee69a-5831-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779710471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779710471, "uuid": "7be5f336-67fb-4808-be4f-0b99ed4a505a", "comment": "Malware payload", "value": "828e5cb9820ef3fec66b5e9522a3b944", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779710471, "uuid": "d8fc48d3-4049-4c5b-96e4-aea7f9e0b5f2", "comment": "Malware payload", "value": "9ada374acbe968520f6f188390d747c950c7cdfb2a5c76e22e9566f3e4252865", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779710471, "uuid": "098a47b2-2e7e-4cb0-8c16-05315c0b2a02", "comment": "Malware payload", "value": "9e9b94421ede1385a5d51cc7daa97b792db3266f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779710471, "uuid": "7f11f64e-65de-4d47-969e-e1ea5dadc677", "comment": "Malware payload", "value": "14540f014ae0059e9a305e8702e834c47385b62f116817d797530ddf75d5dfc215881c776b1dfc854ed126bd864afe8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779710471, "uuid": "3c2ca780-51fe-4c33-baa2-8253182d3ac7", "value": "T16337CF77814338E9E5A98DB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779710471, "uuid": "52a79ecb-b432-49dc-a32b-8d6566f22866", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQV:cqYUQuVDt0TZEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779710471, "uuid": "4eb89761-9a63-4f1e-b5ae-450bdf8379ed", "value": 23298048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779710471, "uuid": "ef8e3b08-afea-44e2-bcad-843e5e3d0637", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779710471, "uuid": "ff14e37f-e77f-4d8d-b37c-094cf3b66358", "value": "9ada374acbe968520f6f188390d747c950c7cdfb2a5c76e22e9566f3e4252865", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d7a3e3-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747109, "uuid": "473b94b0-aa24-4d5a-acb0-08378b754c70", "comment": "Malware payload (Mirai)", "value": "84876cc28c4dfda104a7c6b6578754db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747109, "uuid": "52903b0f-35f5-448e-b66a-309f4e7222e4", "comment": "Malware payload (Mirai)", "value": "9b18ac63fe65adea8a5f7ec8178753e936d78ab5efbd14bf5b51337389507b45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747109, "uuid": "a568bc35-40ee-40e8-8664-b81a74693387", "comment": "Malware payload (Mirai)", "value": "f623987331e434ad4d7ca5943f4e3fe6e5fd1a81", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747109, "uuid": "54e7f540-40be-4996-b5aa-a409d05ce985", "comment": "Malware payload (Mirai)", "value": "90b15b162ebfcf03a175f14e79a955282ea1906cb15da05da3fb0875ef68c65080617dd0e2146e0bd0bafcaeeedd859d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747109, "uuid": "b3ece2b2-b527-44f9-be9b-d6aec5aaa5e9", "value": "T160F3D60E6E25CF7DF7A8833447B7DE21966837832AE1C546E16CD7105E6028E245FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747109, "uuid": "dfa61171-f697-400c-bc12-71e0b6793b60", "value": "3072:x9Ar7T2y0qDZ/jqhJJ6TvPFY4LUuohgJk3DbMxkIsIZpSkrpgQG9TQ9flJO9a2Fs:x9Ar7T2y0qDZ/jqhJJ6TvPFY4LUuohgN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747109, "uuid": "8044530a-fc65-4626-990c-8010bb70b21b", "value": 170812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747109, "uuid": "099968a9-34bb-4a3c-b92a-f24c111831ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747109, "uuid": "48aa933c-4649-41a7-aabd-c4db65a7f991", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c0c655d-57ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779679842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679842, "uuid": "adfb256a-4489-498d-b4a8-404232175cd7", "comment": "Malware payload (Phorpiex)", "value": "f4090e9be0cda74c2ab458961b1e7c3c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679842, "uuid": "c6a53f68-72bb-41c7-9b0f-ea1731b7c2d0", "comment": "Malware payload (Phorpiex)", "value": "9d540d95b2119f00a992eb87a322f6c09a033f05a838a71a4add55414fec8a13", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679842, "uuid": "64750e79-a47b-4b89-9ae1-42971af0b978", "comment": "Malware payload (Phorpiex)", "value": "0ebd3d30f6926cdd6920f7ddd62da8ab9e0b6b4d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679842, "uuid": "6312d682-0e0d-4dcc-b608-b3b98444378a", "comment": "Malware payload (Phorpiex)", "value": "a9e6da333e43c1741b269fbfa45e1ba24f68a525c552684bee94e95c3374ac7c15808a8bd5a5c038f5e782c667409d49", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679842, "uuid": "def9221a-ae40-4cc4-835e-eabe5eeb6bbb", "value": "T15E824B0FF981421AD1E100B05675863BDAB99C72338454EFF7D48A9D0BA86E6FC3221F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679842, "uuid": "805bf432-a2b3-486d-a591-cc84939b821a", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679842, "uuid": "b91a4cca-fd24-4891-9e85-790a2807c6e6", "value": "384:M3IJlVYeryskwAd0ZHu9JgiG7QWav8U9cI:Pw0w9wa0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779679842, "uuid": "92d08836-b26b-46d0-a011-3f08edd50a5c", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779679842, "uuid": "123b0dae-3e36-47e4-bf7c-451781c586b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679842, "uuid": "af9b4e31-b78d-4ab7-8039-85148c4c0fde", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c84c77-5824-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779704877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704877, "uuid": "75db450e-f3f6-4c69-83bc-775c6204cc3e", "comment": "Malware payload", "value": "d55ce9b3905b3f365f91809b1ba6b410", "object_relation": "md5", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704877, "uuid": "a1f28bb3-2209-43b8-bb14-1b79cbc07b14", "comment": "Malware payload", "value": "9fafbc54f006ccefc3c561a8b85799cea15bfa6a6b754c4f41e7202bd06f93a4", "object_relation": "sha256", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704877, "uuid": "33cb8457-a5f2-436c-806f-b89eaee710d3", "comment": "Malware payload", "value": "9d19a7b6535362575ca506006df84734e8dc88fb", "object_relation": "sha1", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704877, "uuid": "6a58a356-8ddd-4f36-bc7c-3edc8a2a8f0b", "comment": "Malware payload", "value": "ca87bf90a9b5ae9446bd202b12eadf0bb0f8296f0ed80a140b3e0aa4c028668de3e6cc1cd0739b2b430e3065da3fb492", "object_relation": "sha3-384", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704877, "uuid": "7eabfc8e-9e2f-4473-aca6-3c9687959a32", "value": "T1870833A4BBC15D73E8C023380915A7328E26DC7C67CA8599DC72F53C65BA5C2CF39A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704877, "uuid": "095b73e1-869c-4cd2-8657-beeecf4a4100", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704877, "uuid": "02da098e-b501-426f-842c-65926b3ad547", "value": "1572864:U4o47w+niahMkREH8C5SHB1Jmz1wiPafa91unp4fRMGJyFEtGzjl:5o4BfhMxcCoHBXy1wZESp4toFE4zB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779704877, "uuid": "4c274a6a-ad70-4cc0-9083-b75f9a732ae3", "value": 79832928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779704877, "uuid": "6808a58d-efa7-4744-9371-5714a75ff9a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704877, "uuid": "34af719d-8426-432a-9959-2f183266f9a5", "value": "_1_9_f_9fafbc54f006ccefc3c561a8b85799cea15bfa6a6b754c4f41e7202bd06f93a4.file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daee2010-5869-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1779734709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779734709, "uuid": "aa29ee09-042b-4ab8-b7ff-0eb7ea65efc4", "comment": "Malware payload (Gh0stRAT)", "value": "ba1c1b53be9cbb675e347aa2719572c4", "object_relation": "md5", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779734709, "uuid": "f607ca94-4ca2-4a94-a03e-ea3df1b1ed6c", "comment": "Malware payload (Gh0stRAT)", "value": "a055948debb0fadb80965850a2e2d701ada83744c472e4df28ef7323088e5ea8", "object_relation": "sha256", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779734709, "uuid": "654c48ee-aad0-4c51-aa90-436eb50d06da", "comment": "Malware payload (Gh0stRAT)", "value": "01c614878fc5bc4726dc0a64d25b08864a796b15", "object_relation": "sha1", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779734709, "uuid": "37c0b8c7-2bca-4fb7-8ccc-e6de146e2328", "comment": "Malware payload (Gh0stRAT)", "value": "a49a79cb02ad42af13c2f6cd51f8b0354e9048e20153f212ccd3bd94bcd4de8bc24a7e8180da35d97f16595333650719", "object_relation": "sha3-384", "Tag": [ { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779734709, "uuid": "9da90185-f847-472d-93aa-aa217d157c8c", "value": "T149373312EB6D94F0E69709084BC9558080E87EA77332ADD1B5B3ADE3DA1C70D2087F5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779734709, "uuid": "7d438bb8-3568-4a25-8d92-a7bdaf29c6f1", "value": "393216:fOIjoE2PpGymel5rLwne6AIZZdxi0k5bEZFmWmPavpjAqeGVh35tDtqfl2d9c9Z:WIL2RD5rIe6AId45bAMPieGV1zDtqfic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779734709, "uuid": "e1caf9df-865b-44e3-b5bb-735af46f1660", "value": 24368922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779734709, "uuid": "388341ba-6731-4e86-8ca3-b5433ec30cab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779734709, "uuid": "51d6763d-6f11-4ec3-84dc-bd04b75e7d78", "value": "Education Improvement Plan.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76006acf-5827-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779706193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706193, "uuid": "9c84b9ea-8062-4ddc-be63-e90566592681", "comment": "Malware payload (Mirai)", "value": "696c6eec207c59ed3901837bf3b83d89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706193, "uuid": "be840e51-28dc-4fc6-a0b0-f8aa7be988ea", "comment": "Malware payload (Mirai)", "value": "a133b933a5f6df55d0b6cc9e93f444a5db6a05de77d0845536b53659ff1dd05f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706193, "uuid": "679ebc94-a998-4700-9b6c-b74c894fb104", "comment": "Malware payload (Mirai)", "value": "866cac9dc1eb7853a30c16f25b6141498efbacfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706193, "uuid": "6a8db34a-2256-4e0d-9c6c-b7ce8c64b488", "comment": "Malware payload (Mirai)", "value": "11dae46509e9b1d7a2b64aea01078bb256fc5e6945ef200ce02f8269291b014e8b6b5eac7925ad013fcef9d0a8a5283b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706193, "uuid": "5fc82794-29ba-4a2c-a547-5b8496752451", "value": "T1B0054B16F8809F22CAD125B6FB5F82A8731747B9D3EA710599188B343BD791F4F3A241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706193, "uuid": "74310374-b61f-4d9b-a9c6-7d6bad540be1", "value": "12288:fTefXpBzXTzfDJ9uiZ+u6LeRl+OpXr42WytIoMgqCo38pDRSRBY2KK/+8FQ:ifX/zXTzVxZGyRFpXrzr2OSg2KM+8F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779706193, "uuid": "0eaf327d-c747-4dd7-abee-3a70ea66ab30", "value": 863180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779706193, "uuid": "4089e82b-9b64-482a-81c3-b0bdf5633bf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706193, "uuid": "835a81e2-615c-4750-be88-99a2a8779050", "value": "nig.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffae6452-5885-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779746796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746796, "uuid": "8fc048da-55ab-4145-ad2c-c61279110ade", "comment": "Malware payload (Mirai)", "value": "7b6bfb5ba8f5ffa440cdc225638193bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746796, "uuid": "5c66411f-8021-4e62-8655-a222bc87c3f1", "comment": "Malware payload (Mirai)", "value": "a1e8095daa7e658ef5ec485e640901c6e85a2ca320574c1b2bb97409761d38d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746796, "uuid": "b23fecd3-92d3-4309-ae86-194ab3c9277b", "comment": "Malware payload (Mirai)", "value": "23e9a663985c494a285b0fd71566051632e45497", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746796, "uuid": "4977a428-88c0-4ba4-98e1-21a44ead7395", "comment": "Malware payload (Mirai)", "value": "87b091059a3f615c9fc9a2508cb83d01b8c5b6cf8025554d9fcf3840eb22f3b855aff95f0d9d5f4f8ae0298499cdbe06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746796, "uuid": "9d61587a-4ade-4d0c-84e0-3bb24ac7cf51", "value": "T1A1444B04EA404B67C1D237BAF69F038D33338B98B7E7731599289BB137C6B595E21216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746796, "uuid": "686453f8-ddfb-471a-927f-438254f20cd0", "value": "6144:5mJb7vjTPmnaTppRcwahuRJay29wuqYeV/GOV7mbF2W+RxoEC:5m9zjTPmnaTppRcwNXD4i/bV7mbFf+Re", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779746796, "uuid": "8380ab94-b24c-4199-8fec-53b0dc739991", "value": 266256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779746796, "uuid": "d3417336-8e6a-4726-9438-897b7664d1ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746796, "uuid": "18b10ace-427f-47dd-b4bf-ed9ee6d39c2e", "value": "bot-058769b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22d4102a-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747285, "uuid": "7adc88de-da1f-4641-9378-0663a98281c0", "comment": "Malware payload (Mirai)", "value": "b32b0b5362f6d9245331da03e9cae823", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747285, "uuid": "630beac3-c825-4cd4-9b62-3c9bbe93254d", "comment": "Malware payload (Mirai)", "value": "a24e12f7412ffec5f4e174f659312d8375d778f6c6c93279476c2dc332025803", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747285, "uuid": "79f229f4-5053-4515-8783-1d8270fcd820", "comment": "Malware payload (Mirai)", "value": "8ca46adfde9219326283d3d87fb6f32fd7e185ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747285, "uuid": "b80932a4-7bf7-41ec-ad2f-098d89ae4913", "comment": "Malware payload (Mirai)", "value": "05c9d998786f1886875230fb834e0d5280e86728590c92e85feb24b0a4342b53b65f0f94dacdd696b4b2b0100ed0a97a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747285, "uuid": "2277242d-2f99-4599-a3cb-ec1f662bcf01", "value": "T14443F1293767DAB2CBD0583B865084536F8D3EB6D558350B15E02BECB1AFD88C5F25C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747285, "uuid": "c2c84f2d-5301-40be-8006-96fb5d6496dc", "value": "1536:4oZVdjMI2ANMTdsJb9e8Q4Y87ejMUeY3L5:4oZbb5MTdKxe8Q47ejFL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747285, "uuid": "d28e2d5b-ea13-4442-9934-31067848a936", "value": 59012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747285, "uuid": "ef21f804-0514-46e4-a451-b23895cfdca9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747285, "uuid": "2ad9c5de-4029-4944-b0bf-fa4aea648811", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676d7f4c-5870-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779737522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737522, "uuid": "d0fdf155-381d-46ac-9735-2d4b432b6d28", "comment": "Malware payload (Mirai)", "value": "63b43654677f1c1e8bab30ea8cc66346", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737522, "uuid": "2a5cef9a-a1cc-402b-a7b7-a30f954a2d8a", "comment": "Malware payload (Mirai)", "value": "a2bd3881754e79fa01badb11d78ff329d078e8a6846ca529fbc1be783be1517c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737522, "uuid": "73873d65-3069-462c-89cb-5a7fbab06d28", "comment": "Malware payload (Mirai)", "value": "431f79e0e2da9915fd5a2a872376ceffa8d6e0d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737522, "uuid": "2a410aaa-6bcd-4636-a501-1f9c1f1985c7", "comment": "Malware payload (Mirai)", "value": "842ac8cf68d0a7efc5638ac996dddaaeae0a02b38794bec53cbdd1bce39befdf7eecc6d03e6ccdd87fdff109ddcf9d69", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737522, "uuid": "8a25d6b4-8d48-41c1-9de8-d9128face095", "value": "T134563711FECB14FAE5031A3104BBA2AF67311D058B24DBD7EB507E69FE7B6911832219", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737522, "uuid": "45885e7a-ae6b-45ec-a262-8a924d2bb969", "value": "49152:I+XHIuthqK+0JWidbycH5nPC4R7vUjmdZyhg74ST51iCqlTahhEkc5En:I+3IuzubcHQCdZyO73GTFsEkOEn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779737522, "uuid": "610d5701-63e0-4e7c-9b7a-23ffca954c94", "value": 5922978, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779737522, "uuid": "ad299480-905f-414e-b74c-722f73d205f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737522, "uuid": "25847bd2-cde5-4ec2-a2a9-9c007ef915d0", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796a2a21-585e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779729821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729821, "uuid": "bb163d78-6e66-4835-9ef8-a0608c4e4ce3", "comment": "Malware payload", "value": "7a6f296103ddb4562b3d9aa9aac15064", "object_relation": "md5", "Tag": [ { "name": "18-163-11-11", "colour": "#B8433E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729821, "uuid": "0ea65375-750a-475c-bea3-a44140eb74ce", "comment": "Malware payload", "value": "a37917329e1ab945ca8306703c03c2e472bc9ba9042c09231ac285e1a5ba4927", "object_relation": "sha256", "Tag": [ { "name": "18-163-11-11", "colour": "#B8433E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729821, "uuid": "93693ef5-6432-4de0-bde3-5e69ab4065ee", "comment": "Malware payload", "value": "b5eca1fbefddc0b9b1de24e3b2215c857c8fd67e", "object_relation": "sha1", "Tag": [ { "name": "18-163-11-11", "colour": "#B8433E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779729821, "uuid": "b285bfba-8ed7-42a3-94d8-6a1f2e45ec37", "comment": "Malware payload", "value": "19898c6a4ae6e9b190403347d27fb1f38908d54eac8d2a7937df5ed185da82962efc0407ae17765c79072c8df67a374d", "object_relation": "sha3-384", "Tag": [ { "name": "18-163-11-11", "colour": "#B8433E", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729821, "uuid": "9a19c991-970d-4081-abfd-16d8717d93a1", "value": "T17C573377A08E31C8BE16919C33805BE1F34BB849F754164ABA4FF766A0857FF11E5188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729821, "uuid": "7ad19faa-aeb6-4f13-8652-14dfe2072226", "value": "786432:DTjGLnj2L90LoYzMxouIqvO7FPlYcilMstTwNSDN7V:q32L9tYzMxFIv7FQTeSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779729821, "uuid": "ef6228f6-b6aa-496f-b614-5640f65461f6", "value": 28597054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779729821, "uuid": "85f34850-ce6c-4183-8d49-f43e1169da31", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779729821, "uuid": "adf73ba4-2aae-4f96-85b4-1fe611e19ad4", "value": "TencentMeeting.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6314378-57d2-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779669766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779669766, "uuid": "c57b0489-ba9b-4ab6-8b90-3d6473ca668b", "comment": "Malware payload (Mirai)", "value": "e3bb4d428c8611aa113f0e0deb90b33c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779669766, "uuid": "1f7dd8f9-9ff9-4640-966c-3bd982589619", "comment": "Malware payload (Mirai)", "value": "a528e37dc8ec07de6b52f5e32cc76ccfcb5e32055787f95a4547193436d29871", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779669766, "uuid": "f2086adc-cabb-4911-9f1c-55fecd54f489", "comment": "Malware payload (Mirai)", "value": "9fd3a1b612303821a0e6a232e5417716a417c576", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779669766, "uuid": "08891915-6148-4695-95cf-d467a5763ead", "comment": "Malware payload (Mirai)", "value": "c304ecf753427c8c28f8f89e97081eba8e1ae8f3f6f28a747d23a07716cb3dbe7ceab05d93e55cc4d080747cf6196858", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779669766, "uuid": "2fafb23d-a401-4b10-a2fb-7017d579a486", "value": "T1F7444B45EB404E13C4D627B9BAFF82453333A7B493E7B20699246FB037C775A4E62A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779669766, "uuid": "2e7a639e-baac-4787-898d-cf89f7d61ea8", "value": "6144:z234ITRK8unxj9GPZCAvV5a0crtOGNC05s/ouO4IV/Gvc:ze4IQ9GQAvLa0crtOGGk/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779669766, "uuid": "8a147654-2332-496a-bc1d-63d58b9c71ee", "value": 278466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779669766, "uuid": "83745655-6e82-427b-b443-e1fe3072aad3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779669766, "uuid": "2e275bd9-d8cc-45bc-ae77-821065250c29", "value": "nuclear.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50dc627-5895-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779753516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753516, "uuid": "66b8ca74-0cd7-4d32-b0eb-ecde79368e99", "comment": "Malware payload", "value": "0ba4c83a6b9fa584f1b4b13567f9a411", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-cont-co", "colour": "#3148E6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753516, "uuid": "65d1f65a-d4ee-4bb4-8e27-2088cd17a216", "comment": "Malware payload", "value": "a59750fe9bf2d7618ad759a1ae7dd963fe3ff9093a369e29757ad9820928db4e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-cont-co", "colour": "#3148E6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753516, "uuid": "1dcbae79-e30c-44e0-9fc6-9d63d47eced7", "comment": "Malware payload", "value": "434206baf59a9af7ed99825a747fad954bf0124c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-cont-co", "colour": "#3148E6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779753516, "uuid": "78da56a3-ce0b-46a0-aba7-03bff9dc1715", "comment": "Malware payload", "value": "b0a7dfe22d091938e6d22851308497dd74ad6db9501df31ca34b31d33f516d2fa30f72f64a50aa010b6a7fa460a0b599", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "sp13-gstats-api-cont-co", "colour": "#3148E6", "exportable": true, "hide_tag": false }, { "name": "ZigClipper", "colour": "#887E67", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753516, "uuid": "da2c715d-130f-47fa-9767-76eff69d4d58", "value": "T1A71691D87AC453F06929ABDC8753B4CE0794613E6FBB184C02E148BD3D0AE1766E4DAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753516, "uuid": "fec35283-ccfc-4538-a687-15867c7220fb", "value": "49152:z1Tohbv/PwQ+y3QUF/Q6QBFHRFyyjriF9y0QQWyMFNdFvyvyhytQyy4CFJrcyTyF:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779753516, "uuid": "5ed1e348-0903-4c55-b791-803c9c7cd5e3", "value": 4240910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779753516, "uuid": "d960be47-2152-4c31-a91c-aaa0d8698b6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779753516, "uuid": "42c0c5d7-5e49-4fb2-9e07-a4d9e58a8284", "value": "62156906-0062-4804-b4dd-c59dfc5449fd.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2392dd3f-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747286, "uuid": "de540aff-e7a8-4f6d-9706-d5501abef7e1", "comment": "Malware payload (Mirai)", "value": "e25d918b819cc481fbc9be8be5ea99e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747286, "uuid": "ad5628f6-f5df-4e21-8869-1ed7ea9a11e5", "comment": "Malware payload (Mirai)", "value": "a5d9bd3a12689d4d76719bf9c2638a0c7b64cb36f4951a59c7c2d4b364eb49eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747286, "uuid": "c596fe34-68de-4baa-8d1d-70a5d0a3a888", "comment": "Malware payload (Mirai)", "value": "622c128d9799a646f86882abf449c2d4d4d5986e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747286, "uuid": "c867f725-9748-4099-be0e-1e97af178ba6", "comment": "Malware payload (Mirai)", "value": "f98965198cdb1f5758314be68ebf6b1c2ca97c83008f98b1ec802523edff4e4d9f1f1225e8f899d4a48215326c3dea0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747286, "uuid": "1e1983fb-02e2-4d9a-b5b9-b621619e5d6f", "value": "T1DE430264B31101B2ED050A300BA747D8232F0FBE56876D71615AFFAB9D061EADD13DAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747286, "uuid": "f4da02fc-131c-4a57-92c6-399f958e2a93", "value": "1536:u4kKad2CGj1NUqIpaBotfHathOWSQEbBvca5VJuS:byqxt5B77CBvV5VQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747286, "uuid": "8fbf80c2-3938-4dd6-87fa-3b5d341a1a8c", "value": 58232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747286, "uuid": "f68a53d3-6f34-4d65-a5b2-68305282ef4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747286, "uuid": "ad837366-b917-4f63-bedb-d2f54593ee92", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abf5ec6-5846-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779719461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779719461, "uuid": "fb42c972-eb91-4d18-b046-26692ca251d0", "comment": "Malware payload", "value": "602e4d4fa646fc1a5d22475a11f1d1e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779719461, "uuid": "5298f2ea-239a-494c-b96d-6f863b4137ed", "comment": "Malware payload", "value": "a63ef74b52848de6fe2db8947d46cf45ce9ab08d413da719dedb826a78257c33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779719461, "uuid": "15aebbec-1e3e-4a73-97e4-35c0502411e1", "comment": "Malware payload", "value": "b06a81358d93dbd8498f38ba8134cd8cc6747a89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779719461, "uuid": "2514de4d-7be2-4bbd-95c3-220cbcb122f7", "comment": "Malware payload", "value": "f645257842dc3753cee1612e1002573ab16406cf2b2ff9cc63a33436af136994aa6bf48f9254d343e96f58a386f1a68b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779719461, "uuid": "5726414a-7bc6-4907-be9f-3efeedf6c13c", "value": "T18427BE77814338E9E5A98CB4D51025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779719461, "uuid": "0ac72d94-3a8f-485c-98ec-2e668e2dcd6e", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQb:cqYUQuVDt0TZE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779719461, "uuid": "324d1db1-2d42-4a95-ad54-2dc6d6d9dccd", "value": 20381696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779719461, "uuid": "64064811-3767-476c-80d6-8dd80766cbe5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779719461, "uuid": "336d17fe-93ca-4655-8591-e2d430c68cfa", "value": "a63ef74b52848de6fe2db8947d46cf45ce9ab08d413da719dedb826a78257c33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e440ef41-57e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779678031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678031, "uuid": "0cb87e5a-813e-4db5-a04d-f2bb2e5569bc", "comment": "Malware payload (Mirai)", "value": "2c53ce91d0f427c58fb86ef13bc62648", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678031, "uuid": "df1dbe5a-460c-442a-b002-1cd6918f24dd", "comment": "Malware payload (Mirai)", "value": "a70a206ecebbde75262e71ada01410a622f2b27da15b26e73225cc73da7ede2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678031, "uuid": "f48dccb2-9d98-4099-ba7f-3162b27ba34d", "comment": "Malware payload (Mirai)", "value": "82593b53ebd673be92262da679eba67e8d91178a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678031, "uuid": "aec3d37b-8c8a-4e45-8419-25f2fe729464", "comment": "Malware payload (Mirai)", "value": "070ae85659fe7c70ca70cfcea42d61a4a925d6f94c0e0ebc506b2d1a2d1fab50c0c3fdc7b57f13b6705fac4f26a93040", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678031, "uuid": "d1be509e-d337-418d-8239-d1dd0381cd37", "value": "T187147D01B30C0A13D1A72EF43A3F5BE193EF999125E4F6402A5FAB499272D335585ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678031, "uuid": "85cde21b-3950-431c-8acb-e58093e4fca6", "value": "3072:TjZeItG6f98jlVFfMcVVIsXDSp94ZIRtxW6FeYGanry5tIR:/HGA9SfMzsTS8ZgtxW6FeYlrysR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779678031, "uuid": "a5037b65-3ec4-4011-a16e-278351d7f275", "value": 204120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779678031, "uuid": "42864c12-10fa-4fd6-97fc-83f9dcc8844c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678031, "uuid": "3c825b03-20e0-4548-8be7-45523069f5c9", "value": "nuclear.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77977ea1-5827-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779706195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706195, "uuid": "af6eb406-00a0-4290-9dfb-f34c9d3f7d35", "comment": "Malware payload", "value": "aa775f1491d81aab04f5cca4608ae863", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706195, "uuid": "b3c67d37-3e28-471b-a3ad-e941c894e529", "comment": "Malware payload", "value": "a7f6ec561aabf56b7a9ed4f7b25077e3ec13c235989945a047a947e75733d041", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706195, "uuid": "64d4ae8e-8b8e-431e-af37-8b11009524a9", "comment": "Malware payload", "value": "1801c46caf36f60f902434dea5808c8299e4c118", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706195, "uuid": "38a49c1e-0c41-4ca8-b0a9-eb5c26e89524", "comment": "Malware payload", "value": "18b5737ab7446f0453aa37fcbb2d5b671c89375919ad33f4ef3d589ae8fc36c06aea62fe493744c6e8f2b2a840cf75d2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706195, "uuid": "c5c98929-e16d-4d4d-a835-c9363521fea3", "value": "T15E256B273711DF69D314C63005F3C6A55AE621A21BE2508AB27CC3287EA162D6D5FEFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706195, "uuid": "46f91d81-2102-4850-bdd8-8130c96848fd", "value": "24576:CG4Cq/v3jjW3WV3U0GGdFxrEi9eMZZNprRVG:l4C53y3UkdFxr3hZZNp2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779706195, "uuid": "9850aab3-3240-4ceb-a799-275613a9d893", "value": 984060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779706195, "uuid": "7e5cb3bf-2f5f-42d2-b93b-87d3d5433dee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706195, "uuid": "21d798e2-22f8-406c-a61b-52af4d60fe49", "value": "nig.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874c8939-584a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779721254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721254, "uuid": "99dc73d0-64c2-4bb9-9ff8-4092ec80d551", "comment": "Malware payload", "value": "1006cf18dbef359ddd28c09c99a4a607", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721254, "uuid": "aee9e86b-631c-4e5d-8485-e9e3b57994a1", "comment": "Malware payload", "value": "a886a7773da4421fdb0497662a05b7fcde27298338d391f6c989c54d3ce5f7e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721254, "uuid": "456fdf53-0cf6-4261-a4ba-4da0c195c348", "comment": "Malware payload", "value": "eb4b5e1e499852ba7cb2e4dcc221dbce83ad91f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721254, "uuid": "6a21fbad-10d4-4f6a-8b2d-3e6910b27f70", "comment": "Malware payload", "value": "f09166452d51e74389376149bdb8ec7d77980d317b0a5b1ca5629bbdf6103d75f1e40329130c9276f3748afe20ffeebb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779721254, "uuid": "338d8871-e42e-43ef-ada2-3d1ec84cecfb", "value": "T19E07AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779721254, "uuid": "b0067a33-d7c1-4812-b5c4-13ab28db656a", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQZ:cqYUQuVDt0TZEy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779721254, "uuid": "cf263d89-e987-40da-a134-39d457fb01be", "value": 16908288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779721254, "uuid": "a01fed3b-02e5-4cc8-9d83-83804df37498", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779721254, "uuid": "e8f9249f-bc92-416d-8f74-686d97caf609", "value": "a886a7773da4421fdb0497662a05b7fcde27298338d391f6c989c54d3ce5f7e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e94b4da1-57e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779678039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678039, "uuid": "88a75ea5-85d2-4a61-9fea-8926da31c927", "comment": "Malware payload (Mirai)", "value": "7a3a382deba261ecd9157de2f4756133", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678039, "uuid": "8bb1a1db-3388-47fa-aa47-ed37fb4bbdb0", "comment": "Malware payload (Mirai)", "value": "a8b2928f22e2b9e177b465735e2d7e3bfd575b024c99707ed5fd3ca599dc9b8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678039, "uuid": "81deeb19-dd2e-4aa9-9ce9-b8fbc029154a", "comment": "Malware payload (Mirai)", "value": "b25e639a1bd7bec301556dd6529a59e2275a5350", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678039, "uuid": "56f6c44e-9ac4-4d95-a2f2-3263fbbd8a65", "comment": "Malware payload (Mirai)", "value": "b59e347f02278f0df57be0334476d2ae36586c9930ba69dd22bc26474f245179d335ad8fbad07d8bbaeb41cb0f9cf86f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678039, "uuid": "52757d26-779c-461f-a77f-64f81bcf4a59", "value": "T183F31800FD87D1F1C8874D7150AAB33FDB31BA189127D71BEF956E32DA6BA029215E48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678039, "uuid": "0062ab97-762c-40b5-bbe6-aac68dd354c6", "value": "3072:gYnp5+7OK6SmV2Sp5vzC2D2+n8V7+vQi1F5J23W5q1RWAVO7/Eey:9IY5LC2D2+n8V7QQi1BQlYoV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779678039, "uuid": "66f890a9-a9ae-4007-99e9-90cf67984019", "value": 166248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779678039, "uuid": "fd731ccb-406a-4df1-b57c-7141df57825f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678039, "uuid": "c8654aa8-a8f6-4ecc-add3-0f1cb03eace4", "value": "nuclear.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6ea48a9-5886-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779747104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747104, "uuid": "f7381307-bfe9-4b98-86c8-22c8848def49", "comment": "Malware payload", "value": "a2e35aa5f446c1c5a632a0d2527ba075", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747104, "uuid": "669d96c5-0e0a-4ca5-86b5-c1479f1dce78", "comment": "Malware payload", "value": "a9af0ddc98065c32f92ed628f12831bf0fe953f3e35ecbbf547b2cd13f1d4090", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747104, "uuid": "316f9c47-0204-4b64-a164-48e809ae12a0", "comment": "Malware payload", "value": "4603f4b69a6346ad2c9d187f6a5f07d49506e2d9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747104, "uuid": "2c755567-ff74-4c99-9834-626c0ffb1fc5", "comment": "Malware payload", "value": "02b09d24edfad8886cd8c3824f91f44618707ac2be7c5a3688f4e843484f13e857855f8c271ee83353a413606464484d", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747104, "uuid": "8bfe3b68-0eff-4b93-b3d0-72065a5535dc", "value": "T15A21108577A30EB56CE2682F361F888431D4A4AB94CAAF592CDE34EC409EF1895405D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747104, "uuid": "6f73cc11-3bb5-4f06-b3df-68b901f96c86", "value": "24:UJkxJk2WLJkENIRksJkmKbJkBJkC+JkBJktbJk4c4kJkNJktasJkw9t:UJkxJk2WLJkvJJkmOJkBJkdJkBJkdJk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747104, "uuid": "94fd26fc-9da8-4b6f-9e27-8636b3d2f5ee", "value": 1436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747104, "uuid": "40e42215-9b59-4d50-958b-49adac6b91a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747104, "uuid": "50dbeb38-0f83-4d45-beb3-9b65f95b8cc9", "value": "dl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ee9ae5-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747293, "uuid": "8ee08c9a-93e3-4468-a709-ac9605ddf9a1", "comment": "Malware payload (Mirai)", "value": "c7abb86e296b928a135bde4dc536a3ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747293, "uuid": "cefb40cc-07c6-4c05-a5f4-0efa386f29fb", "comment": "Malware payload (Mirai)", "value": "a9b701bd6f7ee42d12db2a8426d749fe0e2e3e88f5c7c60bd4e671246c538e52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747293, "uuid": "dda8f8d0-99ca-448c-abf1-d21fc4767b1d", "comment": "Malware payload (Mirai)", "value": "4883cefe5e23f31932596631d3551fb5936efbec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747293, "uuid": "0e43b50d-e2ba-4b81-985b-1bfdf28bb0f4", "comment": "Malware payload (Mirai)", "value": "29f7d4848de07402230bfc1e9ceadc7037e98119d744ff661ec62a0c9b162e30b407b247f5dee886df22d856bf52a0f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747293, "uuid": "a3c8212f-3564-4518-9c84-e6db94eb1892", "value": "T14043F121FA504BD3CCAA8DB480AE35765F59612436DF87AC57170AC0B31A20FB5A833E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747293, "uuid": "db165bfd-aa1f-4c8e-9928-3df3d1b93c87", "value": "1536:tIrRD0gn1aEVi15uooQJpP8LIYUK5xUStQ:OdUEiOdWF8KK3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747293, "uuid": "fa39b3b5-ada9-41cc-987b-6804590ce546", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747293, "uuid": "7fb51ab7-21ae-4b7a-bb37-89625a6a745e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747293, "uuid": "7c452a85-5dfd-4eec-bf8e-670c1de5c3c3", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba8c5c14-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747110, "uuid": "8005342a-bf53-4385-adc5-0dc3cd453ee4", "comment": "Malware payload (Mirai)", "value": "48f956ab91e0e09a527ef245fbee202c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747110, "uuid": "781a7ec4-327a-4a52-bd04-b7692e02a214", "comment": "Malware payload (Mirai)", "value": "aa4a5e7228f6bed34296b5a131e00e3a6dfb291bd6a32b3d4da4015bd870cf9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747110, "uuid": "4c77f262-96fd-464c-a23b-ac996e76f822", "comment": "Malware payload (Mirai)", "value": "055ea01239654431da417ac914227b1d14e3950c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747110, "uuid": "08d69feb-e647-4f56-89d7-a8349833d042", "comment": "Malware payload (Mirai)", "value": "71e40c8f957d95159094dde9552c5c8f6e66caae4ce611427f5d6ddd6a41d1f0dc0f670c0aac7c57f418a63701e90e80", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747110, "uuid": "97387737-b98f-4011-90a6-de283ed2b31b", "value": "T145C32902F98184FDC0CAC1340B6FB63AA976F1DD1238B2EB67D4AF122D4EE615E1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747110, "uuid": "2ef3cffb-6314-4d8d-bc93-f32af97412d2", "value": "3072:R4835ggckwwNZbcnITO1yosFmIxnJdhgtDb7Bq9Fu1mzQUphojgaRFgN:RH35ggckwwNZbcnITeyosFmIxnJdhgd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747110, "uuid": "127a78ec-fdda-4372-8b7b-0219172a289e", "value": 125472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747110, "uuid": "0f8fa63e-87b4-4632-8c4e-d80112f336ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747110, "uuid": "f02c7b14-f130-458f-be3b-ea6e403ebf7c", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc212f8-5852-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779724859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779724859, "uuid": "c789515d-5a9c-448a-8c1e-4d8c2d8688eb", "comment": "Malware payload", "value": "6df6c42513d66cb3d79174e509c61271", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779724859, "uuid": "7f461f5e-1abe-4521-b275-07d059cac520", "comment": "Malware payload", "value": "aa61cd81aa7a31d87727827b667ceefc3a32a9f77c686cfe6d74098aee79a50e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779724859, "uuid": "2335f784-0941-4213-9a72-e38884b631bb", "comment": "Malware payload", "value": "9d41705b959d3eeb107ff204043eb7aa336c8e7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779724859, "uuid": "3258d4de-c589-4f6f-bbe9-ef98ecb60c19", "comment": "Malware payload", "value": "8d5dbcdbdde381f411fa476b633f0c29ed5eafb5a101ed625dd10b6755a543bcdfded1bcee0704b45bf209ac18102cc9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779724859, "uuid": "709b2998-2485-473b-94ee-c1c5d4525daf", "value": "T1AC37CF77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779724859, "uuid": "7526ea89-0745-458c-840c-614b018b227b", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQg:cqYUQuVDt0TZEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779724859, "uuid": "3a7f397c-ed39-4305-b482-24572d2f3980", "value": 22937600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779724859, "uuid": "af07bfab-81a9-4ad9-95a6-6ae9bf03f290", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779724859, "uuid": "8cf22b1a-6e36-49d9-b7a6-cd22f2b7fc03", "value": "aa61cd81aa7a31d87727827b667ceefc3a32a9f77c686cfe6d74098aee79a50e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27318d10-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747292, "uuid": "afdb144b-8c98-4051-a9b2-25291fcc1a81", "comment": "Malware payload (Mirai)", "value": "af433276e23766cc9e2b4b4504e5fe82", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747292, "uuid": "1dbfafba-5e26-4fc9-86bc-b2ace4e7e7e4", "comment": "Malware payload (Mirai)", "value": "abbaecd4fd4a6005c402147e8f893be0fbffab575bb610d025f4c95c3f034238", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747292, "uuid": "42d9c181-587e-495b-bf2c-8a42f6a0b69c", "comment": "Malware payload (Mirai)", "value": "a5f1d1969d610e41869e82a8982489efa29db442", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747292, "uuid": "c58bb6fb-5dbb-44b7-a34f-f1bb81d45642", "comment": "Malware payload (Mirai)", "value": "e1909f2277f02df525cefd4f94eedf6d9a7823b0b0b2216c9a930260cdd937e9a2d81f427f33b25375321c3791db3e5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747292, "uuid": "adbe39a4-5c6f-41c9-ada0-e28fff1068b0", "value": "T13333F2F59A12A6C4FF73FA624C8FDFA4B72119D0E36787C1920A6B0065AB5B43154FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747292, "uuid": "38971f5f-f6fa-4f39-88a4-2a8136aa3cc9", "value": "1536:gVaoF8CDX+KpdO7URfCYerKAa5UKFu/AjINnCoC4u+qgw097:+aovZsIRfoPaaKYaYCv4u+qgwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747292, "uuid": "6c10ddd3-6441-41a8-adb6-410dbf94f63f", "value": 53124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747292, "uuid": "164b972e-c40e-488a-ad2f-593751819e77", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747292, "uuid": "315541a3-f6bb-4366-abc8-6a45c23c7707", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c5a8b1-5874-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779739208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779739208, "uuid": "52de2bfa-535f-47f6-9d9c-88739ecb5461", "comment": "Malware payload (Mirai)", "value": "986fea4cc8fb3e58b0e5e7a71781bbb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779739208, "uuid": "312f911f-7015-46a5-9e7b-cb2d59adf2c1", "comment": "Malware payload (Mirai)", "value": "b126f9ee063a34a60c214e9064f96fa2a92b4d13a0ab7b4133c9baeadcfdda3f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779739208, "uuid": "d58c4fd8-0406-43de-afab-7d6747238661", "comment": "Malware payload (Mirai)", "value": "fa9d261b7d001629e2ff1c4f2989601c8e096243", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779739208, "uuid": "63ef17d6-6974-48ad-b955-153a3fff7c64", "comment": "Malware payload (Mirai)", "value": "7e996cfd5c32d8938c125a90dd3f4557607afa984266cd11a272e36b09e90ef4c5086f7c1a5844eb4bc7a13d78c597ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779739208, "uuid": "b526fd78-f3e8-4003-9671-b6a29348368d", "value": "T181D33A467F600FF3DC5ACE3706AA2709059C650965A4BF77AD64DC8CBE8B71E29E3420", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779739208, "uuid": "5c3e2f9a-8730-4b68-8b3d-eb21d4ae54de", "value": "1536:FDLuVCbyDJW3sCLeYQPV6aSu44gUaDUycXHrzjDLT7jUTHCBXRdF9:5hH3J+IaSu44g7oy+rzjDLT7jyiBXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779739208, "uuid": "fc4eb424-1251-42ae-80ca-ead7b9381a2a", "value": 133720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779739208, "uuid": "884ad30d-c61d-42ef-bc1f-fc73a173f609", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779739208, "uuid": "d70d465b-dd9e-43e0-98c6-0903b64fc48e", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaec07f3-5867-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779733877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733877, "uuid": "fb723211-e0f8-4840-8f11-5c5e31c9c40b", "comment": "Malware payload", "value": "7bdf3fa72453e76b5abed2e9bc00425e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733877, "uuid": "e191bb86-ae3c-4433-a59e-d96ed15959c8", "comment": "Malware payload", "value": "b14212857fe74349571dc653447dd59ff5938a768a65f90a3d4d653b669f8c83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733877, "uuid": "1087043a-67ec-4ca2-ae65-c98fd712c8ef", "comment": "Malware payload", "value": "08da7a48a170bc710a64f31f8e15ea5b01f0137c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779733877, "uuid": "40310279-ce7a-423c-aee7-3d79e10781c7", "comment": "Malware payload", "value": "20d787c5784a65521b1af7e2371c9aee32fe7ad82468695b258eca21da5dbb58c4705c15c7aa2e2eb8289bdb7f8fc822", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733877, "uuid": "29b6902c-777c-48b5-8ea4-ec70b8baab3f", "value": "T19BD68C77914238E9E5A98CB4D11025426DBC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733877, "uuid": "7cc254db-6764-475a-855d-723198043634", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ2:cqYUQuVDt0TZEV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779733877, "uuid": "a2b51aff-de84-4564-b588-63cc654d8a60", "value": 13303808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779733877, "uuid": "35892c35-7fab-408f-8e2f-9a7e5778855a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779733877, "uuid": "b0f378f9-48d4-467d-86a7-16af7b9937c3", "value": "b14212857fe74349571dc653447dd59ff5938a768a65f90a3d4d653b669f8c83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c6e621-582a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779707607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707607, "uuid": "1fc03d8a-c79c-4d2b-8048-4ba04b308f0b", "comment": "Malware payload", "value": "44240b145fbfe5a8adb7ba98ed67c8b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707607, "uuid": "b605a302-9943-4b40-8143-f51d3daabfe0", "comment": "Malware payload", "value": "b160d3d4c817a9ce0abdc9869476d1880875f764eef6c1da255b71c73ee159ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707607, "uuid": "d8785834-7627-4bd2-80ce-326cff882fd9", "comment": "Malware payload", "value": "bd70a166bb505468e6cc711f5b74cd63308521f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707607, "uuid": "dc7ec920-a176-4220-9d21-494cd6c14fcf", "comment": "Malware payload", "value": "57f91355891a700f7ae7a2528c9301ff75a965a225c0e4db14052085de294f0d46dd8a9847870be74be76db1a5e6a52e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707607, "uuid": "3282162e-3690-4f93-ac41-c5ab024869f4", "value": "T15D336242A3D64158F1F6673469B74F816BB6FCA16B32938F13B0724D1D71B80AA36B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707607, "uuid": "01a67ee3-610c-4a3e-9ee3-66565d566d24", "value": "e5c2f66590389755d6ee8e36a6fed940", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707607, "uuid": "728b121b-93bb-482b-bb48-39c14f212305", "value": "768:81bxW7Ag1o4g0axaR8KP4QBVBF2qepOsyVZ2OVvQaGCWk:qknf4GDJe+VZ2OVoaGCWk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779707607, "uuid": "afff9002-4a24-4f5c-9759-59463b0ddc3d", "value": 51712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779707607, "uuid": "723e397f-5616-44aa-9b4f-527fd91615b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707607, "uuid": "c2ae5066-980c-456e-b233-40fef4ebffd9", "value": "b160d3d4c817a9ce0abdc9869476d1880875f764eef6c1da255b71c73ee159ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3670f53-57e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779678029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678029, "uuid": "aacfb6c4-a034-4328-b16a-8e777044fcda", "comment": "Malware payload (Mirai)", "value": "fc8e10622ae410a99559779edc1688d1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678029, "uuid": "626230b7-e5e9-4bf8-9e42-6eb52f318598", "comment": "Malware payload (Mirai)", "value": "b19a0618ab4dcc38d8b5d6e2a7b88130e45a83cd0e6dcd8a8c7544050d00be6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678029, "uuid": "90f67d78-f242-461a-983c-770c92eaa007", "comment": "Malware payload (Mirai)", "value": "e2e2ea77498c337843e49a85531c4b4e16536f68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678029, "uuid": "e18e6c91-6502-4d1a-8648-9de3cc2e7f6b", "comment": "Malware payload (Mirai)", "value": "61ef7cc7d6846f32b66560e87a11c3338499fec7cca280c41d8eb935ed892b9a597d2b2e80cb21cf90a21d3eaff50a7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678029, "uuid": "a6e653f5-322e-4156-9535-3c5794d1378a", "value": "T1C7143B45FC405E53C6D216BABBBD818D372B27F8C3EA31179D216F60378686B0E76A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678029, "uuid": "4f564b05-6bbb-48f9-8218-82a8535126e5", "value": "3072:gZ+7eXPf3p3faKwHtvW2zdMheAyW018a4oRDBpBlgs33fQGx:gZ+72PvJfx2+IAY2a4oRBHSs33l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779678029, "uuid": "31a6e17f-fff4-4db3-9374-d3f76352c768", "value": 207584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779678029, "uuid": "b18fb8e5-03ce-434c-af7c-8f2802b07f05", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678029, "uuid": "ec43dae4-2a0f-4fec-9ddb-c71acb26e696", "value": "nuclear.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31cceea-57f6-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779685250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779685250, "uuid": "5e6c0986-a141-4c15-84fd-4d9c0cff5656", "comment": "Malware payload", "value": "03005bc9241360671269feeffd0f56ed", "object_relation": "md5", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "HEUR:Trojan.Win32.DLLhijack.gen", "colour": "#7A51A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779685250, "uuid": "c8dfcea4-8fd4-493c-ade2-1d5cc30059ea", "comment": "Malware payload", "value": "b23e7c88614b6db904199fdf2bb464b0f84598c69ad1917f99ff278dfaed00bc", "object_relation": "sha256", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "HEUR:Trojan.Win32.DLLhijack.gen", "colour": "#7A51A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779685250, "uuid": "627f725a-c30a-4f95-b30a-2600e89dfdf6", "comment": "Malware payload", "value": "a65f575b707f98d0d878c17fd929c27441eea826", "object_relation": "sha1", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "HEUR:Trojan.Win32.DLLhijack.gen", "colour": "#7A51A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779685250, "uuid": "ab54be32-808e-494d-b1cf-528e4e296518", "comment": "Malware payload", "value": "a76f14c6875a2e4447c3fa79b563940bdfa3470b8c7f3bdb7d81b0c3b64dd0625e07fb1c9d9a782ca957045df92fc632", "object_relation": "sha3-384", "Tag": [ { "name": "dllHijack", "colour": "#DE3475", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gh0st", "colour": "#2119D8", "exportable": true, "hide_tag": false }, { "name": "HEUR:Trojan.Win32.DLLhijack.gen", "colour": "#7A51A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779685250, "uuid": "a333aaef-e0b7-4aad-b69f-b8020eed302f", "value": "T11018D082B29656F6E0B7F17085F5972B9575BC108B3091CB7AA83F2A0F323D06B35716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779685250, "uuid": "d4ce71e2-8c9e-401d-99c3-994c04ba252a", "value": "6323d82b808d068b6ab4eaefb7c2594a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779685250, "uuid": "1cdc42ea-40f8-4d2c-975e-4c4b90ed65ca", "value": "1572864:lMhwn73BkXJXfC3wRnc7sGSr0jWvIdr0a+XT3qOsB+2GPGMQ3pO:my73BmjrIOIMXOpv5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779685250, "uuid": "25b3b4cf-8aec-4c50-b7ce-9567eef8fdd9", "value": 89178530, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779685250, "uuid": "e76f47b9-f4a7-459f-99ad-e2db76a84f61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779685250, "uuid": "6ae9d113-a041-44b7-ba57-3b5d6bdcc074", "value": "QuarkPC_V6.7.2.809.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b931e0bf-5816-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779699004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699004, "uuid": "9c9a016f-f22d-4854-a102-b78388450467", "comment": "Malware payload", "value": "26d423600d12aee6a1ff1792ae84c517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699004, "uuid": "a1c4d840-7be9-47e3-bb3c-e2103da07c25", "comment": "Malware payload", "value": "b30d298d1ce776b7efc937fe9a0f1dfd6ff3b51c6fef623d78d913cb2637071d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699004, "uuid": "90fc2c1d-4c0b-4adc-adef-af4ba3984716", "comment": "Malware payload", "value": "9e33b71a207718e1e52826ae1178cd7e39a71dfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699004, "uuid": "9235f12d-3efe-4275-a055-cf634aa1a09e", "comment": "Malware payload", "value": "45731d13ae21964f4fb1361e468af10207e0f15e192db583a8899d41dc0ce2bf8d64a6edeb78ab7a2eb15e4ee951c89a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699004, "uuid": "99c0aa49-83be-4b17-afd8-1ee558fa9094", "value": "T1F4074A93A85140E9C4ADE530C562E162BF717C488B2037D76BA1FB286F72BD06F7A750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699004, "uuid": "8644fd43-1496-47e7-b6a4-044f72b9295b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699004, "uuid": "23b9e439-7b54-46c1-9b8f-7d57733a7eac", "value": "98304:0LhTdjOq73XWo4WLx3QelO0tnPba2JqhQzkW2hz1ASGEQ:01Tdn7nW5WLZQelOGAxzRjQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779699004, "uuid": "07c6f27b-bb39-417d-a2f7-4d761e69569c", "value": 17682944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779699004, "uuid": "e7cdc514-9781-4a46-adc6-c218fbd4d622", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699004, "uuid": "82a4826f-7c3d-4a0f-b1f7-ae5f245893e2", "value": "26d423600d12aee6a1ff1792ae84c517.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e617fc44-587e-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779743747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779743747, "uuid": "b880b91d-c9bb-4abc-a418-38f1591656d2", "comment": "Malware payload", "value": "c0202fa655d1fea29374703ad424a49e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779743747, "uuid": "7185b0f2-6a92-4223-bbca-d7e7e20b8771", "comment": "Malware payload", "value": "b3b1ce98c4cc971867faf6ebe0ff999a14e2c4138adebc79234d45045954fd6e", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779743747, "uuid": "405987b6-da35-4921-9419-7a6b43432b56", "comment": "Malware payload", "value": "59a9eb17f07baaed77d590847116c8a2983d3180", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779743747, "uuid": "a815689b-636f-4a74-9ae4-785ec7f75361", "comment": "Malware payload", "value": "e7e1281688bdfb42d88add8cf29df8dcbd57d8fbcb063ecaf04de168ee64b19ff04dfaae47a5b50c2d524ec7911d2ea3", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779743747, "uuid": "ae30aeb7-8ff1-4b0c-935f-d5c8db8c47b0", "value": "T100653396A1E871E7868845421EBAFBA3524691C5CCB3CC6883CAF387B1DD077DE2534D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779743747, "uuid": "ce624ee9-dd2c-433e-aea1-808951aff607", "value": "24576:rg/YGNlJ9FAuau0l5vkacq8Jv3UGvwhrgCRWFasyAHDWwnJy0IjvTWgK6ze064cU:rYXzJPgu0li3q81UGY+CR4QRwPWW+y0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779743747, "uuid": "a5439d02-74bb-4bbd-92af-14d6308b15ad", "value": 1418678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779743747, "uuid": "0075d379-4c82-4cd4-ab65-c51078bc347c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779743747, "uuid": "3c262cc4-77bb-411b-9837-421c9f869912", "value": "Invio proforma.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ff649c1-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747280, "uuid": "54d1b149-ecfd-4b57-a258-4eb9b87fff9c", "comment": "Malware payload (Mirai)", "value": "b0bf3f637845dec3e0771ef25382c4e5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747280, "uuid": "2b2c9778-e7ac-4656-9254-6104d4ad7705", "comment": "Malware payload (Mirai)", "value": "b4537262f18d9b0b667aced73206f5699a0e3d197ba5ed6a165cb56708532f4e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747280, "uuid": "b3dbf1fc-874d-4c66-80ec-0ad22b36c9bd", "comment": "Malware payload (Mirai)", "value": "4c9f9684016c90f7421ca5c895f41a5f9ec85f9d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747280, "uuid": "35a92de6-d357-4722-9e51-865aaa2df940", "comment": "Malware payload (Mirai)", "value": "c58476837ff5b927a177eda56faef69190720d7e8c8d7708064e4f3bcf349d50c5a9073b1e6c136570924e19b23edd58", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747280, "uuid": "bbec3f9b-005b-42cd-8be0-3ab74bde85c1", "value": "T17C21F487F412F1B1A9B5047CAB8BB19112472427A620ED0C344D3D605F7BCA8FDB12D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747280, "uuid": "e5205dcb-4c0e-40a4-a57e-6b12c5f6363b", "value": "24:C1DeqDVBg6fyyM5Diz2R82Iza04sbsAcXGj7UowhROF6DlsybXXESxY2Do+YsyK:CJvxBRjMhK2R82Iza04sbsAcXGj7UoY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747280, "uuid": "d190c194-ad30-419f-8266-d27732c9c234", "value": 1248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747280, "uuid": "893d059f-1bc9-42e2-98d2-8be66320f78f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747280, "uuid": "174d86c4-f6f5-4330-a42c-fc8dd49a7072", "value": "cat.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20a224ca-57ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779679850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679850, "uuid": "53d23675-bc8b-48a9-bb8b-e1ac1268d8aa", "comment": "Malware payload (Phorpiex)", "value": "350a91cbaf4bbb9a64b4323cad5af6af", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679850, "uuid": "3665d2b8-e067-4665-b37c-4353e9f9ca11", "comment": "Malware payload (Phorpiex)", "value": "b458e153a8b0c8363aaa1422406de4f59ae2c637dbb8b537da6677141488aec2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679850, "uuid": "9e2a161c-c5f6-4422-9832-063ad5922b29", "comment": "Malware payload (Phorpiex)", "value": "e0da1b1831ec393e85a55ac8e1c41e87da3d6a04", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679850, "uuid": "5be226d0-db4a-4490-8f03-8cfb69d55c5e", "comment": "Malware payload (Phorpiex)", "value": "a25924af3585151dfe00f162029033c08670f7d2098bbcb360a9990ce60decb936eb4931359c0015224d87025c302846", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679850, "uuid": "7f58034a-35d0-4427-a7be-4b314cfc365c", "value": "T15E824B0FF9914216D1E100B05675863BDAB99C72338854EFF7D48A9D0BA86E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679850, "uuid": "53d99d4b-0608-4552-8371-a073d2631079", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679850, "uuid": "dc71b0a1-8d78-4953-822e-076c9adda953", "value": "384:8VIJlVYeryskwAd0ZHu9JgiL7QWav8U9ct:Jw0w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779679850, "uuid": "e8239b56-edd6-48b5-961f-20313e288659", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779679850, "uuid": "d7efb135-9743-4570-8b45-02c62bd09545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679850, "uuid": "a17e92ee-3cb6-401f-ba15-4474143a360c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e00ca2-584c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779722091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779722091, "uuid": "806627a5-1641-411d-809b-2074683bef0e", "comment": "Malware payload", "value": "c0625a50798a2359f31133068027642c", "object_relation": "md5", "Tag": [ { "name": "bromechoku-com", "colour": "#6FE32A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779722091, "uuid": "7b4613c4-8b3a-46cc-b94d-006b38498203", "comment": "Malware payload", "value": "b46d3482ff74395f09f36a0014407ff803107eb5bef70d13bfa62a86ebd7bc75", "object_relation": "sha256", "Tag": [ { "name": "bromechoku-com", "colour": "#6FE32A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779722091, "uuid": "3a41fa0b-6113-419f-a17c-cab11b37015e", "comment": "Malware payload", "value": "e9193fb1d5ac6d417999d84de6d39769b0c82b26", "object_relation": "sha1", "Tag": [ { "name": "bromechoku-com", "colour": "#6FE32A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779722091, "uuid": "40f34d60-3628-4700-a305-1972f0df3299", "comment": "Malware payload", "value": "38678983ec9de9c248dda64b23358fddf6c336f4db9e4f6232035f8886726d612b4f5e2306c4aed0873d47ec0bd0f857", "object_relation": "sha3-384", "Tag": [ { "name": "bromechoku-com", "colour": "#6FE32A", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779722091, "uuid": "dc999396-603f-4752-8078-94d988b630db", "value": "T154955B23B2C9753FE0EB0E3A4877E258583F76716906CC1766E4194C8E39580AE3E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779722091, "uuid": "56fe89ab-5fae-492d-824f-d8ca2be97cdd", "value": "5443e468f74ccce9d330a54441fad8d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779722091, "uuid": "dcd82385-9d09-4c41-8f1a-b5956c82be93", "value": "24576:MjJ9/oDqMHi96ilvX01LKlM3LoRBlldvXzbCm8UueBTZFvJ:i+DJQ01QJjlueBTvB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779722091, "uuid": "d461754f-9e50-40f7-be0e-956b77e5c2fb", "value": 1899520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779722091, "uuid": "c7d53a22-1a44-4f6e-a048-fb6b08f390cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779722091, "uuid": "2c9ef9c9-bdde-4d8f-b2a5-0d08710ec02c", "value": "b46d3482ff74395f09f36a0014407ff803107eb5bef70d13bfa62a86ebd7bc75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509f5897-5804-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779691098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691098, "uuid": "7b4e5357-5835-4132-84af-fbdd8bd84766", "comment": "Malware payload (AgentTesla)", "value": "1a4136f668f125011a9caba37d6ed4b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691098, "uuid": "cc17e7db-1e26-4b2a-aba0-66432e29ff2e", "comment": "Malware payload (AgentTesla)", "value": "b586710da7aeb32217a3d2c138fc085a0ef2cb50c7a7206f94fb9877d688b521", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691098, "uuid": "01b9583c-3e6b-4e2f-a2cb-1a49be7fb229", "comment": "Malware payload (AgentTesla)", "value": "1d75577e85a7b10d35e153555759b5df5bd2a563", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691098, "uuid": "3bb4d269-8cd9-4305-a8aa-fd8764edcb6c", "comment": "Malware payload (AgentTesla)", "value": "237ed43fcf3ac27ed8e8252c6be04105f94ae30a9638a184dd58fcac42d655e9fa2ef91b0139b4aea8fa57bdbcb9de53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691098, "uuid": "cabb22e9-449f-4786-b05e-8838e2012bfd", "value": "T1D4C44216EA51A02FF49389B0797995867C292E361780EC4BB7801F993074ABBF1F171F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691098, "uuid": "249fee4c-4670-4088-bd67-d475cb89bd3d", "value": "ce27e0f44cf14f982e68d60e5edcd734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691098, "uuid": "6ec17f80-5af1-4287-8db5-ff0008409187", "value": "12288:8Llwepz0u3cnQdyVLPmUDeoXKLcRwKNFlHJ4pkfZC7hf2h:8JpMnQGPzpwKNFYFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779691098, "uuid": "c6f54ec4-4c91-4fb8-b5df-39c0c3ef95c9", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779691098, "uuid": "37e0d0f5-f070-4515-810d-9dac7d535a8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691098, "uuid": "dc7e5263-f480-4a41-9a69-56e81ac1a210", "value": "Pago total completo____pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe28832d-5885-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779746794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746794, "uuid": "bf515225-fcc3-463f-9e91-aca41713364a", "comment": "Malware payload (Mirai)", "value": "b13f47214542cc73b1d47e27a943c597", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746794, "uuid": "91c8f5a7-1205-4628-8b86-efd7d468d35f", "comment": "Malware payload (Mirai)", "value": "b6e65ad852f4fdd6802b4660e585fabf23c8db4645d1352d0c082dfe1f4a213d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746794, "uuid": "dff8b021-ae4e-490b-a12c-9acf838d7103", "comment": "Malware payload (Mirai)", "value": "93b3fa6cd36b735fe6372988b3ee5ef0ea63cb19", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746794, "uuid": "d9ee3594-e07a-456d-9bc1-1098954140fa", "comment": "Malware payload (Mirai)", "value": "a78451a75a3113ae751ff992c2a5b69a73259bdff5b58ffa9931500f49e7676f82bee144c54e600729c371dbb093efb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746794, "uuid": "617f9855-0917-429b-9c9a-06eab0a8fb5b", "value": "T111243907B6D0CCFBC4969AB42BDBC1A18833F8390B766217B394BDA51F5DAD46E1C211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746794, "uuid": "0c2c95b4-e63c-47e1-949c-f11ff51510ea", "value": "6144:jkaUIwjvF3TstfomNaY2csysZJY1BnSaJwfxu:uvVWfoy2csysZJY1BnSaJwfxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779746794, "uuid": "6426afdf-a7fb-40d1-81ad-f610163d05a1", "value": 226124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779746794, "uuid": "83df7e73-be11-4a23-890a-a27882fd61a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746794, "uuid": "b4a25960-c159-4b0d-9e46-b64a72cdc3ee", "value": "bot-7040216d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a9f6c4-57e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779678037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678037, "uuid": "e69acac8-0d54-45ae-b962-ad248b9a553d", "comment": "Malware payload (Mirai)", "value": "ba0117d088576115da018a05de7d570e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678037, "uuid": "f520f9df-6787-4fe3-a588-bdad03f7d9d5", "comment": "Malware payload (Mirai)", "value": "ba3a206aaf4c538adb0575408f39d965c383e312f4eae8f8a2bc267ec134461c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678037, "uuid": "e67addba-ce54-42f8-a7f6-32bed28ded33", "comment": "Malware payload (Mirai)", "value": "47c49f3d45c0270065298af48dfa5cc31e80b047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678037, "uuid": "771267a4-a0ca-4a58-a449-2d41a7b89460", "comment": "Malware payload (Mirai)", "value": "7bf588fd983b98bb3c610ecac53ff39e4394f786bd4e758b5a49ef58e185177b08ecccbeb0aa655516c771af69c3292a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678037, "uuid": "8b1277e4-ae67-4d1a-b1f7-7d96d5dc5826", "value": "T1FF142B06FA8190FDC4DAC1384BEEF5379931B85C5238F25B5BD4AB212E29F205A2DF54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678037, "uuid": "d2bc86c1-e0b1-433c-968c-fbf8f96c070c", "value": "3072:JDh61ieF3ogzF7r3Wo0VNO8kWxk51eeUdU5oswVesj8KUrA6OYzp/I:Bh61ieF31zF7r3Wo0fO8rxzi2LUMEJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779678037, "uuid": "7e360cc3-bad3-4ee9-bfc8-4cafc5c501d4", "value": 196888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779678037, "uuid": "bb0ef755-7ae4-4a34-9f18-4cd8784a6de0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678037, "uuid": "7ff5c6af-c0df-4533-8eac-bc5a9f22bb71", "value": "nuclear.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718be854-5845-11f1-a769-42010a9c0008", "comment": "Malware payload (RemusStealer)", "timestamp": 1779719070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779719070, "uuid": "57f09981-4086-49c8-b00a-70e1bbc086e5", "comment": "Malware payload (RemusStealer)", "value": "034811ac2d17cf9c4386eaafb3ff1fe3", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779719070, "uuid": "001a1809-1ba6-4ee5-80f5-da7665b4ff50", "comment": "Malware payload (RemusStealer)", "value": "bb00b166bd615e9b94ad242822696dbe6dba717af39aee9ebbd3d7734e0f0683", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779719070, "uuid": "0d9d16b2-a6c8-4a4c-aeca-f3a836b0cbfc", "comment": "Malware payload (RemusStealer)", "value": "9a2f0deae73b1d118b8ce45c53e807f01fe2bf0b", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779719070, "uuid": "ab33b829-4c19-4595-abd2-02aa1f3c6cba", "comment": "Malware payload (RemusStealer)", "value": "18a72d82d6379d0e83e51e0816e0d8594394a9f3c1bbd795162df7e6e4b8d3484be78c8d150811b7ec8fc4217ec61c7f", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779719070, "uuid": "5a139fad-d65e-4702-bddb-d1b039dea716", "value": "T14235124AA3FA64A1E0F5937089B202878E71BC616725C6EF51CAD17D4E331F4AA35F06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779719070, "uuid": "190bb9ee-6e51-41c9-a18a-6c057eb4b348", "value": "9da7080b9b697496fd4f41997e8bd436", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779719070, "uuid": "4fd64f50-0733-457c-9a6d-5a4cadcdc770", "value": "24576:HywSkJHB86FRUT/xbkf8bGk0b7+zuvSgyTT2yF3tvyzm9:Swhr86rULx4870bq6agWT2Kt6zm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779719070, "uuid": "15a036c8-411e-47a3-a68a-0c632460d1ef", "value": 1134592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779719070, "uuid": "5f1f0d63-bfce-4287-b4a4-7da7a65f4979", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779719070, "uuid": "057b6ec4-bdf5-4ae8-8536-7cfde0e95bf8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c721f73-5818-11f1-a769-42010a9c0008", "comment": "Malware payload (RedTigerStealer)", "timestamp": 1779699681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699681, "uuid": "7c14cc8e-5df5-4e7a-853f-184bf3c293dc", "comment": "Malware payload (RedTigerStealer)", "value": "33cc51d4e64c95c356a8492e0af68d0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699681, "uuid": "6f75b0ae-bb4d-4bcd-b215-12142676bb16", "comment": "Malware payload (RedTigerStealer)", "value": "bc1363062c4f4aff514d71fd85fc9a5a08ad7fc2ea9a40298bb8865d041b8a3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699681, "uuid": "7d1e6ac9-7cb0-43e7-a41c-6623600e33fb", "comment": "Malware payload (RedTigerStealer)", "value": "a885a46b11f6795960f595317a64b8d2c0ffb648", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779699681, "uuid": "b382ba29-58b5-4804-8ceb-e7de668a552e", "comment": "Malware payload (RedTigerStealer)", "value": "fb7d850542d86fd76ed12453e861981a254883d8b9520fb5c85d766dc91a8aacac192287cb64d0878c76e341962091f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedTigerStealer", "colour": "#85B9EB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699681, "uuid": "c81ecd13-7db0-42b3-b7e2-3e6afadf21a6", "value": "T1E90833848E807C4BF85DD13A8BE29D11D97BA86D2A425E4F23A005753FB77CC447EA72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699681, "uuid": "7ec720bf-687d-48fd-9b6b-efca63e1292c", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699681, "uuid": "9752f70a-3e65-4cab-a53c-cf7673c8de83", "value": "1572864:3TIA70sr8rE+vWlM9ojCrD4WWJvKSc/JUNnzrxq0oZVDq5e4/wLGodwfy:3Z0frzelKbDSc/iFzlqhee47", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779699681, "uuid": "43cffe34-d27d-43c2-bb43-62ecc904e40e", "value": 80603204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779699681, "uuid": "f71dffb0-390f-4901-91db-eaeae7c716ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779699681, "uuid": "9313abc2-f557-4399-8f46-aa7c773a3e2d", "value": "atrmenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ade034-57d8-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779672228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672228, "uuid": "4ad21e7b-a752-403b-97b5-d664e39ae37d", "comment": "Malware payload (Mirai)", "value": "5592b5f0b3911f864419b18bc30f79c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672228, "uuid": "83b73003-75d3-4c23-ad0f-5b940c2e1d83", "comment": "Malware payload (Mirai)", "value": "beb1218e97ea179b7e727362bcc4306f40cce2457342c8804c7312cb760ade81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672228, "uuid": "9e707855-956e-434f-a341-01625b396aaa", "comment": "Malware payload (Mirai)", "value": "af69b2de27ebc635330fc5fa37f186d913980b5a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779672228, "uuid": "86f44d5a-4edf-4157-8f34-84562c675255", "comment": "Malware payload (Mirai)", "value": "c5c6473d4376370fa6aeaf6e355b4dd39e32b8c4b3b330b61fa9e62384286b012f48a3d2a40c6a9bd92fc9052d28c8a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779672228, "uuid": "6d6f8f92-0a2c-4629-a14f-f1c4944e0adc", "value": "T12194E15AF34B2F42C8D79535148BC2899715ED6723E283093B46B5BA3C38277CF29789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779672228, "uuid": "e7a20e05-65fd-4fde-bbba-f1235718196b", "value": "6144:mFN17SFxVW/xqN9o01dwu6mRZ8lz/CTINAOaG5TCTQQoSvz8pBq6XD:miPc4oir64KmaaqCTQQ38pBq6XD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779672228, "uuid": "c074a374-31d6-44ba-a164-5752fc92828e", "value": 428652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779672228, "uuid": "a634b7e0-6720-473e-baa9-d3dd0c89b788", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779672228, "uuid": "aebb1185-c2e3-4ef7-92d8-4c844293c7ea", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3ad680-5804-11f1-a769-42010a9c0008", "comment": "Malware payload (Formbook)", "timestamp": 1779691087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691087, "uuid": "57b5ebab-f9e3-4d9e-8f82-c5822e6c3ac9", "comment": "Malware payload (Formbook)", "value": "580eb1f42681af85fafbbcad11c65fad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691087, "uuid": "6698af1e-85ad-49ed-9057-29cf5e8f8218", "comment": "Malware payload (Formbook)", "value": "bece18eee8eab0fc75fa5cbae71089d84bae77783934c921344f505af451a99b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691087, "uuid": "0394113b-3e3a-426a-a19b-5531ce5bb21f", "comment": "Malware payload (Formbook)", "value": "95cc3a7fb07655252cd470862776787963ba003d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691087, "uuid": "e5caa6cb-5cbd-45a3-a651-48868ac9f7d2", "comment": "Malware payload (Formbook)", "value": "6378609414c1e248a72e746250e4228a5a3aeb27bbc814a888b428d176cdabb68c11e364ac145a2855c90bb0aafe7247", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691087, "uuid": "25a3ac88-b35f-43db-b0ee-d939b7699166", "value": "T1772512689F1AC903DDC61B344EA1F5B132799EDEE920C2978FD8BDEB347E6101948352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691087, "uuid": "274569ab-cb55-4b77-be53-3b04fd39858a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691087, "uuid": "6f22b037-d048-44e8-b692-c817ecc05c22", "value": "24576:0/hF/sctVUOUKB+XZRmcR1DVpyx8ThcT:MhF/swVKX6cPVpyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779691087, "uuid": "9f734722-c712-4698-8da2-f1d20ffa5017", "value": 1011712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779691087, "uuid": "1075b134-4830-4a30-9c9e-15401e826bb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691087, "uuid": "a72a8c9f-4b8d-4f0a-991d-6c8f90a6b7c4", "value": "Fatura Dekontu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a02ecec-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747404, "uuid": "a9733aa3-043e-46a7-bf89-f98da796ac0e", "comment": "Malware payload (Mirai)", "value": "4d34ff9135c0e92f0978c0de858478f6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747404, "uuid": "cd5d18cd-e390-4abc-b4f6-645190192d15", "comment": "Malware payload (Mirai)", "value": "bed4874e3440441ebebfa1da575a77db6a84a2194b3e88af22a54b5e758c60ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747404, "uuid": "03a1542f-80a7-4d04-81a3-a0507e625e88", "comment": "Malware payload (Mirai)", "value": "82b490631580466def0d440836a4cc96792a8fef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747404, "uuid": "92db5bf3-93a1-4aa2-aa32-d2ff23ccbcc7", "comment": "Malware payload (Mirai)", "value": "ab0e17c36d182622c5f11bafbc278191dc7c3f23156b955f7c4e2efd97d8aa978ba333bf5aca236c92c9da0a705834d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747404, "uuid": "556e7f0a-f7c3-4a7a-84fb-474a0891cfd3", "value": "T1E9F34902B30C0A47D2632DF02E3F2BE097EFDA9121E4F641651F9B8A9672D361585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747404, "uuid": "6575974b-559a-427e-abbb-02afe62bf5b9", "value": "1536:SW3bmyGKnCcQjYpySAxgDVT5vhiX+EFW+tk4lvAbRoeDG/t2ErQqh7M2IymQY2AC:tLm3Iy4y5xAVDiFWokPbdE66hh1XYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747404, "uuid": "29826c85-e576-4ad3-a4b4-a1d5ece20f3c", "value": 158744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747404, "uuid": "9cc83230-3bf3-497a-ac6f-2ea6d563946a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747404, "uuid": "82611346-b7d2-4e72-9f5d-c5f42c4ca00e", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fe07e77-57ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779679956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679956, "uuid": "37e6821e-87e1-4c25-bbf1-d20db002ed53", "comment": "Malware payload (Phorpiex)", "value": "bf436403527ad7d04681e16f462dace1", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679956, "uuid": "6bec1455-26f6-4650-8be5-6c4bf3b29943", "comment": "Malware payload (Phorpiex)", "value": "c1749695711f5d166315c313e7eb4c96b764d43fcc75f0bad1af24902f175d33", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679956, "uuid": "7859b6a1-24ed-4b3a-a2a9-c5d31e1356e4", "comment": "Malware payload (Phorpiex)", "value": "cc76468b1d861dfad2a36a2f550bb53d30a037e9", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679956, "uuid": "fb31dac6-1950-40df-b527-5438e07d2c28", "comment": "Malware payload (Phorpiex)", "value": "768aca5d018df580f3fe004a7ffc45b9f5901e3918914d80947873a19717c438c3467ef4f7f2caadd8df34847e189c94", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679956, "uuid": "fc33497d-4ed5-41bf-bfab-36161c08d185", "value": "T195824B0FF9914216D1E110B05675863BDAB99C72338454EFF7D48A9D0BA86E6FC3211F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679956, "uuid": "ddc98c84-f1e5-457f-a061-c709deb73455", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679956, "uuid": "4ff3a896-4d4c-4336-bdcb-33e31405feeb", "value": "384:88IJlVYeryskwAd0ZHu9JgiL7QWav8U9cC:Iw0w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779679956, "uuid": "b5a75613-c159-4b47-a643-374fc3d6cda7", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779679956, "uuid": "3946f7f4-c89e-4ef9-8503-240ad1d350e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679956, "uuid": "c7b27ccb-a01a-4767-91cc-9339d4cc10f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca70dad4-5882-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779745419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745419, "uuid": "8f91aca4-0787-4d9c-bb2e-199bd4c5464c", "comment": "Malware payload", "value": "c28ee7c47046d2adfb1e3a3ffce2cffe", "object_relation": "md5", "Tag": [ { "name": "208-64-33-64", "colour": "#F6FA55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745419, "uuid": "4d4d8e9d-4307-4537-aaf0-98674d4bd6ab", "comment": "Malware payload", "value": "c20bbb8043a930c2a02111ca8753d179ab1a2ce124ea3c58977906372055b1b5", "object_relation": "sha256", "Tag": [ { "name": "208-64-33-64", "colour": "#F6FA55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745419, "uuid": "3e38930d-ae1c-4919-a7cc-0eef11744f25", "comment": "Malware payload", "value": "d5374f0bb3d7ed846ce1b52a28478bbefe748790", "object_relation": "sha1", "Tag": [ { "name": "208-64-33-64", "colour": "#F6FA55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779745419, "uuid": "0bdf564d-e5b2-4115-9da0-190e9199053e", "comment": "Malware payload", "value": "8e99e4a5be4a9648284accbbf152410e959d4aa8a5577ac9bea760afe4182ff049c987ff87397f6a2676a043f9c34e48", "object_relation": "sha3-384", "Tag": [ { "name": "208-64-33-64", "colour": "#F6FA55", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hippamsas-com", "colour": "#A9FB94", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745419, "uuid": "d34df7f7-dd45-4fcb-92f1-6c94ca146408", "value": "T1656508BF6BD461C4D811EEFD9E916F0957A4FE907990428E12C2BB1BCD34AB34E1A11C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745419, "uuid": "00b8eea3-9837-4736-9a97-c820fb999921", "value": "24576:iwrzrqNIYoza9AI6iZ+PGDFS/0YX4EbkfO5vbC8j0Ex7lropS:3rS8ziT6G+Pb0YoEbQ8jNhlropS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779745419, "uuid": "31445259-ae6a-42ec-b356-c381b4761fb9", "value": 1481272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779745419, "uuid": "384b7611-8134-4413-b5a1-655696e67408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779745419, "uuid": "32d754a8-73e9-4cd8-9fe9-42761b826244", "value": "Chain.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e8f42f-5891-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779751875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751875, "uuid": "f7fcc64a-ee8e-4ef5-9e93-cfa193e18ae1", "comment": "Malware payload", "value": "44cfe13b3c9208798121cf761b5fbbb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751875, "uuid": "da3f1a43-28e8-4210-a9e2-5be9e35dbb64", "comment": "Malware payload", "value": "c3961d2ff7197cafbe9bd4d01b550f455e21695c1cdd0800299de1313c2a449b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751875, "uuid": "e72e7f87-d2c0-4606-a8c0-bd3f04fdb015", "comment": "Malware payload", "value": "f8754f32c122b300a1e5c8fe0a905f89ac8edf3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751875, "uuid": "5fabc201-bd12-42bb-ad69-fc7feb3d6fd3", "comment": "Malware payload", "value": "6d359579bd477a3a314ccbe03f4198bd268a2f7659c7f0b3fda176e85a20f10bc9722a246871541e46418174ad99ea9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "enthec", "colour": "#9E7429", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751875, "uuid": "5778aea5-c8d3-4b5e-85e1-6fd14c738b4d", "value": "T14247DF77814338E9E5B98DB4D41025426DAC388B5738A3C7BAC471E667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751875, "uuid": "60dd064b-7cec-4093-a952-24ad9a8e18cd", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQf:cqYUQuVDt0TZEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779751875, "uuid": "fa8a0534-ba20-4ccf-a5f4-aaaf67cf4d58", "value": 26312704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779751875, "uuid": "3e8e5325-d482-4071-a266-99f135d5dff5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751875, "uuid": "2a43f108-acc7-4f93-9401-4dfb7ccb367a", "value": "c3961d2ff7197cafbe9bd4d01b550f455e21695c1cdd0800299de1313c2a449b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ee0e451-5894-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779752996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752996, "uuid": "936204bc-0e1e-4ae0-b216-59e620fe88a3", "comment": "Malware payload", "value": "045786f4a55c244609ff07069dedd399", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752996, "uuid": "58d4a13b-49f8-4e37-9020-3e99128b740c", "comment": "Malware payload", "value": "c4073509cd42fc88b9e1497b576d4baae23beaf21f0d8484376a6658c27076e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752996, "uuid": "77ab4495-9b94-45f6-9196-9be4bff420db", "comment": "Malware payload", "value": "7408593ffc7ac2fb4b92ac7f2d16090fa9071011", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779752996, "uuid": "57743124-28da-4f42-abfb-6ac3ca975948", "comment": "Malware payload", "value": "3ea08ee71d800aca16d2d668998ae37da6739b009a0ea886094e6f904d62220ece2bc358d25ca1e3a3b5004a70cd20ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752996, "uuid": "abdea1eb-7e34-4d5c-a48a-346fc5c23a1d", "value": "T17264B8143BEE5418F1BBAF765BF475968A3EF6633A13954E0491034B0A33E80DD91B3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752996, "uuid": "1da3e556-9ca1-40bb-8aea-48324e79a7c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752996, "uuid": "153c5532-994f-47e9-9cf0-3fb1350eea9b", "value": "6144:eCrr/lU1Xadxq6+eggXQ9EJb7Z75k6e/iRLz:frr/lU1KG6nXnld66e/iz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779752996, "uuid": "36a17199-a32a-45d6-aa77-2e81a0560951", "value": 307712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779752996, "uuid": "7663c1b3-c4e8-4178-b6ee-3c300383c3a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779752996, "uuid": "181bb2f0-2eb0-4375-a646-5313e4dbfe7e", "value": "SecuriteInfo.com.Variant.AsyncRAT.23.79267572", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874e8b56-5825-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779705363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705363, "uuid": "83a40457-d7d3-4e8d-87d7-f777fd595235", "comment": "Malware payload", "value": "32da257bd16666b6d8603b7e7d352a3c", "object_relation": "md5", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705363, "uuid": "690c8f54-2ad0-4bba-99e3-3fa54f0ff889", "comment": "Malware payload", "value": "c4e23cb969dfbe9da26dbcc4da8d1dccc0cf45158bf9dc631a928f3c11c808eb", "object_relation": "sha256", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705363, "uuid": "cd3ba840-b9d2-4bd6-a9c2-d9bc1aedd025", "comment": "Malware payload", "value": "d69f79ee5c3b716e546af97e292ee8afd4c11284", "object_relation": "sha1", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705363, "uuid": "39f0ebdf-9b9e-436f-a6e9-d1fd8e8c117e", "comment": "Malware payload", "value": "4170742af294b405eff4216be9f4fea085ff5c7b998fbac31fa0c47cd3ce3853e658c7de4d497f6458da43f2f12a228e", "object_relation": "sha3-384", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705363, "uuid": "50f0ece6-e872-4ebe-b4f0-dfc4c0c17a16", "value": "T1A8069D0BF2A605EDD019C53583BAA233F574780B0725B9EF16A05A246E3FFD0667EB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705363, "uuid": "5ba9794f-54d9-4e7e-a0ad-70df1eed2997", "value": "6ed82d3226365ffafff2c57c1935d352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705363, "uuid": "e584f454-b83c-4d1f-aa2c-248097b63af4", "value": "49152:fISWBURglcWlJUQSyPV3cZ8RxDZa+DmXfUStDw/JcImohiiMoFwdY4:fPnvdZoJpMon", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779705363, "uuid": "ae1225c5-c980-459d-a2e2-bf213dcdfe9e", "value": 3992064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779705363, "uuid": "40fba77e-fb12-4487-9858-6687ee7ac563", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705363, "uuid": "1aef7d4f-0f22-4bcf-9b14-5d06136319a5", "value": "c4e23cb969dfbe9da26dbcc4da8d1dccc0cf45158bf9dc631a928f3c11c808eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "853266c2-5825-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779705359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705359, "uuid": "171ee484-bbb4-47ba-aa47-51a2bb9bf2a8", "comment": "Malware payload", "value": "3b6337af3b483767ff6e7d0a3851c2e3", "object_relation": "md5", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705359, "uuid": "bb52101a-efe0-4035-805a-a41992885837", "comment": "Malware payload", "value": "c6d31f71c8c12d96c6fe69653d1add735fe6dcafee4f95f8dcf7bd379c51fb40", "object_relation": "sha256", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705359, "uuid": "16b200df-e649-4091-bfef-a3ecd66b4273", "comment": "Malware payload", "value": "297f29345841dd04ced7d20d96c403f2be7e4172", "object_relation": "sha1", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705359, "uuid": "520bcd1b-fa55-487f-825f-57746f6505f6", "comment": "Malware payload", "value": "827afde087e54519c2e981236002f507b04d58e882b49756add5a9f07217bd9d76c6f1d1c2bde3c3035aa668bd18b9e7", "object_relation": "sha3-384", "Tag": [ { "name": "Chat-GPT", "colour": "#724804", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705359, "uuid": "cf18d3a4-3df0-4d3d-873f-b387e72bf6d4", "value": "T108069D0BFAA205EDD019C534C3AAA233F974384B4725B5EF16E05A252A3FFD0267E715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705359, "uuid": "389539da-7f40-47b9-b729-eebaef8aa2af", "value": "6ed82d3226365ffafff2c57c1935d352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705359, "uuid": "9cae5c23-f9dd-41a4-b206-aa494b6059e0", "value": "49152:6ISWBURglcWlJUQSyPV3cZ8RxDZa+DmXfUStDw/JcImohiiMoFwyri:6PnvdZoJpMot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779705359, "uuid": "226c39ca-8111-4cab-8ab1-dace47152a03", "value": 3992064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779705359, "uuid": "6cce4a74-50e1-4baa-a3d6-db3ddcf78ad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705359, "uuid": "a2962cf9-bf36-4873-bf7d-a2d540dd95e2", "value": "c6d31f71c8c12d96c6fe69653d1add735fe6dcafee4f95f8dcf7bd379c51fb40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0499185-5824-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779705056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705056, "uuid": "22301b16-a119-4aa1-a7c1-a860709b206d", "comment": "Malware payload", "value": "d4a9b34284fb647f66e7cf5e0f712011", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705056, "uuid": "b892827a-e2a9-4b92-85b2-7284ca3953d5", "comment": "Malware payload", "value": "c7719798648f65f855df5b7afaa9f82121f1ad5828234b326a8feff4df73e081", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705056, "uuid": "a5c87283-8500-4cbe-ba21-e39d934bcf95", "comment": "Malware payload", "value": "1b3fee004971a87c17af876d1ae24636a524e7ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705056, "uuid": "48bd6690-3a67-4826-8681-f9f97665a2f3", "comment": "Malware payload", "value": "0ee2b5898976f1fdc74662d64f46771ecde08cd4a522d4606cb60aa331cbc0e16c4d463d1e672a9baff3db479dc5007d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705056, "uuid": "83d2839e-2c70-44e4-8eb5-158563c023db", "value": "T138C4018776D08B43D15066B6C4E7882143E6EAC73EB3C3463B4912A71D51BF2CE99B8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705056, "uuid": "46743f26-e78d-42c2-9e08-844a83721639", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705056, "uuid": "fe134ef2-2340-4aaa-9f28-75b43a26db78", "value": "12288:FZwe+hHTKnmxRQRYJJL2327fSleg+EdwJ0nUMIMKNdHMI72bA:FZQTUmxiRY24SlekwJ8US+dd2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779705056, "uuid": "96a4c046-ab9f-4d63-94fe-f91230e7c318", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779705056, "uuid": "0f995f2f-9e44-45d4-bd98-e073bb6606b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705056, "uuid": "015319b9-f320-4e89-91f9-e8a12cd8abda", "value": "c7719798648f65f855df5b7afaa9f82121f1ad5828234b326a8feff4df73e081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e86593b-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747278, "uuid": "b8d8eede-a20e-43f7-889c-08f09ac72217", "comment": "Malware payload (Mirai)", "value": "3a7e7c2af4c608eade19d3c8b4beb335", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747278, "uuid": "e9a74774-4dac-4a77-9f70-99a047fabef5", "comment": "Malware payload (Mirai)", "value": "c79e97ba21d45cc66625fbd0654d7fce5fffc8dc35bf31c42a8bc962ec816659", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747278, "uuid": "d5daec3f-05ed-44dc-aa51-18a24c8ef50e", "comment": "Malware payload (Mirai)", "value": "3083522d385bd775b2323f6e0636687797a20f70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747278, "uuid": "2971cd97-7e4b-4b37-a4ef-8c18f09ac7ad", "comment": "Malware payload (Mirai)", "value": "1f214c5cad757f5cbe104b439d65917d96e341ccd5797cf728f8a63809610d41a1a594e5e87922b021ab55b2219ad675", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747278, "uuid": "535aba96-0717-4349-a96e-e742985dd616", "value": "T1E403E112928434E5E8712CB2E8E803C16A7B6FFCC4DB118307F5525DA78DA43B9F758A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747278, "uuid": "9c665f4f-1d78-49e1-a9ea-20532aa98467", "value": "768:3hbUpgfK/AwFxZMxVM341kBXEf+V+La2Jd3kMQxTygHbYaaq9/XXTEVzu8Ln9q3/:3xUpgy4a+M3HUkkaaQs4LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747278, "uuid": "35dcb017-128a-485b-8aac-abb6bd3fc35f", "value": 38016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747278, "uuid": "13854c33-f17a-4c37-a152-71e2eabe522c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747278, "uuid": "bdbb189d-25b4-4429-aa53-1e1606e386bd", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8f455b-5824-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779704945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704945, "uuid": "ec05a121-31a2-4169-a7c5-b74bec9c9b3a", "comment": "Malware payload", "value": "cbe251dd8587553dec38bd393cf49847", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704945, "uuid": "194e7f71-88c5-460f-8c34-4ae8f9f51f27", "comment": "Malware payload", "value": "c8336e84c4a44b42ffc0f6cb57cf573b42cb46fa4ef9e553a9bb398dccee0ca2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704945, "uuid": "d0d5e1eb-a787-4dfd-9619-2bce45f31042", "comment": "Malware payload", "value": "ac4a86978788a7a03eeb6aa0b582e3962685befb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704945, "uuid": "e6e4dd90-cbbe-422f-a8f1-7e981e669236", "comment": "Malware payload", "value": "a687815741b0aa9301f41ffa2b8368f120bef4c9a75bb59c317ab8265573fb3568f6bb14c901afcd4829896b6ed55495", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704945, "uuid": "15b29ef1-c34f-4f28-ba68-f2635a5c5cc0", "value": "T1F7F4BF1F72528E12D2C85637C1C75A04A3E4D6823637DB0E768827965E0B3EBDE4B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704945, "uuid": "ffcc5f03-c8bd-4507-af2d-4c28e62e653d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704945, "uuid": "b425f442-5e47-44b5-aa11-6a912861e17e", "value": "12288:9GIbvq9pmhFGL1ct0t/8/8uFQ8BLs5rI5AIoy8o0RA:+pSGL1cM8/x6S02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779704945, "uuid": "6ce930c0-2368-4fd0-bbc8-1f3b25fef9c6", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779704945, "uuid": "3f123ec7-86ac-40c8-8885-33e8650e7cff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704945, "uuid": "9692b266-0cfa-4eff-92ab-23d1beb629ef", "value": "rawww.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908d88aa-5870-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779737590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737590, "uuid": "1fae63ae-74a1-4629-b1dd-e66e1370a3ef", "comment": "Malware payload (Mirai)", "value": "4a36011f18e483d12e20681948793a8c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737590, "uuid": "654be43f-befc-4181-9cd8-6ec5f0417b2a", "comment": "Malware payload (Mirai)", "value": "c9bdef3590843ea0619b5fb14e03bb7dadfd94099d5e5e8273b4639fa6c40c68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737590, "uuid": "609eda7f-72a6-412d-b939-4589aba7cdf7", "comment": "Malware payload (Mirai)", "value": "3b296e6bba274525268981d0ae49ad4a62cbbf41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737590, "uuid": "24829f21-8d10-490d-9284-68df890dd04c", "comment": "Malware payload (Mirai)", "value": "e2883f917a67e02197ba2580dc798b121a0d54e58a847e8913fd958dd45c3fe66a0b66b748b08d7ab6163e4aa00b608d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737590, "uuid": "71094da2-5850-4ba1-92cf-4599b4940835", "value": "T173561897BDD24942C4E43A7BB9BD80C473630EB98B9652575D04FE383ABE1D90E38358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737590, "uuid": "f92f738d-48e1-4e3e-b80f-1f085dc7ebbe", "value": "49152:RtDiXRfVdc/p6z/fzZuJmI1zFmFZ6a+9mLoEWq5EY:HDiXRfVSp2/fzUmV3+9BEfEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779737590, "uuid": "3540915f-ce69-4991-8e13-ec96b167afd1", "value": 5963938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779737590, "uuid": "dd0eae2a-01ee-4108-9f5d-6e44f7ac7eae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737590, "uuid": "cf9e3c56-ff75-4dcf-8427-769d0cbd3470", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169686f2-5824-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779704744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704744, "uuid": "17458de4-31ca-4206-a505-db3663a96b52", "comment": "Malware payload", "value": "6ec8d48577ee55877ff2457a015669f3", "object_relation": "md5", "Tag": [ { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704744, "uuid": "467ea9c7-706d-49b1-8cc1-73938cd28b9f", "comment": "Malware payload", "value": "ca0d51aa48d5839ae1fad76f13844b5b6a7974da929d1a0a81fa233a491f6c11", "object_relation": "sha256", "Tag": [ { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704744, "uuid": "a32fdc32-1d9a-4f36-909b-afde433e1d0b", "comment": "Malware payload", "value": "47fe423f52f0c1ea43a7b9768ac302f66afe3e4c", "object_relation": "sha1", "Tag": [ { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779704744, "uuid": "240c5221-435c-432e-a942-16f5bfab19a5", "comment": "Malware payload", "value": "e85e730a82ae388aa71a15f638db4e0fa74db51d17a70c17ac04d67f95e2674fb2e526c1349d0012717d3890d1a467ab", "object_relation": "sha3-384", "Tag": [ { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704744, "uuid": "5decf45c-9f50-4442-bdae-da3df0069331", "value": "T148E3128F04E363EAC09E38AF50D8717C4C069A7C7D9C3F99B2F554E868270596C49376", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704744, "uuid": "1fe18027-731d-44f2-8152-2c6a5e706b9b", "value": "3072:FA1nkCzA7kYmLOTlnQUU2ZPJNAzKDRRvqab9GeJMeN:e1nk9iLOBQUUmhNAzKeaie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779704744, "uuid": "18fff4a6-1467-437e-98e2-89d6876ec876", "value": 153019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779704744, "uuid": "78bf7891-ed53-4495-8a97-dc4315e67dcb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779704744, "uuid": "d3424a8c-2ada-4ad0-a7e4-fe0abda49c4b", "value": "New PO attachment product_list_pdf.txz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "914ae2cc-5870-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779737592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737592, "uuid": "da7b6b07-c645-42cf-a02e-29315091409f", "comment": "Malware payload (Mirai)", "value": "33e6c9f516b80dfa333fd80d38307ab6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737592, "uuid": "bf4c4184-8eb9-4ae6-8b59-820b88b8a30c", "comment": "Malware payload (Mirai)", "value": "ca752a158c7e37696137bfead3e8427b40035f6cbfbef45cf27d9089e2408898", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737592, "uuid": "39bd5754-9e34-41e4-b48d-1db272fb5ee9", "comment": "Malware payload (Mirai)", "value": "5c856beabb5197de869c5a2402b2ac9a106aec7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737592, "uuid": "9760b601-2329-4434-9d60-4a1dbd2a0849", "comment": "Malware payload (Mirai)", "value": "4fd44bfc8cd832e6cbffba7968ac5ce56321ca495255f078f49ffab87df138f23af8403676e0e0577aeb6a787a0412a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737592, "uuid": "0c317599-ab69-4666-bf0f-384ebcd1a8f6", "value": "T1F2E32A15E7418B53C0D22B7AFADF424133239B68E7A733055928BBF43F8679E4E22516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737592, "uuid": "7a031f7d-1690-4f79-a580-7bcf98d3e265", "value": "3072:1re5yYF+Sa9P3ZnSHaYqY1CKsFacfR/DCpM/97M2KVMDk:1r6RESa9P3ZVYqxKaacfR/DeM/942hw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779737592, "uuid": "3fbebc80-2084-4ed8-93fa-7c7476b428cb", "value": 146592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779737592, "uuid": "b5528e92-416b-4214-8487-03beb2b0dc1d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737592, "uuid": "4f109c87-a5cb-4819-be00-6d8d55829915", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b12995-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747394, "uuid": "7fe8f12a-0b5b-454f-aa53-d951dccbe9bf", "comment": "Malware payload (Mirai)", "value": "a049ea704857e7a6d6ff5719f0cc6a49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747394, "uuid": "1e22329d-3e00-4490-88c8-58190c572441", "comment": "Malware payload (Mirai)", "value": "cdb59a9e81e82d7e6b26ca6d7aacec761860b719a00872c8567c175550fbd4fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747394, "uuid": "30c62cac-8460-4e24-923f-e7ccebd6837e", "comment": "Malware payload (Mirai)", "value": "37b588990d465bc89e3c5f99798fee38a64dbdf7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747394, "uuid": "23f31427-5d0c-472f-a1fe-0650f62dd1ec", "comment": "Malware payload (Mirai)", "value": "911e28e816cf95f17bc59dda4da1d8786b484a3f7d50b90b5b3e0069f034b2dbca0a623a3ce2bd2fe53db7b68587a777", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747394, "uuid": "58d4a40f-0c5e-4f20-a430-ff9fd270f052", "value": "T10D14B81E6E228F7EF6A9C73547B74E24975823D623E1D641E1ACD2111E2038E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747394, "uuid": "732ddcf2-4928-4a96-8ac8-d1055f684952", "value": "3072:QDy7dCcHfWaKYCYv5RuiMK3+cQOXfj56hh1P6DV:QDy7dCaWalr3bt+eX7E6Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747394, "uuid": "57e5728b-29a7-4ba4-8d79-7d1d384e9eba", "value": 207860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747394, "uuid": "b10a4027-c5e9-4af6-810f-90f827af7876", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747394, "uuid": "8c4c3ce5-6bf6-420d-bcfa-c74cbd27059c", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ba035d-57d6-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779671380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779671380, "uuid": "54540bc5-1e14-45b3-985f-cd33591d1bfa", "comment": "Malware payload (Mirai)", "value": "cad6b75dc2711be6e361ea02db817ec9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779671380, "uuid": "1ed42368-72bd-4d40-a159-b8a0edd3777d", "comment": "Malware payload (Mirai)", "value": "d03ae552af3581c000b2ac28f4a74c64db641f6ae7ff8d227fa3f60c30cf6b89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779671380, "uuid": "052ee597-8d26-40ea-9572-33982ca6cd02", "comment": "Malware payload (Mirai)", "value": "bd439b6ac836663b15229cb0930fcc6910658cc0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779671380, "uuid": "e6d99874-9fab-43db-a379-8e6abbef028c", "comment": "Malware payload (Mirai)", "value": "abcfb889cd3554f974910c3aba16bc47ec951bd47383ab58b9d6db8517335bb2fa2d6928062d03fadf597f156be58f84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779671380, "uuid": "c304a831-4100-4b17-ae1c-e691f376e240", "value": "T147441A06AFA10FBBD8ABCE3346EA1B0625CC644722A53B357574D918F54E60F49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779671380, "uuid": "36be8e42-663e-4992-816e-b3912e6f2e50", "value": "3072:nNex8xcv+KMxKRmu2ayCvpUtHEl46HEBc1Ct1utJ5//2fVk:NexeI+KMKvpUGl46kW1sahuG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779671380, "uuid": "8ffcb2b3-92de-4382-8f37-b05365c6752b", "value": 269224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779671380, "uuid": "318519ae-4876-427e-83f3-05f83b195582", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779671380, "uuid": "5df732d0-739a-486f-91b5-db26f415a59d", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca654b4-5870-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779737530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737530, "uuid": "7dbbc02c-e799-460c-9ed4-5dac9cf54566", "comment": "Malware payload (Mirai)", "value": "28e3253a6e558e684351fd13f40bac57", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737530, "uuid": "029462e8-902c-490e-bf4b-9efd409332ff", "comment": "Malware payload (Mirai)", "value": "d0ee30fa8389fe31348f38d6d69acec2f35ac62e6f8f6c132bcceae494eb7c34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737530, "uuid": "b3c7501c-ecce-482b-a89a-c3f6bc83562c", "comment": "Malware payload (Mirai)", "value": "7df62e12686d1281e16ca7e8a1f949634be52d29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737530, "uuid": "0bdc63b7-8ac0-45b3-863e-878bae6f3be2", "comment": "Malware payload (Mirai)", "value": "517fb24e596062789821d74bf04965bef3f73b57bc9100d15dbfd82aa3a0c219813fbc73107ffbf8b3b5b106e534d5ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737530, "uuid": "f29d9fcf-5b25-4549-83ec-02b0c200bed4", "value": "T1C3561997B9D25943C4E43A77B8BE81C433630EB98B8752565D05FE383ABE1D90E39318", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737530, "uuid": "d55f819c-99a8-4155-abca-d90c2ec2ab6f", "value": "49152:gbjK7B5ExI44cymRgneMnl/56YfASONu8GDMtA5E0:g6B5ExI44cymRgeM/A9NuVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779737530, "uuid": "527fac18-3c3f-40c3-9af6-a059a383f180", "value": 5963938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779737530, "uuid": "e94917d3-89fa-41e8-b62e-82f1341d7c6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737530, "uuid": "07f5ecbb-bccd-47c4-9688-ca5c0a9e5e56", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af33553-587c-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779742735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742735, "uuid": "7fe3ae59-cd7c-4190-ba97-61f299ee8746", "comment": "Malware payload (Efimer)", "value": "8ff7b557a20716053fe65a636046c3aa", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742735, "uuid": "69dc9605-6947-419f-ac22-df8afc0609f2", "comment": "Malware payload (Efimer)", "value": "d297973f8d1bb330dc7a7d7538bfbe97ea4608aee040b48122da39a2562ddf4c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742735, "uuid": "8cd0af9c-c92e-475b-ab3d-57528713341d", "comment": "Malware payload (Efimer)", "value": "a9f2aecb7279c5fca11fd239305f87ac8cfe0d6a", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742735, "uuid": "1a893ad4-704b-4da3-8f8a-29d7e7c246f7", "comment": "Malware payload (Efimer)", "value": "4cf7f0e0be093e93ba4d8fc40334715aebf3abc59754ce5c2561e4269f714af069e7d0ebe06ef328c9ab3fc549c1c62c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742735, "uuid": "fa721e23-730a-4d57-9e57-6766fc5154b0", "value": "T1D1D63328E2E231EEC3A2A1747CF516F078A4F86D53324D3F5498C7354D8B621DAAE527", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742735, "uuid": "9fa2823a-3391-429a-884c-ad7cb6f7042c", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742735, "uuid": "f35d91fd-8ea9-4df6-bcea-08dbe56f6a7b", "value": "393216:SzZYchBimJmnosBEJug5iyXMCHWUjXVcuI3/PGTAI:SW2iNnFBEN5XXMb8XiH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779742735, "uuid": "1c967476-d2c3-438b-bcd5-c1c1405111e7", "value": 13842881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779742735, "uuid": "615fe079-ff16-448b-a5a1-94c1d1c5b57a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742735, "uuid": "b247a368-0595-413f-a1cf-2c7853432103", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84703641-57f4-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779684313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779684313, "uuid": "566c3e9e-ea04-4079-938b-bd26c2fd498a", "comment": "Malware payload (ValleyRAT)", "value": "9fc9ed6d84de7a2496a9f74d8e02b0d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779684313, "uuid": "baf14adf-d012-467d-b268-6d755bcf6fdb", "comment": "Malware payload (ValleyRAT)", "value": "d4f851868288d1fb186fb9ddb911a7806ee70235296fa3d5dc99cdde0ab89e82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779684313, "uuid": "05d32e94-be66-40b2-8d73-b8744a1f4e09", "comment": "Malware payload (ValleyRAT)", "value": "a10f09238de728c7ab6f9fc6841982da34765f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779684313, "uuid": "1e228498-e66d-4294-9aa7-3115c5d4c056", "comment": "Malware payload (ValleyRAT)", "value": "98b6568ff81fef09123e6000bd16a510f5815bd2ee0f4eb239a90a318b3bc6e1b33b404e3c82ea729945a03fead58c62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779684313, "uuid": "94b5308c-6d9c-4d20-a2b5-1e88986f0b92", "value": "T15B068D1737FB00EAE4B6D27CC9875902EBB27846073267DB01A186560F276E65E3F321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779684313, "uuid": "30080939-3ac7-44c5-871a-b8b658c3fd62", "value": "17c9a621e07aaa4c1d90c6f107d1540e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779684313, "uuid": "658b8978-f819-47e5-aa00-709b56767ccc", "value": "49152:O4VVWYVC7Qo03UxX3TV1VKOJf6DEtX5mHpgszN80kZ4gPuKe/L1jF7wME+kzUUm0:wHADcsJgt4EqF7wME+kzUUrrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779684313, "uuid": "effd0d9a-620b-4ec1-adb1-314b4daaf3a2", "value": 4003328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779684313, "uuid": "53585341-d085-48bb-99a7-52f6474b6d56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779684313, "uuid": "5779fac9-c456-4f81-9a80-417dd5557bab", "value": "Quark_2.1_x64_win.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066cea29-5891-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779751532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751532, "uuid": "ec3cd906-787a-4f20-887b-821c602f65d6", "comment": "Malware payload (LummaStealer)", "value": "33b1021186c244c0257fcd1c8385ae99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751532, "uuid": "0224ee10-3b98-40d8-b2de-fc679378095c", "comment": "Malware payload (LummaStealer)", "value": "d5647efd5104b67524f99f22788de313769ab552dd53bfe497eb2a7765bbe56f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751532, "uuid": "76be9f9d-a36c-4656-ae4f-80785c1d8a51", "comment": "Malware payload (LummaStealer)", "value": "2469a406680fe8b8e06a36a9e1704d64ef787a6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779751532, "uuid": "3b3f316b-f3d0-4882-867f-d17c8b5e0f11", "comment": "Malware payload (LummaStealer)", "value": "ce7fab8a5a7c06e651676f53c31a298abcfac3e1a4900985fa12d8180f1408275d5e7ee51afcdb62f45b86883dd9cdef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751532, "uuid": "9023f617-8b82-47d3-a1e9-eea3f6e2d128", "value": "T149853900FDC785FAE402163249AB63AF2335AD090F329B97EA487679BD772D51C36319", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751532, "uuid": "d0f01d77-f921-4d72-9fd5-ec0d94e2e276", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751532, "uuid": "f10ab534-c461-4b19-8076-781d3d824ee4", "value": "24576:Ogd1B62ype3Og/L1hOrOaAvXab+gSiq5pp9BPdC8tBsXno+MJ2SLzVP7yUdeeqO4:OsQz6lvX6MTtFeubsGDxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779751532, "uuid": "154d0210-b0f2-443d-92e4-00eab75b4233", "value": 1771648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779751532, "uuid": "02ddda7d-241d-46a8-ba78-c53dfedb6ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779751532, "uuid": "47e636dd-a70b-4c65-af43-172285a3e967", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8793fda-57e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779678038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678038, "uuid": "047e346c-5e21-42c5-8719-69a8cf90647d", "comment": "Malware payload (Mirai)", "value": "892c90371630de2ccda8e6bcd66c4999", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678038, "uuid": "abb9b8d9-27ce-4632-9551-268fb423cd57", "comment": "Malware payload (Mirai)", "value": "d71e966c74269bde16966988fac51f5e37ca7bb9232e7d267ff8d392f76e3c83", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678038, "uuid": "30e3f95a-4a3e-4628-87e7-193b9cf97f0c", "comment": "Malware payload (Mirai)", "value": "036f20f8cfa533983cb2dd018ab6699f593ca278", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678038, "uuid": "44237c26-bf96-4a43-9689-02a4ae3ff942", "comment": "Malware payload (Mirai)", "value": "3617946615cd233c41600af503059eb85e7d94ca944ca2c44a787e4c92dfba2a79e861ea944cbced39dc980eb3b169d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678038, "uuid": "2ced7990-a7d1-4fc8-acae-e8312b8a7d27", "value": "T1C0F33B80EB43C2F0DD470C7151A6B337DA32BA2D513BDB47EFA1AA31E895611E529E1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678038, "uuid": "73037652-f747-4285-9939-e2563c919c19", "value": "3072:BGFZhhYqFE0BNqtwqcQ9jWejrUrmynqO24GR7PlF8lt2g:BGHhhYqFE0utwqJAejrUayWgtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779678038, "uuid": "ea5a3c54-c6c6-4c8d-9c1d-8164afea4724", "value": 159240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779678038, "uuid": "01f4ccdd-7f6f-4e0e-b908-edd4a69fd615", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678038, "uuid": "d38fbab0-79e3-4aed-8770-329279519d2a", "value": "nuclear.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "663bb763-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747398, "uuid": "393d514a-5d46-49a6-a00f-bb7f15957336", "comment": "Malware payload (Mirai)", "value": "9c160cf35652ad3d7ae18ca9c0aa531f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747398, "uuid": "ec02a5aa-3ad3-4c44-a445-88760239d72d", "comment": "Malware payload (Mirai)", "value": "d85c0a6f3fe57ae482809a6b846494df2675f6652111b9554f0457c70c05374d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747398, "uuid": "364a3e5d-deb8-4c3e-a77a-244699075fa1", "comment": "Malware payload (Mirai)", "value": "c5efa9d6ef8d45f14cd9d9b3d1c78344aaf846a1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747398, "uuid": "9be86226-aad1-486f-be9a-bc2596b8e2e6", "comment": "Malware payload (Mirai)", "value": "f0dfbd09f03288abd52f7333800f02b43a7db325cb7c59ba5d9610473b5ffa97e505b9e6850845cabb3bb6df6d9347bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747398, "uuid": "460adafe-6e49-45e9-914a-eaaca08be486", "value": "T18DF32981F9414F27C6C712BBFB9E428D3B2A13A9D3EA7103DD215F203B8695B0D7A651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747398, "uuid": "31f025cb-0e54-4cf7-b3a3-edb72abf049e", "value": "3072:tQC7toK0cm5aWW/i4SXdAcTvEG7kJ6hh19OME:tQ2PoDUi4sd1T80kmOME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747398, "uuid": "4bed33e4-1cbf-4ba5-941c-c84a1dcefa22", "value": 158848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747398, "uuid": "ebac018d-9db8-4e64-99e5-6e88ca4543f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747398, "uuid": "c87817ef-fbda-4cf4-8b1a-da167cab8d52", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e274b8ec-57e5-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779678028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678028, "uuid": "da997aca-66d8-4f32-9dba-3aee5448d398", "comment": "Malware payload (Mirai)", "value": "5e7ed406086682f20dbc1360e7865d1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678028, "uuid": "7cab1ee7-11fa-47d4-abf9-04741582a83d", "comment": "Malware payload (Mirai)", "value": "da6177ddc019c9b2a0a0357e9f2876d1142443befb7f69592a6fe1d343d7ec76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678028, "uuid": "45a85b05-1da6-43d7-99bf-0a536442ca5f", "comment": "Malware payload (Mirai)", "value": "c9bc363eec581ccc69ef2a46c0b1c9b6035f4580", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779678028, "uuid": "13cddb6c-7986-4903-8ffe-f3a6ac3dd638", "comment": "Malware payload (Mirai)", "value": "ffb2faf2c4746f66278b93b39a0c29e7119d0531c72ad63b6aff9cec705d80911502d5b0f98a357fca1d52d48901400e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678028, "uuid": "f0ff5c57-5e04-4bac-94de-9dd230e94a17", "value": "T163937C61B57A1A1AC1D0507504B74723B0E12BD95658EB9FBEB30E2BFF632902D12EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678028, "uuid": "eaa7cdf2-77f8-45e5-8a2c-45980d7da100", "value": "1536:f0Yh1LEsEGesCos09BdgIl9XNDuN40IZG0M8x33CSqZWdfdqYydE72oB1Ra1+sae:f0UiMZFXNDs0RlFqddERts3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779678028, "uuid": "07796c7d-021f-42fb-9c99-f5f446f31d36", "value": 96372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779678028, "uuid": "978567cd-9ba5-4a0c-854c-0267ebd4214c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779678028, "uuid": "7900df5c-af78-4ba5-b2bb-934b1d16ee99", "value": "nuclear.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7aa898b-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747105, "uuid": "65a728d9-47fc-4bb5-9b02-f73d927e53b9", "comment": "Malware payload (Mirai)", "value": "0b46a7ba9abd76a64947c1c4a1bf0f7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747105, "uuid": "93d0a255-7d0c-409d-bde7-c41cb2a04320", "comment": "Malware payload (Mirai)", "value": "db8b9405f6cdef30a1484eb96ab261ca322e0bdd2f9fc0282b80a8fd89cba576", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747105, "uuid": "74aa89b2-e207-4d46-ae1b-474f530b1fae", "comment": "Malware payload (Mirai)", "value": "056fe467cf3d39b2fd5f616d7bb0ab5d60395042", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747105, "uuid": "810e9eb6-b1f4-48ac-b631-a9ec246aa334", "comment": "Malware payload (Mirai)", "value": "f05182bc1f648d6689dbf492b9b4844f7d692d240716615b73f6fb6a733e69f9da43d4210d19516067aca841a09d83ae", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747105, "uuid": "3cc0d10c-146c-4dcd-b8d3-2b4a43aeda7f", "value": "T187E33A55B8828A22C9D413BEF92D018E331367A8E2DF7213DD205F2577C7A6B0D77A52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747105, "uuid": "39eba768-6501-48dc-a45f-56d3b6b0bf75", "value": "3072:ShQVnQ899wekE8hf1DAtKVklaHz97VVsdAsMwk4:lVn9wekthfCKSlaNAdAUk4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747105, "uuid": "e09daa4a-c734-4bc1-a9f7-4e483040801e", "value": 145552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747105, "uuid": "a8ed3208-1365-4b15-afad-32fa6f9d17d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747105, "uuid": "966b730c-2145-4866-981d-66bd3a3d78b6", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab2f75f4-5842-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779717878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779717878, "uuid": "925d5f62-2491-4d12-9570-18f5ef41ab19", "comment": "Malware payload (Mirai)", "value": "47494b3792444259533eb7ab289f7782", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779717878, "uuid": "9d182a7a-ac2c-4635-ac7e-dc621cca2151", "comment": "Malware payload (Mirai)", "value": "dd5ac6f4a7b1b6ce4d10dcec2527dbaf499355e5034a0963a9a3eef59c913820", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779717878, "uuid": "91acc98e-1160-49ed-885f-a22f1804796a", "comment": "Malware payload (Mirai)", "value": "59a4a2f9643332af261032c2cc9d5eb16dab33ef", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779717878, "uuid": "2f235808-0b85-4041-8bb9-2e3f60b88c43", "comment": "Malware payload (Mirai)", "value": "344a5ed628f3b708cff8931c188aed4d7bc5a82b76316b7276590ec0975a86daa7d7e8fde0a997314b7a5bc05fab7cb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779717878, "uuid": "45abaea0-a5eb-4623-b038-aa4882d08a77", "value": "T187E43A06F8808F62C5D12576F65F8268732347B9D3EB72069A189B343BD792F4F3A641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779717878, "uuid": "645cc0da-c6d5-4043-bbca-206a618e653d", "value": "12288:Ttr6DymZs+f5SA7Ry0pasq9Z+ic6c6p78pVRKiecMQ25ezCB:96DyqfvVyA3q7+I4McMj5ezC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779717878, "uuid": "7de41866-d6b2-4324-a5a1-c9479af2c648", "value": 681544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779717878, "uuid": "66ea5cb1-56ae-451f-b67e-2234f8ad0a08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779717878, "uuid": "f63873f7-b041-4702-beb2-c5d31f73b3cf", "value": "bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cf84868-5845-11f1-a769-42010a9c0008", "comment": "Malware payload (RemcosRAT)", "timestamp": 1779719009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779719009, "uuid": "49ed946e-a41e-438d-9044-7d911925c7a8", "comment": "Malware payload (RemcosRAT)", "value": "b82ad2590f7b479aa1d2699401ce8b5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779719009, "uuid": "f061881d-9be4-4b9d-bf01-a89c48ea88b4", "comment": "Malware payload (RemcosRAT)", "value": "ddfff81d72e630cb6d8e77e59f362c40b6032d16ed9cd004c7c2e049360b80c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779719009, "uuid": "720d2ee2-79d3-430f-a5ed-6ad4b39a53f6", "comment": "Malware payload (RemcosRAT)", "value": "bcc4406ff6c46923e3bec6652915d1fae88bbe2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779719009, "uuid": "18945fff-22ae-459f-88ec-62d7b1a1a5e7", "comment": "Malware payload (RemcosRAT)", "value": "de4709ecca5467e79896adbb1bed0d355a9321f79f4dd3a101833960c64504514488eaed1dd668c02d19e963769eda80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "remote-access", "colour": "#FEC683", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779719009, "uuid": "f7dfdd1e-c44f-4b88-9264-c692b8dea50f", "value": "T19593D813FA4AD0B2E42591F145426F32CEBCBC3636492173D38FCA41AD79892D456EBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779719009, "uuid": "0066ca5a-5418-4fe6-889d-23aad9047b9b", "value": "d3a62971944197f0701c7049a9c739d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779719009, "uuid": "a53cb2c0-a35f-4fe6-ba80-91e087f90988", "value": "1536:ohhW0YTGZWdVseJxaM9kraLdV2QkQ1TbPX8IHOCkIsI4ESHNTh9E+JP19qkP6Zr8:uhzYTGWVvJ8f2v1TbPzuMsIFSHNThy+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779719009, "uuid": "8309640a-4768-4763-91d0-2d853e67f945", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779719009, "uuid": "7c2bbe1b-2fab-4049-96da-64970bf527c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779719009, "uuid": "2638010c-5bc0-43a6-a17b-a1b975de9e2e", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "874533a4-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747024, "uuid": "d5c41686-023a-449b-b502-011862f06111", "comment": "Malware payload (Mirai)", "value": "1326b589994181a01d80fd8d767ba91f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747024, "uuid": "0de3143a-3126-432e-8418-d3859a3398a9", "comment": "Malware payload (Mirai)", "value": "de224e9a9b44a97f38ca670b4d775cf32dca9d43abbb6cc355027350294f77bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747024, "uuid": "fb3fa648-1091-409e-a0c5-c3783fb9bf06", "comment": "Malware payload (Mirai)", "value": "da67f5c4bb19f226f263f45b26bacd4617c9b25a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747024, "uuid": "60fb2ad3-73f0-48d5-83a0-a83c85292812", "comment": "Malware payload (Mirai)", "value": "394cd321a7852cf9e7af5f130408ebcd252af018b1977a30338b2fc56b8f8bd2cfb3c6e60db9d2ac4c0476545ca69a15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747024, "uuid": "5c00b4f0-c1df-46e2-b615-5fa553fdf80e", "value": "T18034C61AAF610FFBD86FCD3302E90B0625CC641722A53B763674D928F54A54F5AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747024, "uuid": "6de66fd1-7ed0-40de-a53b-5412fe4c914c", "value": "1536:i9Ni84qeNUVD6fQem1/9kIEGh9QS2ZB5f53RYuGMoiuB4GH3EWcZyMtMJeNB1J64:WcforkZGX3i24GJcIC99xdgXHu3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747024, "uuid": "147c5a0d-9d33-45e9-b24b-32333f033f84", "value": 232536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747024, "uuid": "d11e81b0-d9aa-437f-b546-0cb962e9bfeb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747024, "uuid": "b6da40a4-1d81-4f5b-aa07-9956ab1153ed", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd528582-581f-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1779702984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779702984, "uuid": "c3bba860-d477-4339-a454-0d5796bcf027", "comment": "Malware payload (SilentNet)", "value": "74824ff5f4afda07f4870d9e07427e96", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779702984, "uuid": "2c9453bc-700b-419a-a3ca-98c2ed2ab098", "comment": "Malware payload (SilentNet)", "value": "dfea8fc8899c6682c23c6acaae00e0981876827a3321092c243492c109539c1f", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779702984, "uuid": "04de2a92-5eeb-4903-91b3-f6952f3d9738", "comment": "Malware payload (SilentNet)", "value": "4b2b745d1640f5ac4c8ceead49645e8e7bc13870", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779702984, "uuid": "c7895c32-403d-4828-a8b7-0bac9d66b3bf", "comment": "Malware payload (SilentNet)", "value": "82c57fb068fce619de3581122d541a8b501e91deaa911ac36b2391d3be93dd088e967b93f10e13fa5b3273d2fd448245", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779702984, "uuid": "a767290c-3aed-4301-a426-110f731e7da1", "value": "T19BD4239C951E1924CE778CB54A591AE325AD42F40FB0449F1A81E2E3EE1314F3FCAED6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779702984, "uuid": "efb450af-892f-4cee-80f1-f9762feffeed", "value": "12288:jUVIQ050IfV1zzFPqkjCI/ZOYR9Vt2b2OdIIVuvQlzNfs8OW4Ee:jVQ0z913okjCI/ZOQVp1IcwfTUT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779702984, "uuid": "37971d84-4b9f-42c0-9e44-4b32324cf31b", "value": 656298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779702984, "uuid": "c6f29b47-303a-4f74-b848-8249a8d541bb", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779702984, "uuid": "08972fa1-ddda-48d7-8a38-78bdd275d41e", "value": "WizzyAddon1.21.11.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50a29979-5888-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779747791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747791, "uuid": "d167a0ed-4b99-4a88-8376-68e39b6fe273", "comment": "Malware payload", "value": "b280ac15deb041445ffaa43ab5b17963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747791, "uuid": "6e7bf851-e487-4c98-8572-611198d7e8d3", "comment": "Malware payload", "value": "e038309ff7f57bf0eb319e2b4ada6e54beecb4764f3fb4320b4ed10e8709f001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747791, "uuid": "413e603b-0620-4f69-a43a-0e49390f84d4", "comment": "Malware payload", "value": "755ec0ca932bc5e5726cbcf86a7a8b6e5c4f67a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747791, "uuid": "5bd5a0e1-9d79-4e20-bb94-47d65f1fc9d0", "comment": "Malware payload", "value": "b1fce28cf6f7442a7822cb6cc2be64acb576dceffe254d8a124e8861b2c9bcd0d85c7df5ef3c310473473bf76deb929b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747791, "uuid": "c7cf3ab3-4d5a-4853-9755-15d3e897f9ae", "value": "T1B00833396170C43CD936BDF61D6AD98FF21A44167B33E04D629125187EE3A89D0F82BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747791, "uuid": "5402d45b-7e23-4761-83f6-063848c733f6", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747791, "uuid": "d7c94435-a3a9-4432-96d5-79bc64ddab56", "value": "1572864:et9IKPwuWQHRWYuiKKvlmols+MmMMf4HAH+sEp+vSr/sSvKn4Y7:eUK86RWECmMMf4HAH+f+S/sNf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747791, "uuid": "5b16482e-6227-4617-9540-d0822ff20f1b", "value": 77359507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747791, "uuid": "262c6113-14b5-4313-8e8d-947293eaf797", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747791, "uuid": "a72a097f-bc4a-4079-8bc7-761d063d6086", "value": "MySloven.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892df45e-5880-11f1-a769-42010a9c0008", "comment": "Malware payload (LummaStealer)", "timestamp": 1779744450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744450, "uuid": "c52e7d6e-fd59-4348-a261-e8a30fe42eef", "comment": "Malware payload (LummaStealer)", "value": "c94b44641f4b05b403fc92fb741587bf", "object_relation": "md5", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "mascard-biz", "colour": "#666295", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744450, "uuid": "52015419-f6c4-4d3f-a22b-ad70399497c8", "comment": "Malware payload (LummaStealer)", "value": "e03dd36f22e24a323f8db11ba3a220786ea14c5617538b5433911e5a6d1f66a3", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "mascard-biz", "colour": "#666295", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744450, "uuid": "0f466cd1-dd44-4957-9cf4-56f99b92b487", "comment": "Malware payload (LummaStealer)", "value": "98df16d8059b750533493c712b603ceb14ed2c87", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "mascard-biz", "colour": "#666295", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744450, "uuid": "3e64b8cd-40db-419d-a736-9e3645d76dec", "comment": "Malware payload (LummaStealer)", "value": "2171e0334caadb56d3b8a7ddcd8f9a27e58bb0e15cee117eb497218987fb77b2e5fed5f19226ea9701aa5abbe3ee6c64", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "mascard-biz", "colour": "#666295", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779744450, "uuid": "5440b4c3-08f5-4790-86e8-925da999d5ac", "value": "T1B6667D41BCD205F6D412633648A723AA37B1F85A4F326BD7AA5076BC3E772D88D32744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779744450, "uuid": "0a0f76af-3e45-4503-b240-a634a5763b5d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779744450, "uuid": "a3986c10-c755-4f90-a18d-b074594263ca", "value": "49152://CODscXWFjuCp6beG6xwYZJRcSKydeXbsGDxRkgEz:/ZlBHeGKDDR5XtGL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779744450, "uuid": "070d9bf2-ddab-4cb7-9488-92957a222213", "value": 7070336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779744450, "uuid": "d88a1093-f0cf-4cc0-8f65-0d2d64224cf6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779744450, "uuid": "5d3a2e16-db16-4ad6-87f5-4a3d7e5e6583", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2fadf41-5827-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779706295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706295, "uuid": "6dd3e3be-c072-400c-9aec-637936c028b7", "comment": "Malware payload (CoinMiner)", "value": "409ebd11fe97304938b6593ac4c30c89", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706295, "uuid": "06e5edc3-c142-4fc6-bded-ab6e97e6b4fa", "comment": "Malware payload (CoinMiner)", "value": "e0bbf8208a9cb5d5c21f9118ca4395d2a9e1004a12a169125f06e6818aa9f88c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706295, "uuid": "a6a06717-cfac-41af-a626-c90eaae71154", "comment": "Malware payload (CoinMiner)", "value": "25c611a6acc0e478959d94dfaf996d8b5bdfeda4", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706295, "uuid": "62a9b8cb-7677-47e0-bc8f-ab2f82f402ff", "comment": "Malware payload (CoinMiner)", "value": "7e61bf88e9b01c8c7e0c87d497bc9250c3f1baa66aad487b5d5b05d8f46362cfcef2fabd1dba7b93200e9a7fcba29a1a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706295, "uuid": "52f63df1-22b7-4df6-93c3-4d8298f4d34f", "value": "T10FC5E09EE3533C45C4FEBA7B908AC5401AD38C5738F385853E02593B75BE9216F61BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706295, "uuid": "ac158495-fac7-4b95-991a-afc7eb4876e8", "value": "49152:5YkzHg3hPXmXKIqQCo+yozywKMrkPPKiGxwZ:5pHKIqQ7bwKfnt0wZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779706295, "uuid": "e45087cc-4518-4f95-ac2d-e14ffdcfb95c", "value": 2532828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779706295, "uuid": "cbc1535a-c8e0-4811-ac2d-d39ac2095e64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706295, "uuid": "e2e07754-da0f-48b5-b8ff-179050e4e7d5", "value": "bluefix.armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a99ed80-5870-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779737527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737527, "uuid": "8d0be38c-4744-4b2e-a318-c4120a5673f2", "comment": "Malware payload (Mirai)", "value": "5a0d4e4a83deb85499fb3d074752444b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737527, "uuid": "33f2b4c1-84a1-4add-ad09-813237d5eeee", "comment": "Malware payload (Mirai)", "value": "e211586b09f29d5befc4c989bf2719b6102aff054e6afd3dc9e1bad2d5cc0acb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737527, "uuid": "00fa1277-6c36-4ef7-8477-5cb3cbc9470e", "comment": "Malware payload (Mirai)", "value": "3a3816a87646abbf58e6c1bb739ce8ddd3401d37", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737527, "uuid": "876ca99d-1add-4e6b-b9ce-8e1cd61f350b", "comment": "Malware payload (Mirai)", "value": "4efc89dd4df3855c9bb625373043b04cb91f4f26bf561a508dd1216c19d745d86d5e3c2ad9403c2ae08984e0b5e566a6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737527, "uuid": "47182700-4706-4d82-878e-27a77c65bfcd", "value": "T194660919ADC53FEAC41D4B3484EACA9603B05D104AF15A3716A4FEA9BC772787F4788C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737527, "uuid": "f1439e32-a1b9-41d1-abc8-fc6238d727f1", "value": "49152:m2i9Prh3N25GYdp5ryws88cSf+KVAoHK88888i88888888m8A88888h8wfw2XMJr:y2sKH49Eq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779737527, "uuid": "3b135b57-de4b-421e-b9cd-125f2d9448e7", "value": 6750401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779737527, "uuid": "f11d0d7e-37b9-4370-978b-35492b7489dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737527, "uuid": "33941628-171b-4793-b18e-88ac644e0ecd", "value": "mipsle", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b9b955-5865-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779732766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732766, "uuid": "c70030cb-c522-4699-a04d-5277f4b20de4", "comment": "Malware payload", "value": "b84dc9bb2d09ce7a47564ded3d16604b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732766, "uuid": "10289eb3-d8a0-4e07-8e46-05c2410c2d7b", "comment": "Malware payload", "value": "e5a0289fa38bbbf958ebc57cee082111b55f7b8aa20aa9f2e52a38fd66011e80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732766, "uuid": "8f664425-bd4e-441c-afa7-fd70c7319732", "comment": "Malware payload", "value": "3cc29d1cea3a1e5e6351d9bbc2a28bbbdb43630b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779732766, "uuid": "d5af7970-f7a7-4e6b-be23-08da9db4de84", "comment": "Malware payload", "value": "97d8a3197344ee7de18488842cde0825ffaa5708e39ce18b08d3e2d12658ff0027b1f485585c3ac848e7bec048dfaa03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732766, "uuid": "0c57aff9-a382-4f96-8286-a227e9261d1c", "value": "T185135C413BBC9723EA9F1F7DB4F192130A72B712D912E64A5C9C61D919E33809704B9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732766, "uuid": "caf39184-0192-4078-976d-3f5c2643862c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732766, "uuid": "d5759caf-b15a-4f12-97ff-159d6ef4f837", "value": "768:Td4IIYtt3nhBTWtb7qAEbEFCII3QvhtEiopdNAmbLhO:rbf3vWtyAEb4pIkfPopdNVJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779732766, "uuid": "131d317f-bd03-4192-9890-ef99fd914197", "value": 43256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779732766, "uuid": "5db6b094-3b51-4ae6-bea7-73711c865d1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779732766, "uuid": "4f62b6a8-e071-4fbb-9f25-dca21d589c36", "value": "log.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6c139c5-5824-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779705093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705093, "uuid": "49433f2e-b630-42dd-a751-d22324737ff8", "comment": "Malware payload", "value": "9e3bef7118165c82d955ee644a35de97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705093, "uuid": "3125ae59-cdc1-4d24-a42a-cbef2cb56eab", "comment": "Malware payload", "value": "e6a5a5a28414a7fe9ad970c7a510f3b66a50627068db213f60a29f5ccc011258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705093, "uuid": "dac05030-3cf3-4e93-8f89-b563540b4820", "comment": "Malware payload", "value": "6f3c3e74d22b4e91ffacad4899047cc8ba0940d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705093, "uuid": "f170c8fb-20a0-417f-bd6d-2c9460579373", "comment": "Malware payload", "value": "c771dc365ed5e9b2afd9463255efae1f6d9bde21c538b7a5ff9d1b4d3ccf7f20ea9fa687cbda679196cb6bbaee6ce3fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705093, "uuid": "75316193-6e8d-42c7-b6f1-d824905b9618", "value": "T154536C4DBBC8A326D3EF8779AC7206068270E1135903D39E4CD9515A0F76BC8879DBE2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705093, "uuid": "e5bb5093-d643-4a71-a413-cdf502335058", "value": "768:uvDc4tPWQPgvpMYAHWNClWZoZGmm3bKv/fpLJY2Em7UYMcaRKm4Lh/faXfd5c:D4R9KKYbeuxbKvBJY92F9SXfd5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779705093, "uuid": "225cf50b-3b36-4885-a60a-a0440d06cbb5", "value": 64512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779705093, "uuid": "c54601db-b8fc-41d2-b0fb-d0e1215ab5e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705093, "uuid": "39c01899-ee8a-454d-967c-a8cd6a4e0285", "value": "e6a5a5a28414a7fe9ad970c7a510f3b66a50627068db213f60a29f5ccc011258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98a609f9-57df-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779675327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779675327, "uuid": "b56f401e-85b0-4f9c-9cbc-920936fa6ea0", "comment": "Malware payload (Mirai)", "value": "9c0c7c060906b4cf81b26a06d27ada47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779675327, "uuid": "25b01a30-ca92-4e96-9981-599706ad387d", "comment": "Malware payload (Mirai)", "value": "e6cd7cb5aa2e4043c71ce545ea5b3207fd9a96503ac46a69fce67487495b53d1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779675327, "uuid": "2c1a1f29-ee79-449e-9d64-55211c691f8e", "comment": "Malware payload (Mirai)", "value": "2788b812eab56b48725e59be0295c5005e51fe26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779675327, "uuid": "40a6e928-5002-4488-8bf3-e5c05bf17af5", "comment": "Malware payload (Mirai)", "value": "494bb5e42d4b2261b336bbe7e02afb47b0123591d3a38b6a4f4a758ff26db269e91e40172ea92c20e593b4f4e7150eeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779675327, "uuid": "5ab3b590-fb7d-4720-8722-87823dd9bb14", "value": "T1F6B3198ABC818B11D1D625BAFE0E518D33134BB8E3FA7113DE145B2A578AC5B0F3B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779675327, "uuid": "8a9d1fe6-098b-4ba2-bc02-f6dc6b23d819", "value": "3072:w1lRAo0+WPP9JUnQE6O6Dfi4s16mhYMHVyr4dWP0hNeCDTUjgH:lQn2/DfiD5hYw44dWP0XeCD+g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779675327, "uuid": "eea4645b-42dc-4c84-a4bf-a2abb49dc086", "value": 112412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779675327, "uuid": "f3b6df3a-8c83-4e36-b785-fffaf5d15ce5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779675327, "uuid": "a678286c-d6e1-4151-86a8-304930cc2590", "value": "jklarm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb22b6d-57ff-11f1-a769-42010a9c0008", "comment": "Malware payload (NanoCore)", "timestamp": 1779689105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779689105, "uuid": "7b2628a9-1145-4928-8439-062fbe08e7eb", "comment": "Malware payload (NanoCore)", "value": "5f02a1b8bf93a4023269663ec03b0d53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779689105, "uuid": "35e4d645-a51c-4982-b5a8-25dc5a9b4c1e", "comment": "Malware payload (NanoCore)", "value": "e97d440bc8a3c2fb5588520e9becaee6ba90bd55aa2c6496a15684300f0e3731", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779689105, "uuid": "551afcc9-ed7f-49b0-b92f-b89bd141591c", "comment": "Malware payload (NanoCore)", "value": "665f2f5394efa01e414a6b315014b77ba14c02d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779689105, "uuid": "71ffdae0-3163-4dca-a326-78e5544f7573", "comment": "Malware payload (NanoCore)", "value": "ec0610849ef1011f53ff1f861e431de747213fdbe614e5fbcc897d95ec124165af03512a0294e4f138dfa9b90847a790", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779689105, "uuid": "9f004402-ba67-44d9-870a-a8d7e31daba5", "value": "T11814CF2677A88A3FE2DE8679611201129739C2E3D9C3F7DE28D455B39F263E44A071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779689105, "uuid": "7289faa9-7e02-4564-9639-ea59ff6ebe4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779689105, "uuid": "a51130c8-e851-4298-8236-62268ea9e308", "value": "6144:MLV6Bta6dtJmakIM5w8GL+1WUQ52F+/8Ej4ef:MLV6Btpmk4GLUcQsEEj4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779689105, "uuid": "c151c8b0-3939-48ed-ab9b-62c139b6d2d4", "value": 207872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779689105, "uuid": "22ea087f-627a-40d5-9e74-e344509669e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779689105, "uuid": "7be2174f-9be1-43bc-95ee-6e2847b4e48b", "value": "Backdoor.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6a5254-5885-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779746793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746793, "uuid": "3b8b6b0d-44f6-426a-9129-37bb34a73b5b", "comment": "Malware payload (Mirai)", "value": "a347e6b69b9229f371cbf47d76be5b5d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746793, "uuid": "604688e8-3db2-4edc-9255-8c3e2c8b12af", "comment": "Malware payload (Mirai)", "value": "ea827044db3bb527d8c73a71664bab5c29a068fd7a8b9f3c62d2d672d6b6ea21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746793, "uuid": "be9c638d-5d5d-482d-a325-478c1d84545c", "comment": "Malware payload (Mirai)", "value": "64340ef212b1064b675f3fd782e90ff40992378e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746793, "uuid": "6f6dd1ec-a224-497a-9074-89a62cfb48aa", "comment": "Malware payload (Mirai)", "value": "6be8a65b1f145021682e0e189ea74723e266f6524f1eb7206e969b2adf2b3bb5329e216228dbc1356587717e651cdad8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746793, "uuid": "9f3bbed7-bf43-480e-8a4d-0170dc7ead91", "value": "T1FA342A05F8544B67C6D22BFBF78E429D37365B5897EB3301AE24AEB02BC678C1D29111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746793, "uuid": "8003200f-d75f-4a98-b763-1e6aba34fc09", "value": "6144:zbmGaNwAQaaw9IPE0qKfLWyYQAZ1+S8o1WpJf1:AwAmw3WfLWyYQAD+S8o1WpJf1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779746793, "uuid": "24c3c5cc-4895-44a8-9dc6-9b43235ea3cd", "value": 240761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779746793, "uuid": "5e74586e-a27c-42aa-b90f-bd5b5438f9a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746793, "uuid": "f05be6e2-691a-452f-83bb-6a489ebf275b", "value": "bot-e0e4c747", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9e87ca-581d-11f1-a769-42010a9c0008", "comment": "Malware payload (Stealc)", "timestamp": 1779702041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779702041, "uuid": "57678a94-5635-4498-b1b6-30c2428c266c", "comment": "Malware payload (Stealc)", "value": "dd900c31b79540ccb2e585f82fa9746d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779702041, "uuid": "634f0dc4-e0aa-4032-9d62-83c9db8a00c7", "comment": "Malware payload (Stealc)", "value": "eb35e29e65134d98d2a84a140b804014fc52fe90361234e2aed8a52b593d6f7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779702041, "uuid": "420cda68-43f4-4686-8c01-fba59192632d", "comment": "Malware payload (Stealc)", "value": "33f7acb3a82ab87fac9c244f21ab9594f8be1dd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779702041, "uuid": "8dcbcfe9-9daf-44a2-8c7b-1e79ecad93ba", "comment": "Malware payload (Stealc)", "value": "2e98589b19888d042bc1cd42cca889b6f1dda4321c1a8792d552da75b452e62e3dbdb360b7307045bbedcdbacc5c9b54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779702041, "uuid": "c1c5560f-a8d1-47b2-9001-c09532a0cf98", "value": "T14AC6123BE2CB653AE3695A37F572B230453B6E11A5138C1696E0E44CCF35CB11E3E686", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779702041, "uuid": "3aa7b0df-78e0-4447-bcfc-84a0008c2a3a", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779702041, "uuid": "9219792b-87a5-47d0-aed0-e2331fff3fbb", "value": "98304:x5/MGN/IkkMKSVqqSiA0cQVgf8/6WnlntoRbc50lMWeY5MauqkyknKlD:r0GN/IvZ+qqZnVf6W1tGblMpFqRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779702041, "uuid": "5f1ab340-21ae-415e-85e4-72856a51d1f2", "value": 12173317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779702041, "uuid": "241b9898-50d2-4aef-b977-b602dee82180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779702041, "uuid": "f6bfb74d-42d5-42e7-9fce-81b474cf565f", "value": "62.60.226_4.159", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4a7af5-5804-11f1-a769-42010a9c0008", "comment": "Malware payload (PhantomStealer)", "timestamp": 1779691089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691089, "uuid": "c37c0738-aa17-46c4-9df8-b9d52c6b1ff9", "comment": "Malware payload (PhantomStealer)", "value": "3a59dba58469d06be78f7831eabab72e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691089, "uuid": "3cdee460-32ec-4196-9e8e-db6b5b3fedd5", "comment": "Malware payload (PhantomStealer)", "value": "ebaf8f3cf910b2a0e32e97c13712d6dc9ba62fc57ec456a55136420585755bbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691089, "uuid": "afc902b0-3c0e-4d2f-a571-e76af0d18f03", "comment": "Malware payload (PhantomStealer)", "value": "24670a4ae2fd1a1f62a8da1b5f870370a3926f8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779691089, "uuid": "28e8281d-9b02-4bfa-b049-27614ec79058", "comment": "Malware payload (PhantomStealer)", "value": "44106f92d4dc8ba99087354135e10233dcc69f36df1ef3a7454daeabc9da895d71fb539913d3f7c15f601314e52a55ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691089, "uuid": "455ee6a7-abcc-4afc-8ab4-7e2936052efd", "value": "T1776523656617C813E5911FB44C32D3F96B684E68E922D207DBEB3FAFB03A374145A1C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691089, "uuid": "6db87b44-5b6c-4d0a-80f2-ab77c320b40a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691089, "uuid": "c66774b8-dd97-4a31-abf9-c1c6c6c035d6", "value": "24576:OfVdZhwZt804TaLOMvyKJa6wurTY6ezhlzYiZjT8WlBjXRM2682/8d64+a3BzkSd:OfVdXwJtBaKJvVrTY6El5OWlBzRMZ8/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779691089, "uuid": "3b29f2d3-69c0-4e4f-a883-663fc0701156", "value": 1523712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779691089, "uuid": "eb0c171b-33f1-4944-a239-fb9b545102eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779691089, "uuid": "bfdfb98a-769f-47f5-b192-635f26e684a1", "value": "INQUIRY _ PO 5500026552 and PO 55000265531709III2026.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "698b6585-5870-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779737525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737525, "uuid": "0a7cda63-0275-4162-b5b7-80a08b3b06e9", "comment": "Malware payload (Mirai)", "value": "0078153530086a8596e92c72f65021e7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737525, "uuid": "6b2ab25c-c79a-4d07-b1d0-465f02c5d2bf", "comment": "Malware payload (Mirai)", "value": "ebbd64ec1e1359dc69622647f3c28152dd07b57bf92ba71c8c8f0ca23a0910a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737525, "uuid": "4eee8e8c-0fc2-4421-a5ed-6e5cfd3a9a6a", "comment": "Malware payload (Mirai)", "value": "cd47c1d835af782616eea6240ed58240c839ef4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779737525, "uuid": "79ac5508-1a28-4a7d-a8d4-625ca823da15", "comment": "Malware payload (Mirai)", "value": "756273ce970dd1c97652ded5116f3920a9dbb7a166c3634eccfb308a78b0d17bd58bce1ea5d4c4192d66ace3d0285f88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737525, "uuid": "9164867c-2431-44de-9b3c-c40b0704b237", "value": "T1A9465B55FC2C7862D6C9B6716FB613843239BC485F82D3276618BB3DBAF23548F12261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737525, "uuid": "71a55536-9317-4a42-9bc8-6b0d1a6051db", "value": "49152:1Q8jNelwF1qFSFffgoYiarsCRpZ1NTSI5dsr35EYsX:1Qcklu1LfgoYh3kYdgpEP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779737525, "uuid": "d830b0cb-ed65-414c-a450-129e28da8eac", "value": 5636258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779737525, "uuid": "4981f9da-d64f-4ee8-996b-0b9021f84dd6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779737525, "uuid": "eeca4d2c-0efb-4d57-9f96-c14fd0e8256b", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2956f5da-5884-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779746007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746007, "uuid": "fdc295da-de3a-4690-bfbf-bb13d55414db", "comment": "Malware payload", "value": "3b7235a7447da50d3ddeb6abd869f43d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746007, "uuid": "6dcf9a2f-5e3a-48de-8677-1024e1f36655", "comment": "Malware payload", "value": "ed1a00479fe2ea2555882c67719abc86e98b512f122aea79adacf37355cab996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746007, "uuid": "a06a784f-af2d-4b70-947c-86f3725cb726", "comment": "Malware payload", "value": "b5a31ed9fa6c7d0afb7c1e1c2193e0dc663bf78a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779746007, "uuid": "606ca9f0-7869-4dbc-b15f-17dd8c30ea6f", "comment": "Malware payload", "value": "37f7123d5f0e0e9cde905e99ff9617f69634c76cee9fb318bf2b339c1e1076cb797e9044790cca966039f00ce63c37ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746007, "uuid": "c9b3401d-95ad-49db-9537-30caf17d1de1", "value": "T144E3BF123C436668C06180B4C257B962AA3A3E4D23B047F72BE53D5E3D772E19FB7691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746007, "uuid": "12e3721f-0dda-42ec-8988-fc1f1701aaad", "value": "a7963724125553ac672b4dbcada6e45d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746007, "uuid": "694a98c5-10bd-4924-9c61-ded5eef6ed5f", "value": "3072:2ITUSbCedBs6IlQOxUKss7cAzcKm8TewbL7+KVq4axPZh3cthf3yDC+WehYMXRxt:ISbCMBs6I+hS/QKm8TeEL7NV+l2hN+WG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779746007, "uuid": "c43dd879-ae88-4387-8ed7-fba56d4296e1", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779746007, "uuid": "1eee57fb-8149-4f14-a568-05110f1ca0da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779746007, "uuid": "3a82071f-c2b2-45d7-8889-f8568852acce", "value": "2026\u5e74 \u7b2c\u4e00\u5b63\u5ea6\u8fdd\u7eaa\u8fdd\u89c4\u4eba\u5458\u540d\u5355pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e23fa287-581c-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779701650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701650, "uuid": "1ce8eed3-3784-4fdd-a62d-689f7fe5d3ee", "comment": "Malware payload", "value": "64af45d1112930d9d57fc7d04767f63e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "voidstealer", "colour": "#8A5A75", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701650, "uuid": "c8188133-6517-45e5-84fc-b53e6c707b4b", "comment": "Malware payload", "value": "efb4de6a4070c9c721a06230882a97aa364daf4206d082362ac3e5dd30744e8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "voidstealer", "colour": "#8A5A75", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701650, "uuid": "c76dba43-b053-49e3-af00-6cd41c66c8f5", "comment": "Malware payload", "value": "78b883974dd605020445e8f1b50dd48ba1cb1433", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "voidstealer", "colour": "#8A5A75", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779701650, "uuid": "6262e2d6-6fda-4034-a4e9-76a1cfd526cd", "comment": "Malware payload", "value": "47db3bdd5fbd94564b33aeadde82682201da5e6856b55ca06c48835af2def470ef759b03599a077bf1d7c03f759e0ad8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "voidstealer", "colour": "#8A5A75", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779701650, "uuid": "45ce9a63-7266-4eb1-b988-d43ad3a28875", "value": "T15FF733B19AEFEED9D975D13B61922F55090C0E132F0801DECA6D8CFAF2A5970761CB24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779701650, "uuid": "cfcca27e-9bc7-46ba-83c2-c412c4838231", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779701650, "uuid": "b66b33c1-320e-42c9-ae4d-fb88d94278b0", "value": "1572864:1ejOYfv58/CmgRdMoe7PlXvwMptXkXUbI4R10SMexuCKcB4M0U7:14na/JgjcwgVLR1iTCKU4Mz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779701650, "uuid": "2c6ea074-5bba-47f3-ae42-02d0793f6cb8", "value": 76702751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779701650, "uuid": "28a97d60-0cab-43a4-8a7e-fd4250526520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779701650, "uuid": "9e752e71-11ad-4ede-a970-ee04aad68701", "value": "EchoVoiceMod-Installer-Wizard-1.4.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21187017-57ea-11f1-a769-42010a9c0008", "comment": "Malware payload (Phorpiex)", "timestamp": 1779679851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679851, "uuid": "a8b0f7f2-b98b-4f74-a3de-a579e63f6a13", "comment": "Malware payload (Phorpiex)", "value": "6f53fba21b48bf436a9b0696e27c0e6c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679851, "uuid": "ef879ee5-ec20-4368-bb71-87f2146796a1", "comment": "Malware payload (Phorpiex)", "value": "f0a2e52f99091dc85534cc8b3b300327bfddc1a91eb9dfef9a793e40fdbeadeb", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679851, "uuid": "339ae747-cc9e-4139-b5d1-7479b7d56d59", "comment": "Malware payload (Phorpiex)", "value": "9d650f4ae6565dfbc313bb5358be576e3d886d8a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779679851, "uuid": "bafa985f-a100-4008-99ef-f779daed9142", "comment": "Malware payload (Phorpiex)", "value": "c0568ea95130ddcd1c0ac1caaa8b639e3cd65f58f99b35d4edd40c25bd131cb3e0723a8af5499745441af2f35c55fea3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-phorpiex", "colour": "#6B8B5F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phorpiex", "colour": "#C56AA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679851, "uuid": "89261f88-ebee-4a34-b8d6-86e07a647785", "value": "T100823B0FF9814216D1E110B05675863BDAB99C72338454EFF7D48A990BA86E6FC3215F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679851, "uuid": "ac37ed2e-1017-4df9-9216-a9845bd85229", "value": "b8b034a37970476c0e8791d5941c31e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679851, "uuid": "2a79167b-caec-4192-b2a9-4813bb2fb5a9", "value": "384:6cIJlVYeryskwAd0ZHu9JgiL7QWav8U9cu5:iw0w9la0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779679851, "uuid": "48bfb673-6b47-4898-a110-38da5871e1e7", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779679851, "uuid": "319ae11f-781a-4a44-ad1c-4e100540cf62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779679851, "uuid": "9793e553-8554-418d-a10b-1d737ae8644e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b324a68f-5886-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747097, "uuid": "310aa6d5-964b-4f56-b210-9ccf44a863ad", "comment": "Malware payload (Mirai)", "value": "8c9ac84bf9bacfa5e51095c1cd7f5b96", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747097, "uuid": "3f9a0cf6-1aac-48ba-b166-0b32d3baab2b", "comment": "Malware payload (Mirai)", "value": "f274c6b31df78c79831b16aa05e1c049242c76abd744bbd8e268239e8f4ecc9c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747097, "uuid": "d13c88e3-8165-432b-917e-a0cca580dc53", "comment": "Malware payload (Mirai)", "value": "5d39618754333bfa914a896d70f99be76e138df3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747097, "uuid": "05cf2a01-7efc-4f9c-b87b-6049d2f7607b", "comment": "Malware payload (Mirai)", "value": "ee5433409b31b95a4f5d6c6d840d8c343ffba590b7bd748908e1d8b90da6ec3d628e6616f090c05d55bfda30558d5cc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747097, "uuid": "ed11590c-72e1-427d-aeb2-2091a6cbacfc", "value": "T107D33951B9825A27C5D123BBFA6E028D332963E8D2DF71178C215F2177C691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747097, "uuid": "c088e919-361e-4671-ae15-054181cafb53", "value": "1536:9ZrC6uZMkwCc5xFKqJ2AjHSUIOQYacwV84V77X1LpZ7oGQN6ZTrwhiA9yqd9Ck/V:frCukwCoqUI8677X1zoNN6dwhphnbtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747097, "uuid": "554555ab-3882-40ca-b3c0-a1199e904194", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747097, "uuid": "d73dddc9-1569-4ee9-af38-4aaefd839563", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747097, "uuid": "2307f5ee-e2c3-4687-a38b-f8d5c433328f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f227c3a-581b-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1779700866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700866, "uuid": "9bcb6354-1306-4a65-b88a-5df359ff4b4d", "comment": "Malware payload (SilentNet)", "value": "3561110ff8ff87e9e288c4fbbc82d7a5", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700866, "uuid": "1810e367-8049-4b01-acb0-3f949e14f210", "comment": "Malware payload (SilentNet)", "value": "f29be0a82b2e76c8ab44a9a1d3eef13e1f5340c7cda4c33e05fca6f220cc5917", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700866, "uuid": "6ea295cc-7f89-461a-a92d-46287fc52842", "comment": "Malware payload (SilentNet)", "value": "11665b764634e3ac934ca7bd84cc7f7a26a556d1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700866, "uuid": "b1f14aae-9583-416a-8a5b-23320728736d", "comment": "Malware payload (SilentNet)", "value": "809479a6b8d9de2b9c172e8ce9b2ec3c2e9309779cdc9a4c6a63e47b2d64ac500afa94aa2f1262bc28409d8152cd296f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700866, "uuid": "2dab28d1-0716-4203-b0ba-5032036fd912", "value": "T1FA563350B31BCF80EE1FD13605750A8A1F3A41608E41AF634B5AFA8B7E5E3B633C6955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700866, "uuid": "17d9f7d3-5535-4eda-b48c-51c16bee53d4", "value": "98304:jnwhytdSV1+Em0+N/1vBai2JS5LaPiIrr5NSbq4MmQKLA/DnMaT:DwhgdSVfAN/3ai2EIi+OIDMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779700866, "uuid": "fc74a346-901d-4a8c-8222-aae6443f2f32", "value": 6405608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779700866, "uuid": "7f807698-df6b-4d90-86dd-f4ff4ed13439", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700866, "uuid": "cbf2e4f0-ef3a-4399-a003-72c315fddcb6", "value": "KryptonV2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d24c607-5816-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779698850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779698850, "uuid": "89501d2b-4b3a-4155-a8e7-e12bec870881", "comment": "Malware payload (Mirai)", "value": "094a3f2e1d3325d2a2c9681c20b8966f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779698850, "uuid": "b084d920-b85c-4802-9097-d027cfb10089", "comment": "Malware payload (Mirai)", "value": "f2aba97b83192723c2ae0f691025497188e19aa6061cc0c42807fb3ad346a09a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779698850, "uuid": "fd7c9a13-7956-4cb3-9564-61ebc9e2c7ce", "comment": "Malware payload (Mirai)", "value": "78732cf77355889df993c903fafd7cebca07ddb6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779698850, "uuid": "f8b7d5ef-8450-4bbe-a5e1-6bebc3a470ad", "comment": "Malware payload (Mirai)", "value": "ed53a4d960d6cd33a669a5946053d64762ddc4b04328234faffb410687d552d5ddae6d51129dcd6cf889c3f559298605", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779698850, "uuid": "7db274dd-ea30-4a43-956d-fec73c17b441", "value": "T166F092974B91042B0F7508D0F0FDC714220563B65B24422C7D4A8570BBC52D7F373969", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779698850, "uuid": "c41b869a-41a5-4bed-9417-6440220c235a", "value": "12:yEdEqdwq4XmaZVgzd3/FZ7cll7qxOvK4aF:uTH7qxhF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779698850, "uuid": "cb436637-4b99-4d8b-8deb-80d4f88122b4", "value": 462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779698850, "uuid": "e7cfaa9b-00bd-46eb-8619-72594db0e7db", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779698850, "uuid": "f902f4a4-8011-4852-95f1-af95d4fcc386", "value": "wipi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8c33070-5828-11f1-a769-42010a9c0008", "comment": "Malware payload (SilentNet)", "timestamp": 1779706842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706842, "uuid": "fbb65c17-3ec8-4186-91dc-e2fe8a3a8680", "comment": "Malware payload (SilentNet)", "value": "12c4dab0e07b5749249a28e55e18be7d", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706842, "uuid": "bdac72f1-5acf-47a6-95a5-433a357b98b4", "comment": "Malware payload (SilentNet)", "value": "f324a5794c121e48e39bf29c099b0e2c6e268d417e469be3e6c1732fd69398e5", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706842, "uuid": "46ded906-3864-477f-abe3-c34ca1734d0b", "comment": "Malware payload (SilentNet)", "value": "1008d308d93d2048e7e3e5ed123c2151dfc133ec", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706842, "uuid": "561e2cdd-d3d5-462f-b0ec-4d84e852529c", "comment": "Malware payload (SilentNet)", "value": "f115dfdacbbbd07e610876df9ca4c2cc5b40756cecce33f9b1fcd0a626727df97b0202fcec26818987e2b336a0baed19", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "SilentNet", "colour": "#3481D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706842, "uuid": "0166e4e5-ddd3-46be-bff5-27fc9f0d4495", "value": "T1DCB533FFE44A08C4F1B18B984CE61AA79C474577D8FC5A8E5C0E52913F769C4F1AC2A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706842, "uuid": "59d22094-d2a4-4ec0-836f-44fe9686fdd1", "value": "49152:jV3NbZ0Kh1o15ybh8rmAGJzxzP5ITHfnsPGTNXAPeHoBFt:jJBagiXuq5Wz0THvsO8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779706842, "uuid": "f74861e3-2e76-4925-ba42-08a05ca7254d", "value": 2407796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779706842, "uuid": "1471a14d-2acc-415b-9a33-ffbfc70e4cbe", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706842, "uuid": "8297ba3d-f5c7-4387-8299-70e7e05626db", "value": "Krypton++.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a20b0de-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747297, "uuid": "8a3fc703-8a89-4217-8e1e-493c20032988", "comment": "Malware payload (Mirai)", "value": "e7bff14145d40f60631c6ba08ad74743", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747297, "uuid": "35c6ac6e-b88d-4287-ae30-9197a22bdac2", "comment": "Malware payload (Mirai)", "value": "f3a9d46c2b8eea216fee25e4d286e6afe501fb61ca33cbef2a8f080aafc6cc80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747297, "uuid": "07f0f1b0-787c-4a07-b828-e2e497f9b70e", "comment": "Malware payload (Mirai)", "value": "64dfd25332042a0bb5f374d5e8002df472bcf681", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747297, "uuid": "e6f8043e-3e83-4374-af24-163736d6a467", "comment": "Malware payload (Mirai)", "value": "4efbeca26309a47b1c3f027cfdfc3988e378dfbf8f8511885a0fd3efd3a9ec745ab6d5422baed0db41dd9c425780d5af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747297, "uuid": "f64e514a-2db4-4354-904b-bbb3abfa9062", "value": "T14923F19ED3B1237CD42D323898BE659728D0F51B62A449233EE4709DB8AD7E06B1DC53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747297, "uuid": "9c993356-a049-4423-8173-abf17d89448a", "value": "768:EessG0aMqhczBPPoy3YWX/RJOHXkRMscGQaUdhBMfng+SwnbcuyD7UoQRj9:EessLD556HXbayaJnnouy8oy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747297, "uuid": "f2db502f-43e7-43f5-b92e-aa401bb29027", "value": 46724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747297, "uuid": "4b214d7c-7575-4245-b0c0-ab8f0b05ee68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747297, "uuid": "e8e0f57c-6d35-4bfd-b88f-e4a9e20c734f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "124d9ad7-57f1-11f1-a769-42010a9c0008", "comment": "Malware payload (AsyncRAT)", "timestamp": 1779682833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779682833, "uuid": "08cfeb53-3fc5-4339-9a68-6a99947e812e", "comment": "Malware payload (AsyncRAT)", "value": "56668c98ff919d4550d1d67ae27a06aa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779682833, "uuid": "4b8a5a13-0d03-4c84-b3fb-758bb64bedbd", "comment": "Malware payload (AsyncRAT)", "value": "f407133c05f481c19c4715c2a8a967a7c6efa03109fe21f768338fa085f80b17", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779682833, "uuid": "506a5660-684d-4c89-ba04-4747867f4414", "comment": "Malware payload (AsyncRAT)", "value": "0b4c19164b64a95ad41458f36f24aebbc6fef557", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779682833, "uuid": "38fa6f15-887b-402c-8b15-f0b2e7cc9270", "comment": "Malware payload (AsyncRAT)", "value": "1dbdbc94982cd0fbb29ee7bd098f0a0158672acff680e15a738c394d59948ed3c57f89bbc7b417c7d7a3349492b6a96f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "botnet", "colour": "#0DE97F", "exportable": true, "hide_tag": false }, { "name": "c2", "colour": "#D61A10", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779682833, "uuid": "2cc0c6a3-6794-44a5-9fb0-3953d64e7fcf", "value": "T113535C002798CA65E2ED4AF4ACF2550106F5D9772102DA5E7CC814DFAB9FFC64A027FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779682833, "uuid": "7c53321d-fd44-404f-b10e-10f2b4889e60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779682833, "uuid": "fb591150-3a96-4fed-a48e-239444278547", "value": "1536:IMs0vS1fOPneNUUX5vKCGbb8wkypSJEQKpqKmY7:IX0vS8neNUUX5v1Gbb8v0SpZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779682833, "uuid": "891908fc-3db1-4ca3-9089-f7b2468a38e9", "value": 66048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779682833, "uuid": "30cbb2bc-eac8-4720-9c4d-fa07a7a3eb5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779682833, "uuid": "66841cb7-a93d-44eb-8209-e82a05f38cb6", "value": "zenithflow_app.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51ebcabe-5850-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779723742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779723742, "uuid": "08911f49-6c6c-4963-80e0-4246ec294715", "comment": "Malware payload", "value": "5ae8717c30a45df86f34276c2748049c", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779723742, "uuid": "17b59ea0-f524-472c-87e2-0148070de331", "comment": "Malware payload", "value": "f58c66cfa44c6761e477c78a83e764138200e849e43fcf0ffc443fc87161696d", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779723742, "uuid": "ca709a00-3a1c-46e4-92bf-b645e470e278", "comment": "Malware payload", "value": "38fe01bf0dd46737251b39ff695652dd07863e87", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779723742, "uuid": "f6844427-a36c-49d3-bce0-9e830e9e2fcf", "comment": "Malware payload", "value": "3c4d847bdb15f7ab87c441fdef1e93796fa92140cc77accdd6e779c8013c24ac3448b502ff3c0268340b3057575f6154", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779723742, "uuid": "afc75f34-0f1f-4054-a827-9be0afdec5df", "value": "T1A6B6125BBCD404E6C0B9A336C8B362927B75BC080F3263D72A90B9782EB76D45DB5354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779723742, "uuid": "4798d998-d1d0-4fce-b1df-f04487113089", "value": "ebc247a77b4d4a804b261f97a1fd075c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779723742, "uuid": "2951087a-5f8d-4356-a1fb-2d117066e508", "value": "196608:TpFpzJ73IqIIjoypV7YBr03Mq5xleq1afWIlW9SiVJ/16L9kuDvGWUOl:TdzZVIKV7YBr08q5beq6WIlMJ/ukuDbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779723742, "uuid": "701b151f-6f7f-499a-a410-740e218df8cb", "value": 10660992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779723742, "uuid": "e1e1a8ee-34f2-4980-b1ff-86c3e12134fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779723742, "uuid": "d268b3f5-15f3-4724-addc-0d7ec4f8f3d9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71557ba-5827-11f1-a769-42010a9c0008", "comment": "Malware payload (CoinMiner)", "timestamp": 1779706302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706302, "uuid": "7a4768fc-3ba3-4bae-83e5-ecaac72311b1", "comment": "Malware payload (CoinMiner)", "value": "7bbac1f17e2d4d337fbc3dc61ddb218d", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706302, "uuid": "4aef1d04-7e63-46fb-90f1-b1c8be720106", "comment": "Malware payload (CoinMiner)", "value": "f92544ce064e237e31f2e00b78d793d1dcde308d8b629a01a33f93b42b9e6a42", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706302, "uuid": "54a7bb57-89ee-42ae-8b33-62c5e3d6c482", "comment": "Malware payload (CoinMiner)", "value": "c3ad8c62640407116d04c1fb4ec5a986f31b4b0c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779706302, "uuid": "411ea6bd-a4a4-48b9-a623-39e8b6d0c3d8", "comment": "Malware payload (CoinMiner)", "value": "dc3a5a4812272a764273e47479b6f4b8e00b0de387cc2bb778b1e8d93d15a3dbedaac9ba70d8a64aa6d50421b48e7805", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706302, "uuid": "eb0fd923-3316-4d11-bc3c-05314da47d8a", "value": "T10C266B06FF1C8923CA431EF0193F83D9F3152A8380F5A229775F6B472665E36A197399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706302, "uuid": "8c1bb713-5ff8-4906-bfad-f404c254eaca", "value": "98304:AzUUoUEDwOz+Plg0ivCFT0ahC64fYlFJirhOEaRFRq0cywVlult6RyYxjWIT43Pz:HUlONrtT4YRu5gscq5mihGk5aUBqRcF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779706302, "uuid": "f485715a-3267-4035-a736-d4a7a24e6218", "value": 4860788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779706302, "uuid": "c9995557-642e-400a-90c9-542158bd0895", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779706302, "uuid": "a6501ca3-e925-4505-a69e-53d77597b9cd", "value": "bluefix.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce30e97-582a-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779707600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707600, "uuid": "7e80f94c-be45-446e-9376-eae81ddb185b", "comment": "Malware payload", "value": "793999bb681f3aff9111a842e411604c", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707600, "uuid": "d80efbec-2ede-4d2d-b49e-d0a2659517ce", "comment": "Malware payload", "value": "f9bfd95b4a37ddb0240bf2b5950556fcf51e347eda3fc52d9a28d73488547f53", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707600, "uuid": "dd11cb26-71be-4871-8ad6-4b222d481c31", "comment": "Malware payload", "value": "eb242a7a24b74d24c45cd1a1913ed5cc25468267", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779707600, "uuid": "0c030b2b-da47-4b0b-8a00-65289574ebb7", "comment": "Malware payload", "value": "0915df82c7401e6000bab128096af39038be043e9c7388a31c1acec08f2b46d18601709919be055789ebba295eb367e2", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707600, "uuid": "507fb42c-b64e-4f3d-bd84-d09a073431de", "value": "T1599002745440575DDA4568199F34C5C055201181569235B62F4155CA1D60679E550995", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707600, "uuid": "d5a05f29-9f13-4d2e-9cab-458defa84d85", "value": "3:VSJJFIGFBuIFldoEFI8EyOG+:s8GFBxFI8EzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779707600, "uuid": "314d9c14-71c7-4a7c-b196-dccb7e92ebde", "value": 56, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779707600, "uuid": "8483f9f9-7b03-4e98-b635-a72a9edd900f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779707600, "uuid": "a0b89871-97b2-4ef6-badb-fd5981dc3c96", "value": "ps.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fe53b12-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747360, "uuid": "af44cb63-080e-4e1c-b7a0-d9d0a44e1030", "comment": "Malware payload (Mirai)", "value": "9ecf253a569a5a53009f040191340fc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747360, "uuid": "64d60589-a2a5-4d4e-8495-4a492e9374ee", "comment": "Malware payload (Mirai)", "value": "f9f007cae9366067ef65cc7cd3cdee3bef3ddcdb441f273726060584a02b9c35", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747360, "uuid": "8b16333e-8e42-479c-aab7-c9db35ecd8de", "comment": "Malware payload (Mirai)", "value": "522a30c9de82001682f7afb0ee422bfc11285b9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747360, "uuid": "6dc365f7-51e1-4f37-85b1-e1ef0f0cecbb", "comment": "Malware payload (Mirai)", "value": "e0a5bff2bc794df9c98da024d01210870f3e22aafb5ccf7ec73c1e55cc775f86eab1c14287b0273bf26f2651d6c388cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747360, "uuid": "29006937-c6ac-4e93-86b3-90a430821fb0", "value": "T178732A91BD815713C6D012BBFB5E028E372A53A8D2EE72179D226F2137C786B0E77641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747360, "uuid": "6781b0b2-eb29-48b1-bb6b-70f666513356", "value": "1536:86dz9MTC0XU66EeOpT5brAMjztPz+Sbjt+UvAs/hY:86dS6ELvrAMNb+AA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747360, "uuid": "fbe77d5f-cf54-43d8-ba16-47fb8ea19614", "value": 75392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747360, "uuid": "016409a1-d0b8-4a70-8912-ba6bd3bd4a20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747360, "uuid": "0dbc4728-1953-49a0-83f2-7754bd992b61", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ffd41a2-5880-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779744247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744247, "uuid": "3de66715-62c0-4543-a8ed-fdacf8e9cbb4", "comment": "Malware payload", "value": "40132b6d4730d1502c425b891efb3efc", "object_relation": "md5", "Tag": [ { "name": "185-102-115-17", "colour": "#D4F2C4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744247, "uuid": "865bb6f4-2e6e-455f-82c5-13dc08ed4d07", "comment": "Malware payload", "value": "fa16b64ae95d6492be2074e65a0d6eae3ddb8adb9706f41f1fb0ad71c50aa7ce", "object_relation": "sha256", "Tag": [ { "name": "185-102-115-17", "colour": "#D4F2C4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744247, "uuid": "2fb1625b-2058-4264-a78b-e296b5fedbe9", "comment": "Malware payload", "value": "570d93e3cb98089a00340b159af7329038f9ec7a", "object_relation": "sha1", "Tag": [ { "name": "185-102-115-17", "colour": "#D4F2C4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779744247, "uuid": "0d7c2eb8-1ec3-4ce3-b883-fe49d7113784", "comment": "Malware payload", "value": "28dcab7b2b3aa8a9d379e2cc670352d1cea17dc1f2c9b3817529104b4f7162a5f8212e64a7b1339f538b606c57a45c26", "object_relation": "sha3-384", "Tag": [ { "name": "185-102-115-17", "colour": "#D4F2C4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-OffLoader", "colour": "#5CB2BB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779744247, "uuid": "e31d75fb-c795-4fe3-a4cc-bbd1df752599", "value": "T167656BEEB068D0D3ECE4F272D01EB61E592AF8A694C085DA57D62725F95D01CBC1B233", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779744247, "uuid": "d6ebb5fe-0668-4b66-93b2-c55837f20d57", "value": "24576:nRHjrTqTIdqMGb5DAbHdzauWwWD6s3GeFaghgefWcKBTdObOjfSySN7Hios43r1i:SWScTClcTys57yDc/e8STrVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779744247, "uuid": "089b2cf8-b64c-4827-9093-c2f51a0b9c65", "value": 1512656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779744247, "uuid": "727de355-fd70-4263-b695-82ca4994c903", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779744247, "uuid": "965f7c72-18c1-4a2b-af84-2b6ef74a2352", "value": "sunwukongs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6aa0f58-5849-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779720931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779720931, "uuid": "13cca42d-8eaf-445f-9e7f-fe76103281ef", "comment": "Malware payload", "value": "d09c4c7533e53632a38d635ffd43d91c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779720931, "uuid": "654e4b14-919a-4f0c-b285-b96b6735be76", "comment": "Malware payload", "value": "fa50c0eda132cebc0e28ba4a0157f9b66ec8b5e288c204dc4df911ae87734a40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779720931, "uuid": "3fa999bd-5193-4cdb-8382-a87b0051e88a", "comment": "Malware payload", "value": "f866ebc8fbdbb39876e30f8fea2694dacce28549", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779720931, "uuid": "05693179-ed68-4fcd-982a-7bb0bb9d690f", "comment": "Malware payload", "value": "d1454099f55d02b2497412b739fb6d897d7ab7381a1feb77c1b6585d4ab650b103eed9a1e01b1faedb610c303eddec7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779720931, "uuid": "15db3078-8db9-468d-ab79-b00cd486e8db", "value": "T10F55C931EB00445AF9C2033369EC959D80957D318BDE40D3B2869DFA95AE3F26736A87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779720931, "uuid": "35c198ee-7d64-4e2c-8673-5eeb0803ccc1", "value": "99ea9e23e313bcccda3a2d224b088ae5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779720931, "uuid": "5e2d951b-0154-4d25-97eb-9db335a88d63", "value": "24576:nva3+u5s6inIUGs7BWv54O6RgJXNhx7XJ73T:nk2PnIIlWv54O6RgJXNhx7XJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779720931, "uuid": "03de1e97-c526-4e11-a64a-4c3839937e36", "value": 1395200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779720931, "uuid": "933fc007-3e52-4b82-abae-389954706099", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779720931, "uuid": "53945c3d-91d4-45a3-b848-3819db600d64", "value": "fa50c0eda132cebc0e28ba4a0157f9b66ec8b5e288c204dc4df911ae87734a40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfd186c-5824-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779705023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705023, "uuid": "fbcc2b4b-aced-457f-833e-fe65500b9128", "comment": "Malware payload", "value": "c1b0bc1cadfc350963dc5b72ddcec4e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705023, "uuid": "752afb1d-8579-4fed-bf76-16e54ee17ae4", "comment": "Malware payload", "value": "fa621c1554e0bacc82e3d38037b237907f088f8427bd80f730f60efe9879872f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705023, "uuid": "03b3c279-85c5-483d-9535-ee269bb7efa6", "comment": "Malware payload", "value": "6aa66c089ae6812f701eec32668c4f4c07f76b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779705023, "uuid": "fbd9b07d-5533-4e29-870a-27424069f3a9", "comment": "Malware payload", "value": "c69f7e4edb29fce52a1d73d876e35d06be98e0e6008a921399c44f7252fedb28f1f0b7aeb92a35de24100beaff6a6d19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "kevtel-com", "colour": "#54DF73", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705023, "uuid": "ce7cccf8-f674-448d-b7fe-1ce3756affe5", "value": "T1F8C402477BC84725D24A9272C4D78E2443FBEACB6277E3467F4212961E413E0CD96B8E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705023, "uuid": "53793d2f-dd77-49e5-97ac-62ec748bae65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705023, "uuid": "2fa88ab2-558a-40a7-ad64-2c4fed1f8a14", "value": "12288:3lkl5SA63hEZR5xC0cRVA/gK6eO0QRbP6xGoX8flt0b4pGeBm2yY1:3lkzSA6RGP0VeqelQ9foC982B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779705023, "uuid": "d7ef82f4-0ef1-4f38-ab44-e1f1ccb682f3", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779705023, "uuid": "4306a45b-392d-4033-ad85-cadbd86a0d53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779705023, "uuid": "d18f9c9d-6776-4c15-be75-1d818797ae6d", "value": "fa621c1554e0bacc82e3d38037b237907f088f8427bd80f730f60efe9879872f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2d42290-586a-11f1-a769-42010a9c0008", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1779735044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779735044, "uuid": "4e25a169-8639-4f08-8a2b-1c277fa49f3b", "comment": "Malware payload (Gh0stRAT)", "value": "4acf6196f919873f54fbe714d1b51ff8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779735044, "uuid": "02cd95c9-2470-4335-bb39-3d87cb41d399", "comment": "Malware payload (Gh0stRAT)", "value": "fa9996838c5459b9124f9f06f75bec832cfc0368782b33466563fd50774b5ae2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779735044, "uuid": "ea390860-2d0a-44c0-9177-ea7cd2de08db", "comment": "Malware payload (Gh0stRAT)", "value": "a0a43fcb79a283aee466b690ad567019171169eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779735044, "uuid": "9828b4c7-dd93-4a77-9163-48da924fc5f3", "comment": "Malware payload (Gh0stRAT)", "value": "eee2b53ada2695e3a3873ea86703a89bb505de43482138635c9a1b04662a4fb997d10f4561d52adbd83eeffd97a5dd65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779735044, "uuid": "fca9d0f6-8a37-48b7-aed4-1bc94d062c3e", "value": "T10827333FF29CA63EC5AB073245B3971088B77725651A8C2B57F0484DCF2A5701E3AB5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779735044, "uuid": "2c8b5614-0a68-4b5f-98f8-545a969ceb0e", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779735044, "uuid": "429ea929-ef1c-487a-ae1c-9deb4f3d0a60", "value": "393216:+eW5uHgBtDlP13QZCwb76VCqsoGvFKjQJvktQOK2v0Xj:+exHgB7t347yCFvFKjCvXOKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779735044, "uuid": "2a1fa884-c387-4127-bd1e-f0806b008835", "value": 20471068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779735044, "uuid": "1c91582f-353b-492a-b565-e3748e0efb63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779735044, "uuid": "933d8f5c-75c8-46b4-8a6b-73acf7cc1fba", "value": "Ring Design Drawings.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1dd4c8bf-5887-11f1-a769-42010a9c0008", "comment": "Malware payload (Mirai)", "timestamp": 1779747276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747276, "uuid": "b47238a7-3a02-48ae-91d7-62f63020e977", "comment": "Malware payload (Mirai)", "value": "91f7f155fa81ae476df747bc45208bd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747276, "uuid": "5e7ea451-e7b4-440b-9202-eff0230ece50", "comment": "Malware payload (Mirai)", "value": "fb124879e651fce06de0adf8ee7f62046bdf0e50e7a288c7e6956f09dfd7c08e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747276, "uuid": "ac087348-3f34-449b-aa29-a796462c2214", "comment": "Malware payload (Mirai)", "value": "78f2d94f750686d03d441388c14134fd0b593025", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779747276, "uuid": "84a5672f-6303-47e9-8767-87c4a8ce8f2d", "comment": "Malware payload (Mirai)", "value": "7ee7cd0debedc38fb573360509eb191e8c5e1f4094453ff55db824fc00e5ba2b2433df686a63ca117845f6a5d0e8ec4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747276, "uuid": "2f468240-b26a-4b73-937c-77222d57498b", "value": "T122832A97F400EDBDF80AD77B4453090AB270A3A105830F36A39BB963FD721A45967EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747276, "uuid": "cdcb9d57-d734-49ae-90d5-86aca4818917", "value": "1536:quKG91i47gWxYRyRqwwrzPQtav8FjWtFUo/V6OXZJ7/aNSOFmA7ExtX1dT:q5GTjxYRyRqwazPQta6Q9VXXz4FmA7ux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779747276, "uuid": "da4a5380-8e6b-4e14-84c1-c4922a95345e", "value": 81652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779747276, "uuid": "54a03411-6579-4b64-bb34-51f937405adc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779747276, "uuid": "3d82a672-2f84-4005-a98c-bc3e05caa515", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ae29b7-5801-11f1-a769-42010a9c0008", "comment": "Malware payload (ValleyRAT)", "timestamp": 1779689984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779689984, "uuid": "d2d03f6d-ef71-4fa0-96df-ff197421f60b", "comment": "Malware payload (ValleyRAT)", "value": "631a792abedbe2e31ce539862cd7edf4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779689984, "uuid": "51c4bdb4-4b45-4f96-bb93-eae800dd9ae4", "comment": "Malware payload (ValleyRAT)", "value": "fb152cc3f7065d2bcf13045fadf442a76995d74cc334ee32fcd6937662110c5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779689984, "uuid": "899dc0c8-da80-40a7-b446-b759345e35f7", "comment": "Malware payload (ValleyRAT)", "value": "b85f6ceb88aa2da869aa78d231d62ae933e7727a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779689984, "uuid": "09522bf8-e6a5-4e73-b3aa-4e2942c1638b", "comment": "Malware payload (ValleyRAT)", "value": "d080a59335ef15a7515f6828861cd2ca08e5c5dc1adaa826db4889e96a4d0b939ae70968a2bdf6f0e23f6b74423ec2ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "Trojan/SilverFox.bg[qtsc]", "colour": "#C77927", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779689984, "uuid": "242c6267-4971-4eab-b545-ccd40df1504d", "value": "T19733633B8F9095A4E7AB84F3EF6A655A94BBF0785080BD17123C3925550F4A12FBC07E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779689984, "uuid": "ed80a6af-029e-4b5c-b272-38647e81546a", "value": "61aee1efa149f59d7615c8dc7392ffa0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779689984, "uuid": "3001043b-eda5-4d73-a304-f687d1203fb5", "value": "768:J6aqQEc428dD1ZLVZRlrhrQIdA0+e7O94cIeXhNyCiCH:7jR8RfL3zRQ+Op4cbhJ/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779689984, "uuid": "affd2af3-e72e-4c64-b031-e5054490007b", "value": 52224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779689984, "uuid": "ee4c8fec-b2ef-4ce7-8dba-98112b28e6bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779689984, "uuid": "4d81a216-9043-45c1-bdde-831470632b6c", "value": "2026-\u5e74\u7b2c\u4e8c\u6279\u5185\u90e8\u67e5\u5904\u4eba\u5458\u540d\u518cPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584758b2-5819-11f1-a769-42010a9c0008", "comment": "Malware payload (AgentTesla)", "timestamp": 1779700130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700130, "uuid": "a53caaf1-fdec-4df5-9b20-f23ac9a25925", "comment": "Malware payload (AgentTesla)", "value": "2d6d2fda1ea156036566495ad5594228", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-cyberflor-co", "colour": "#EB825A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700130, "uuid": "d9d276dc-ae67-486a-83be-807bd363174a", "comment": "Malware payload (AgentTesla)", "value": "fbb00701ca21983b5245d21a46f1f86b9c89659fca3629bd3514819eb92ea53c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-cyberflor-co", "colour": "#EB825A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700130, "uuid": "d06d0dbd-e4fb-4e52-8069-b8e8aba93165", "comment": "Malware payload (AgentTesla)", "value": "a99932c566736618ea0adefe12248255aac4bf51", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-cyberflor-co", "colour": "#EB825A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779700130, "uuid": "e301e26e-eb60-4fbb-bea6-5a98aad74f5c", "comment": "Malware payload (AgentTesla)", "value": "ffea58f1a615358400503c8ee3a99980a5a5db8986d24c699ec4278a594c66baab2926a26acf5018f2990c51fe661129", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ftp-cyberflor-co", "colour": "#EB825A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700130, "uuid": "ef85409a-d620-46d7-adb8-c76a1619bda9", "value": "T15B340E037E88EB15E1A83E3B92EF6C2413B2B0C71633D20B6F49AF6614516525D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700130, "uuid": "97385b89-4740-452c-b977-e43e1742c54d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700130, "uuid": "9ba73fc5-e8ef-4e57-a201-032e0bbd95ee", "value": "3072:NCppimSVMrdtm6/d7Uz5t0i/bMqOub254Ssko2F:MppimSVMrPXd7UFN/oqOub9/k/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779700130, "uuid": "d3a2b612-af4b-4e9f-bc87-a7c4ec287d5b", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779700130, "uuid": "c6dc137a-e454-4698-bd3d-43811597978a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779700130, "uuid": "0368da57-89aa-470b-bc2c-5cec94a99ae4", "value": "fbb00701ca21983b5245d21a46f1f86b9c89659fca3629bd3514819eb92ea53c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e6afcb-587c-11f1-a769-42010a9c0008", "comment": "Malware payload (Efimer)", "timestamp": 1779742705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742705, "uuid": "2345f5b7-ccc1-4198-8552-66941f3b564f", "comment": "Malware payload (Efimer)", "value": "6b024d090a29460233335e7217bb3de4", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742705, "uuid": "526b748c-0303-4c23-8f30-3cda7a89b356", "comment": "Malware payload (Efimer)", "value": "fc597a5b0c91bd4787d194a68031db40c71f85b3b6d6e0c6b89b9d143e76c797", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742705, "uuid": "9dbd2026-af05-425f-85be-7916441e0d56", "comment": "Malware payload (Efimer)", "value": "35b6101420b634028b797f245c433d04f324e52e", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779742705, "uuid": "f7b32bf7-e47b-4c1c-8af7-93096652cfad", "comment": "Malware payload (Efimer)", "value": "33ba0b0d4ec2cfb5ad8580c236b8f24122ec0befb208c6fba193dea20beed38c189927a0c6e07b80d8c0af311760bb22", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742705, "uuid": "5e475aaf-92a2-447d-a603-d2c5283d0432", "value": "T1E6D6330D85E666EEC77791B06EF350B4B8A8B8550132CCFD5BA4C7B1BD0B5A88DAD007", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742705, "uuid": "09d93398-3323-4d32-90ec-d007852b4672", "value": "c5e49de42b1165b00bd79240b8cd617d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742705, "uuid": "2d9dd344-4206-4d39-9af3-d4ce7e4d1579", "value": "393216:uMSR4LdV7jPbn8IVnHXMCHWUjXUcuI3/PGTAI:u6LBhXMb8XBH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779742705, "uuid": "a1c875c9-9a5d-45c7-ba46-790c2d79f5d0", "value": 13841267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779742705, "uuid": "72749115-fea1-42a8-8aa5-8727b905fd50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779742705, "uuid": "5895413f-8e59-4e0a-aca4-b8653d3c2a69", "value": "common.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "491c519b-584b-11f1-a769-42010a9c0008", "comment": "Malware payload", "timestamp": 1779721579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721579, "uuid": "be36716f-ac4c-48dc-9b42-fd2def83ac1e", "comment": "Malware payload", "value": "f516de5fe17a274fe7601ddf084674a7", "object_relation": "md5", "Tag": [ { "name": "acrobat-lat", "colour": "#81FF4F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "m-acrobat-lat", "colour": "#7822FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721579, "uuid": "305f227e-abc4-4f83-b173-17e615006a74", "comment": "Malware payload", "value": "fcc04ecdc68d2aeb2c7d402e33f549fbd51213caac7c6134393d0b5f21bf6312", "object_relation": "sha256", "Tag": [ { "name": "acrobat-lat", "colour": "#81FF4F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "m-acrobat-lat", "colour": "#7822FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721579, "uuid": "ef527638-e44a-4f14-bad0-f53108edb029", "comment": "Malware payload", "value": "bf21aaf84a1e3b1b83a74a5613daa62c137fc3ab", "object_relation": "sha1", "Tag": [ { "name": "acrobat-lat", "colour": "#81FF4F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "m-acrobat-lat", "colour": "#7822FE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779721579, "uuid": "cb728d31-2982-4a30-810e-8e82752f4f03", "comment": "Malware payload", "value": "faebaee347233a558a41bde3e1c3b8b9d3b75a9b62a9fdea009215ea7d2095ede25ade8c2b6c83d30fee8683ac47a978", "object_relation": "sha3-384", "Tag": [ { "name": "acrobat-lat", "colour": "#81FF4F", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "latam", "colour": "#6BDD9A", "exportable": true, "hide_tag": false }, { "name": "m-acrobat-lat", "colour": "#7822FE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779721579, "uuid": "a2343343-4ebb-4757-b316-6e5e2c2f7a82", "value": "T1DF213845696283C879712A64C37DA201B0D2526BA5D0FD58F7CCE042BF25657EB091F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779721579, "uuid": "3eaed77d-cdd5-4f9a-a03b-e7d71856ea60", "value": "24:k42cLLhJwYgTjMTGqoLldp6XlH0RY5lTlqh9TAKUZFBKG4jvN1IlESjLBKuYjxf3:k4lL7wbTzBMXva4Z4vHo9y8hNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779721579, "uuid": "5332cfbd-18a9-4af5-9bbd-8e259fd2a3f6", "value": 1309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779721579, "uuid": "c7520919-b7e8-4290-af56-e4d35fe20654", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779721579, "uuid": "b9fff017-19e2-49db-a6f7-9288752f7785", "value": "fcc04ecdc68d2aeb2c7d402e33f549fbd51213caac7c6134393d0b5f21bf6312.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7f6f7f-5811-11f1-a769-42010a9c0008", "comment": "Malware payload (NetSupport)", "timestamp": 1779696839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1779696839, "uuid": "79c9fc55-934f-4ccc-8567-a94eeae5cf0d", "comment": "Malware payload (NetSupport)", "value": "90ac2bc1e8c8af0541a69403263c63a0", "object_relation": "md5", "Tag": [ { "name": "193-202-84-64", "colour": "#FCCA6E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1779696839, "uuid": "3048d97e-0f28-4e8e-bd0e-418228af710f", "comment": "Malware payload (NetSupport)", "value": "fd6710dfa4cfced8656950d70e3ccd1468fd43962ee6268a19b111ecc2015d34", "object_relation": "sha256", "Tag": [ { "name": "193-202-84-64", "colour": "#FCCA6E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1779696839, "uuid": "8607f06a-da2d-4156-9a30-e8e54e3e1d6e", "comment": "Malware payload (NetSupport)", "value": "f810630502898ebd29efac3709344a6fb9becc81", "object_relation": "sha1", "Tag": [ { "name": "193-202-84-64", "colour": "#FCCA6E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1779696839, "uuid": "d7e760ab-539a-4717-842b-2efbc95beacb", "comment": "Malware payload (NetSupport)", "value": "a47993f83d7dfb8d79bd3a2da7c13b685d23427573a30b510248180b998dd69c7a33ddc69c9d604d8e22023b970594ba", "object_relation": "sha3-384", "Tag": [ { "name": "193-202-84-64", "colour": "#FCCA6E", "exportable": true, "hide_tag": false }, { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "LIC", "colour": "#A95D4F", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1779696839, "uuid": "1ecc7df0-eaf4-49f6-93b4-6dc1fd0d52e0", "value": "T1A6A2D010CFFED090C82FC7792074AB685FB1E7DCD25766A0E9C975585CAA8D816A34C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1779696839, "uuid": "8875e7f2-1cfb-4cb3-a625-09c63587bf03", "value": "384:w462TNtW0irngh+6/jiE+AT9cWQ31ypb+FALpY8IsQie5:GQtWLr8+6/j8qpQ3Ipb+FALfJu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1779696839, "uuid": "2b615f4d-22ed-439c-842c-e857e9f0faa2", "value": 22141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1779696839, "uuid": "79b5f5e4-6b74-44c0-9f44-55308debd421", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1779696839, "uuid": "ac5375a5-1bff-47bd-ac36-ff58c714045c", "value": "SPAM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }