{ "Event": { "published": true, "date": "2026-08-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2026-08-16", "timestamp": 1786924981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d3bd96cd-a39f-4b2f-8a4f-e69e7a46e2af", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1712a444-999a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786902251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902251, "uuid": "e58e369f-c4b6-4c35-aaeb-911ed5e6bf64", "comment": "Malware payload (Vidar)", "value": "369b32bb1e14b61d118f46dc70a0203f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902251, "uuid": "c9c6ec4e-79cf-4e86-b200-88c8a58c2e87", "comment": "Malware payload (Vidar)", "value": "0142b1f1e18d36943fc883ccf665e124594e032d1d924b487731e06345dd50c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902251, "uuid": "f376ebb9-bfa9-422e-947e-ad0961d875b9", "comment": "Malware payload (Vidar)", "value": "589b77411b4d3712e86ac6f393549346fbaad602", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902251, "uuid": "c27d81e1-9b7d-4660-b0e4-c0313dfb3dc6", "comment": "Malware payload (Vidar)", "value": "0341625fa567fbedda02e2ef442987714e10ba39ecb2f1e12c90ed3d6ec50b49ab49428d01f9ff1a24d6f5e48eb78584", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902251, "uuid": "d17abec2-056e-453e-a7a8-3c8317fa5372", "value": "T15B367C177E9088F6C0AAE735C4BB4259B674B80D8B3523D32E616EB82F317D16E76740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902251, "uuid": "6a920780-a709-4efa-a97a-e52152dfc77c", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902251, "uuid": "28f46e5a-db0d-4cde-80e8-969954c51921", "value": "49152:00Yk7r6Uor0g1ETabB3p5gg64hpmrkoDdguOS8pKvekMxz:04o9Zl64kDuuODpKGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786902251, "uuid": "139f4e6c-c574-4dcb-b9f1-3f7aa543559e", "value": 4966248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786902251, "uuid": "9af4a331-d1c4-4d9f-9866-8baf00401b9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902251, "uuid": "9398364e-0105-4d4f-855d-63b35ebd10b0", "value": "0142b1f1e18d36943fc883ccf665e124594e032d1d924b487731e06345dd50c2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad46498e-998d-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786896920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896920, "uuid": "77a1b283-ea45-4438-9fbe-185d707ca8b9", "comment": "Malware payload (ValleyRAT)", "value": "4138436b1c5ffa5301e4c10a1292c21e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896920, "uuid": "3dfa8b49-fe75-475c-a45f-90254bc2be0e", "comment": "Malware payload (ValleyRAT)", "value": "02a97b438854101f396a32e95b69b463ce19b327ccbf4d700a5a982cf3575d39", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896920, "uuid": "96d8d8a1-99b3-4fff-8c67-ef4eb1b5f5bb", "comment": "Malware payload (ValleyRAT)", "value": "0ba59175eefc8ca6bbc84be56a8e11e776bd860d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896920, "uuid": "42b045ed-47b4-48ae-b39c-04aed4d279a5", "comment": "Malware payload (ValleyRAT)", "value": "f3a6def3fd779b536023eecdcc9d5d90cb0862163b6dd85304d899a48334264f9c390c2f8ecb6bae4cafc69dc33d8710", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896920, "uuid": "75e7f871-3e55-4f72-97ba-3094d750e9ca", "value": "T1E246C0133E9C00A6E05A1133CE69B6ECF16EBDE83B76019715A4BB1DFD32741CA1456B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896920, "uuid": "7d0b38f3-a782-4274-b149-b5c9053425bb", "value": "015ade0acc2769b31f99b52582ac5d1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896920, "uuid": "7dde8304-eb01-4c1b-b982-7dcdfe0b7e29", "value": "98304:eJ4pESpilkCHK6fT5ippzPTq03qKvhoKZ4OiZrq1DfPHNADtV6v+zM+rwroDrroC:eKDcKpzPTq03lvhBZ4O7NADtV6v+zZRO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786896920, "uuid": "0f397394-8c8f-4dba-a770-70735590af4c", "value": 5764096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786896920, "uuid": "e9a8b101-df30-4bbd-bcb3-a8377bce1b00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896920, "uuid": "df28d98c-a75f-403e-8b3d-9a1c2ea2f186", "value": "4138436B1C5FFA5301E4C10A1292C21E.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6cb2ec-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786915115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915115, "uuid": "229b67e4-305d-4044-be55-bd327b9d6cbf", "comment": "Malware payload (Mirai)", "value": "5cc1fa8d9d8343fde1ef0912fd2a6308", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915115, "uuid": "e887f25c-53aa-484c-8adc-f1f915fefb92", "comment": "Malware payload (Mirai)", "value": "03b6868916eec5a491bfd866d0407e21fb4df8efa77a11224c3a14686b77ebc7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915115, "uuid": "08244f1f-55f1-47a7-a226-b4a3e517edd6", "comment": "Malware payload (Mirai)", "value": "0c831dc6a03f97cafc81991b7fbde219ba10656f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915115, "uuid": "98d50f92-b474-41c9-a4f2-bf47d5dd5da8", "comment": "Malware payload (Mirai)", "value": "5857bccd8ed1442fc5d5d75b841211f058f1503ef9933267c43998e316700c925cdfa9b1bd79b01dff30fc27918124dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915115, "uuid": "348e64c0-03b4-41a4-a2bf-5950206c0abe", "value": "T176343A85BDA29A22C6C2167BFF4E418D7316639AD2DD7102FD2D2F603FCB46A0A77141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915115, "uuid": "64667099-1fe2-415a-b90c-7e6210e4c90a", "value": "6144:WUiCsf6NsRo8cG3vsi7dZ4quKP4Pl3dZdLGqGV4lssM7khWot:WzR6NsRZcG3Ui7dG+P493flxlssM7khh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915115, "uuid": "20e21e68-e0b9-46cf-b21b-d43b84aff1da", "value": 230348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915115, "uuid": "60046667-6f58-4a0e-8e73-8e4b36b97459", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915115, "uuid": "bb76a32b-0d98-4937-a895-16976ca8b81b", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35e462d6-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901444, "uuid": "b12dd82f-018a-4472-aed8-bac163a39b5c", "comment": "Malware payload (Mirai)", "value": "adf57afaa159592101454f2a8e5ff398", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901444, "uuid": "03fd0c7c-704d-4702-b50e-2ddc7418f41b", "comment": "Malware payload (Mirai)", "value": "0456e20d11f2d38aa5b216487ffbff956da517c4121d91bc6e2461793aa40d71", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901444, "uuid": "8c2f470f-27e7-4064-9ece-db8d64c41165", "comment": "Malware payload (Mirai)", "value": "66aea708df843cba7d42adfacfb9d268ff4263e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901444, "uuid": "2e2dc1f0-11c1-47d5-92ef-e0d54d4b0fee", "comment": "Malware payload (Mirai)", "value": "55178c0f580c1722cc1c0cdf669f28d7a856ebe20b356d65335cf7bbba31b06d25295f9878c524eda6ab437310f3b232", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901444, "uuid": "933e0d0c-feba-4465-9e3c-5f8aea223de7", "value": "T147C3AE73D42A7EC4D1514030B8B5FEB51B61A5C041935EBB26E9C87A00CBEA4FA0AFF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901444, "uuid": "5f76e506-e3b8-4c69-a140-fe07b882bdfd", "value": "3072:hfpZykqkt436I+9eIHjmNOkSMPXeC4GnHZ:hRZ0F3BcSNOkvZhnHZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901444, "uuid": "d7cf8148-bace-469b-94a9-54574f5fac5a", "value": 120332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901444, "uuid": "6a50db0a-9b57-40ba-a270-05b5c82d6bae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901444, "uuid": "163e686c-4b36-4519-937a-69e85e073473", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38f2cb76-99a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786907891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907891, "uuid": "354432de-1766-49fc-90f4-523dfd3e1bc0", "comment": "Malware payload (Mirai)", "value": "b0864277a669a29697e39a47b0236a11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907891, "uuid": "fba61241-00ea-4806-aee2-225ec3667bf8", "comment": "Malware payload (Mirai)", "value": "073d66a89b4d983347c878d55d83b38ef5e990e8c091c7386d78b4629ce4ec08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907891, "uuid": "479fc58f-58c5-4b18-9b7b-7d9a06c97a1a", "comment": "Malware payload (Mirai)", "value": "863ce1642ebbddfc7180293962a1a75ebcb67d40", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907891, "uuid": "05805d7b-6648-4a86-92cd-f34a4912b9d8", "comment": "Malware payload (Mirai)", "value": "4dfeaa372d580e7b224d49072fead129692b8fa11c4b8812c3d670a29aadbc9e42bb9e34da6f19ce9cd27efe7778fcec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907891, "uuid": "e1499b66-3217-444a-b83b-17b646711b14", "value": "T1836301E7ED5A65F2C5780DB0F5A01DA2BF6171FAA4CA24B52C0A0D0D0CA1C76FA7D943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907891, "uuid": "663e8322-7350-48d7-a4df-2ceda8e68911", "value": "1536:rnDY9ng4Z10P6/MEyaY7EouIpLrTyeZ2eXzbiyJPlCohLE:nVLi0JepeZ2yj/hLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786907891, "uuid": "46be0ec6-b26f-49b4-8fbc-f2bcf78ed13d", "value": 68464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786907891, "uuid": "546acc33-ad22-4795-9198-5fa4450e8cb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907891, "uuid": "75e60ef7-79fe-4b6e-9074-2dc03b909e42", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc0bdc5-9914-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786845055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845055, "uuid": "f98a4d03-85f1-4a88-af80-689695172055", "comment": "Malware payload", "value": "1b32d1f9613f86ec5a94447fbf1166a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845055, "uuid": "8962bb8e-018b-4ade-a165-39cd6d1c4e2f", "comment": "Malware payload", "value": "075c704d7a0ce2ce66a8cd946a3b255896cd9d7b63f31068f960b98e89d154cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845055, "uuid": "b04d834b-befb-46e1-80cf-30fdbae874b1", "comment": "Malware payload", "value": "c6457e22b45656cf3835b3efd7deb460679cfef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845055, "uuid": "26ee36a2-53c3-444b-9b91-4b298f628df7", "comment": "Malware payload", "value": "41443283c196d7ab28906d9d4954f55e01471a3aa15be577ec141320c01dd80891b8a83f800c14fafc1dde37ba8f8449", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845055, "uuid": "23fadec0-761e-42f4-b84b-962db4841cc4", "value": "T16F06AC077D9040E5C4AAAB31C5778262BB61BC0C8B7933DB2E90AA782F727D25D75F44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845055, "uuid": "b5a90e06-b73b-44c8-8ad0-487113f164ae", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845055, "uuid": "dd4249b4-67e3-4482-b5e5-125ec8322f2f", "value": "49152:ojvSoBbZbntyNT/a+a4cpWPtqVa3kRAOn4rcirrTZZ:oTTKaw3lqwURAWucir5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786845055, "uuid": "4b83395c-afa2-4819-80c0-ff38371b535a", "value": 3861336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786845055, "uuid": "6e2d7630-e1ec-4f21-a582-d1034d4186e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845055, "uuid": "67501852-04c2-4749-b038-c7a7edd966d4", "value": "ws-Setup-Complete.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23a4a54-99b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786913678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913678, "uuid": "c46021c9-9f1f-43b5-9373-5fbe4e801487", "comment": "Malware payload (Mirai)", "value": "cfb2f8a76cea0797a825a8645dfe961f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913678, "uuid": "262e0a53-3e69-47d4-942d-2830e8c2bbad", "comment": "Malware payload (Mirai)", "value": "083eab84fc1ac0deefb5f8e51447c4a099219c6650fe33b4600dc8e1db5fba62", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913678, "uuid": "f1d5a77f-2596-4000-b02a-6b399afc0709", "comment": "Malware payload (Mirai)", "value": "ed6f105b457054b3f71bf75f16b917d00c2044e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913678, "uuid": "a0674dd3-f84f-4125-921d-5352a4d8663a", "comment": "Malware payload (Mirai)", "value": "9b2f8c2e3c0010f8b67c5b34331ceef803314f565feed14d3f7644bd388500ab51264a8cb9e8694c4149c6390bb08dd1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786913678, "uuid": "8c4e7877-1f62-4781-ac8d-b6fa875cc932", "value": "T135D4C80B6E228F7DF67487314BF74B249B6D23D627E1D980D19DC1142F2128E592FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786913678, "uuid": "2c35d2ba-ed82-4c01-81ca-9bcfffcb22ac", "value": "6144:EW5nGswqLYmbvx2WHfS3UzmnvEDNkMgtfJVBfBQBiJ0yAKiGd34jv17dqWgbrbD3:F5Y+Dx2UUnvD6HyxXKVENKZqnBUqL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786913678, "uuid": "4f4740c4-1cff-4b33-9953-c1187dd4e453", "value": 648392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786913678, "uuid": "1b19ba8d-c6e0-4c8d-a1cf-40c613090169", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786913678, "uuid": "406e277f-4390-4444-90cb-b5bb03e0ff21", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cac60ae-99ae-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786911012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911012, "uuid": "07bd2484-dd86-445f-912b-799681a211d7", "comment": "Malware payload (Mirai)", "value": "54977c0bcad3c21621e11f9126dc02d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911012, "uuid": "05d769bd-26b7-4bfe-a48d-a37180eebfb4", "comment": "Malware payload (Mirai)", "value": "08626ff1610dacf45e4265722a82b2676834392112fdc2cb5100ba40dc70ff8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911012, "uuid": "8bf8a180-dcb9-4e97-9ea2-38780c4ded88", "comment": "Malware payload (Mirai)", "value": "253005a34e9faeb31899c94d2990063195466b0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911012, "uuid": "d56cc2ff-416a-4cf3-9510-3c4f6948b087", "comment": "Malware payload (Mirai)", "value": "d7907b5cf62ad24c87371d8878493e0b71f6cc4760ac8b6fcdc14707a04af686d2ba6c6c0140b98bc8f1f3f76523b87a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911012, "uuid": "e185e901-f235-445b-99f1-3cc194d585aa", "value": "T117630224F126F0628D1031266A25448D697FEBDCD1BF4B223B21A5E4F5BBF8934B144B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911012, "uuid": "5b3d1655-eaf1-4426-b908-337833a8328e", "value": "1536:0StAEUIu8bud6DxAnI0kUL22XbqXXore5FIvjllWfyhPLL:08AENbi0x5UJrqore5GllWqFLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911012, "uuid": "79ffa613-3ce8-49a7-9afc-77e5005fd0f4", "value": 70276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911012, "uuid": "50f75406-e137-4d38-be82-7a155596bee2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911012, "uuid": "69bc9ee1-2b65-4ea7-b469-580f2ba86d49", "value": "08626ff1610dacf45e4265722a82b2676834392112fdc2cb5100ba40dc70ff8c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b453a4-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900845, "uuid": "ae6680f2-f839-422a-8b4b-5a83ba639abb", "comment": "Malware payload (Mirai)", "value": "357f78a1fae377cb8c125eefd787662b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900845, "uuid": "fb1e2450-9e59-4067-a311-5e65bc76f601", "comment": "Malware payload (Mirai)", "value": "08c4a76f8266722694961c1ae5e43fe29be4ebabc3418ee897b32d6a1490a296", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900845, "uuid": "963ec7c3-29c6-41e8-9162-fb13181fd8bf", "comment": "Malware payload (Mirai)", "value": "30f84f83008836dc147e2a0b550556221bfde8d0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900845, "uuid": "49df7e25-dd9a-4206-87b5-60be3d5d00d2", "comment": "Malware payload (Mirai)", "value": "d73e46915e6a355baed4c22a3d21e274e12899a1ba8c9ba5441e36a2241cde513038293c1df30ee0c74bf5494c69af44", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900845, "uuid": "467ff360-6f4e-4d25-a1c9-b4df0aca2ab4", "value": "T12B33F29B220441CAE1EA21381B4583C14A238BD4D483755FF297F367CFB1B7566A2BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900845, "uuid": "14d22063-fd97-4796-adff-c25a7c080206", "value": "1536:tsjdEqhaDQqTnJeWmqjtB491Djpde7al6ekf2bdVJuR:tsj2qADTNeWmqj4djlXkodVQR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900845, "uuid": "2cf6d29f-78aa-4cf0-8e3e-0474af2c2b84", "value": 54612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900845, "uuid": "0fd14f97-5693-4e01-b77f-bf094dccdd8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900845, "uuid": "1ceb20fc-4fa3-4eda-86f4-283673e442f9", "value": "miron.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d76e91e-998a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786895551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786895551, "uuid": "953124c2-38f6-4627-ad54-74a2853c045e", "comment": "Malware payload", "value": "77654ba879a50411f2b804c14b1d799f", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786895551, "uuid": "fcdfd833-f570-4d26-b604-361b025591ea", "comment": "Malware payload", "value": "09df0b71b4cd7144433db1b4a689f01b1d85abadcd29962b75d740c5846002c5", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786895551, "uuid": "8fa09af1-2b21-4de9-a576-437780d99014", "comment": "Malware payload", "value": "5b92187a3c7de1cb29e5d7430ca11ac257f65488", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786895551, "uuid": "56eeff03-6eab-406e-8e63-f9da7229555c", "comment": "Malware payload", "value": "e9e7aedab120f6af2b290c17077ecae5ecc5b60e9c271f4f81dcef6b2e544258401f3d4dde5c2490607049bbccd5a8f2", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786895551, "uuid": "8b2e4b14-b6f1-4c90-b817-5dfb0ce6ee87", "value": "T175E633857AE011FEEA7380389BE156A3E838B8721735C9DF57AC426A7E571D0443EB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786895551, "uuid": "ac8aba1a-a47f-404a-a257-eb554fa1118f", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786895551, "uuid": "742d83c7-353d-453e-904d-3e66fc6eaf44", "value": "393216:8LZGPztwEj6EzYbqkyI1V07xzXMCHWUj7cuI3/PGTAI:WUJwa5j/I1V09XMb84H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786895551, "uuid": "12b71560-e1f7-463f-ab04-f4820f3e4e7b", "value": 14089454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786895551, "uuid": "ad18d2ef-e400-4837-a062-1b3d4989cb67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786895551, "uuid": "99a67c75-df67-41b7-86d6-f4e2a0c04bf0", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92b5fcf5-990f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786842759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842759, "uuid": "52f49118-3070-44d4-b657-ab1ee94feb39", "comment": "Malware payload", "value": "9b3d5b2419f4d77a5828171e0b1c4707", "object_relation": "md5", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842759, "uuid": "6bcb89cb-e49b-4b78-becc-b69f0295f761", "comment": "Malware payload", "value": "09ee5443809176dcac8ddd954e2dca7c3ba1d0692fca9394d1f1c78e3d943f42", "object_relation": "sha256", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842759, "uuid": "1fdd13f3-23bb-4a73-b5c5-b9462550662e", "comment": "Malware payload", "value": "7e7a6081c35b68da1b736ddd46df618514eecc5b", "object_relation": "sha1", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842759, "uuid": "07618da9-b7a5-449b-b5b5-4aadd575ce8d", "comment": "Malware payload", "value": "3b4eae03bdfcf09e2bc2d09e9aa33ffef1f7bb1c068bd5c987f5877d7b910368f21d28a5c28c7e47f6e20cac02ba7e06", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842759, "uuid": "fd229f57-7a07-435c-8ca1-73b9677aeb52", "value": "T176D02213882F04736F2000898330327BF9C2626C53878202EC90888D340033E3DF8308", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842759, "uuid": "0bfd5c6e-219c-4792-8b8c-c8607bf42dc6", "value": "6:SuKxVABeQXiVnXKbywlf3Ggk0ZapPX2xkVA2FfAqLez6MFM:ixVABPXiIZu50Zap+qVA2Foqiz6Mm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786842759, "uuid": "f830b286-f6e5-4bac-9e99-0b5d56123e90", "value": 208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786842759, "uuid": "7e586a99-9f8e-473f-9236-da32bc548b17", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842759, "uuid": "ee126331-6bfb-4b1e-9004-cc9350d870a4", "value": "OpenLink.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d2be96c-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786901376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "7cf56ece-0b22-44da-a909-80f9e093b9d4", "comment": "Malware payload", "value": "4e7c9a6b6118cf4e142553468a57d31e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "504d6818-08cb-4cff-8829-2d4d4fe50f5c", "comment": "Malware payload", "value": "0a1296edf8c8f890164fda0342e980e8b286f24b2f2503d093988897cd0774a9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "17c8905b-98a1-491c-ad8c-333e7a0def2e", "comment": "Malware payload", "value": "7a8d8b4cc85782a42e2fda401bbb5743b8cd964d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "5d406c32-f01d-4fab-ac35-a823847b3351", "comment": "Malware payload", "value": "e8a7ad02bc01f8e10284bd8bf6394160f8ab7fe064d32623c4bdbadb7a53e7b4887e6392ee617d48c32393cece59faaa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901376, "uuid": "8d54387a-f0d9-4bdb-9af4-da5ac9bf5537", "value": "T174B30782BB43DEB3E85300F112B75B254A32FC3E4836DA95E3797DB589165C0A62637C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901376, "uuid": "3f3ebb39-45bf-48bf-8ff6-b74aa7bd21f8", "value": "1536:r+etcc2GNc4bWTe6whLxEiHFFHihRuvf7XLcC:qEB2Ge966whFEMXvEC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901376, "uuid": "2fdf78c6-c1aa-4883-960a-5dafd68c9385", "value": 110168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901376, "uuid": "3426b3ba-c0fb-4ecc-92da-f825ab7cad0e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901376, "uuid": "bba9e011-9fff-43e8-af2b-10c35fc732e0", "value": "eclipse.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c19c5a6-99ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909776, "uuid": "888aa0a4-9757-4a00-a7eb-2541d3fb7619", "comment": "Malware payload (Mirai)", "value": "4cb80c8a5cef6f4a5926428125a23477", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909776, "uuid": "802f0951-c29c-43ce-ada3-d35ff13cb422", "comment": "Malware payload (Mirai)", "value": "0a6dcc49c0ce6535d54f3ae2f0f079d33d294090236585885c792f3b1a2ca5bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909776, "uuid": "32d7d396-8958-4b13-b7f5-f7530051161c", "comment": "Malware payload (Mirai)", "value": "f7662a829a0c0eea1038c477f18eacfcd3481744", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909776, "uuid": "f33370e8-dc4b-4500-9697-71d667137914", "comment": "Malware payload (Mirai)", "value": "8427a3191dd422300cc9e8bff9944d44ce446a89fb64ff9823644bf3d84cf428e5e924a4cec6ff62ca39bf8c2ff764cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909776, "uuid": "0e9f99f2-1438-48a0-b3e4-3a8e00902e67", "value": "T1F243F1A2D2326ED4F0FA75B5DD45900253FF405C80ABB377A560634853C2C932BB972E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909776, "uuid": "fafb4b6b-01c3-42e7-8a6d-98c5ac3c89c3", "value": "1536:vkxgyInKM8Kw70gO7/BytpcRUz70kCyfP:v3KM8XO7/B0cRS2y3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909776, "uuid": "abe4055d-0436-47ba-a9ce-13f91ab08ded", "value": 56276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909776, "uuid": "9cb271c5-df59-4bf2-8553-fea709b4b284", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909776, "uuid": "0ec26613-b9ac-4be3-bff2-e05a2969464e", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abc2b18-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901130, "uuid": "d3c9f796-73e7-4a90-a4a4-4a7612d1797f", "comment": "Malware payload (Mirai)", "value": "187008ff117e7fe7cfbff88902c5a3b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901130, "uuid": "9cf0cc1e-b9d9-47ef-85fd-adb607509fb6", "comment": "Malware payload (Mirai)", "value": "0a888ca4421723714277309f62bb25ca0660246bc1e2a238d3ff13caba6baa68", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901130, "uuid": "269d20c0-e614-4f98-86b4-637272fdc3b5", "comment": "Malware payload (Mirai)", "value": "516780bfe16c75c56648d0221b4ef4b2fa024d7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901130, "uuid": "f8148c9c-814c-4bab-ad69-30f494c74e7d", "comment": "Malware payload (Mirai)", "value": "db69f912f8596e15b7de903db6644adb70072ea5b616e25923040d2de31030e1c890075b38a47f6910560131d094b6bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901130, "uuid": "73270a87-0328-4671-95e8-598b6e20216a", "value": "T111B3E709EF611EF7E8AFCD370AF9270124CD592A22A97F757530D818B24A28F15E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901130, "uuid": "62dadb82-f8c3-4372-ab38-2a33bf630dc6", "value": "3072:Sd5b7djS5HEC26Qb1ShRhFczcmVRh865Uh:Sdh7djS5ECUSozcmVROh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901130, "uuid": "704b3df7-496d-44c4-91ca-433075776d82", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901130, "uuid": "0e83306d-84f5-49f8-8a6c-fe55819d438a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901130, "uuid": "43324e42-aec0-436c-bfde-2a01b29f874e", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d08b7a7-999a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786902261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902261, "uuid": "6599185f-9fde-4793-923b-8e82beacf882", "comment": "Malware payload (Vidar)", "value": "6d03c679eb773621469776d997717b4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902261, "uuid": "4808f457-f0be-4491-a79e-5a0281ca1f2f", "comment": "Malware payload (Vidar)", "value": "0b44b8c0b32767ea6c601d66fe7980265fe0581ae584f86ffe516a932c17816b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902261, "uuid": "90f596a4-bb7d-48e3-9159-20673ae1457b", "comment": "Malware payload (Vidar)", "value": "321f0131f7200eb2f9295b9b83a8aefd7c1ca672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902261, "uuid": "6fd666e7-e03a-4191-b6ec-3b2e3945d25c", "comment": "Malware payload (Vidar)", "value": "166692bd297ceb9d0668791631a60d3d354d50033f54e491b5339406b5b60300191b62fa9f3f9ad0bad6bd620c3bb97b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902261, "uuid": "121aea5d-34d9-4fef-8fb5-eb92d61e6bcb", "value": "T13D168C47BD919D76C09AA232CDB602523778B84A5B3323E72E51BAB93F363D09D35704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902261, "uuid": "4e6167a6-3142-4a01-b81e-db71c41c1d23", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902261, "uuid": "7cdd3959-ed5e-4fde-a157-b7e4c87d4356", "value": "49152:FQg/NKUYKDeD9f6IkD4RAl8bGAppJQNREfEWccpz9R3hXf2P2oup6fqMk6NUeu4C:FB8iIxNLFtvwe4Y91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786902261, "uuid": "c76d7793-2675-49d5-b4b1-41282e92b491", "value": 4342608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786902261, "uuid": "7f294786-53e5-4782-8ccd-8ac1849de341", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902261, "uuid": "f20de87e-588b-4a44-bff7-a41aab0c7a8f", "value": "0b44b8c0b32767ea6c601d66fe7980265fe0581ae584f86ffe516a932c17816b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24559330-9991-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786898408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786898408, "uuid": "e0adcd13-64a0-43aa-a223-be876e8c6a28", "comment": "Malware payload (Mirai)", "value": "b30eeefb80125fbaf7cfdf3e292bd6b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786898408, "uuid": "cf53d5bc-e725-444e-9e99-f74788e1a74e", "comment": "Malware payload (Mirai)", "value": "0c266db1b29e950f1b1674362c00f6c376f1159258278bcd58daee61ba9fc1c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786898408, "uuid": "45e1e528-9edb-4926-8156-63f97eddbd0d", "comment": "Malware payload (Mirai)", "value": "635799708591f8c3fb8b4c6414659b742bf03695", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786898408, "uuid": "29616e1c-72b3-4802-96ba-0e45186270c7", "comment": "Malware payload (Mirai)", "value": "a2feb6473bbc1018438167dd56c24e575f8420846638422254c541e6348d060a1fc32204ec454f63e0c491ab444479ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786898408, "uuid": "e06ccb04-3e05-4177-a39e-5466d1bc55cd", "value": "T12B144B46EA418E13C0D71779BA9F524933239764E3D733069D28AFB03B8779E0E67605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786898408, "uuid": "dd14438a-2bc2-405b-8e1e-9a5b84a5f7a4", "value": "6144:porY8X7SeKTahldsgmCU3Dz2WKlo0HAdM/98L:porY8X7SpTazdsgmCU3HLXlq/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786898408, "uuid": "ce510426-d5c7-462b-9895-b78162245a19", "value": 198674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786898408, "uuid": "3d1c4309-a9be-4bff-bc50-945876cfea04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786898408, "uuid": "1502a5dd-99a2-421a-8739-6d4384f3fee1", "value": "0c266db1b29e950f1b1674362c00f6c376f1159258278bcd58daee61ba9fc1c9.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "131c24fa-997f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786890648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890648, "uuid": "ed3ed408-7c37-4324-9458-32a1b433009d", "comment": "Malware payload", "value": "4c7ea5107c82895ae43fc2a19ec9359c", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890648, "uuid": "32409c4e-3d47-4c7b-b84f-bf1c53f7ea0c", "comment": "Malware payload", "value": "0ca9475d4abe7797fe5078fb2472993c34b334760989614c138088fb39a9e272", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890648, "uuid": "5e6377b7-fef5-4e73-9f76-646f51abd0fa", "comment": "Malware payload", "value": "049cbe5d4eea35f358586d33589f51363dd50c47", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890648, "uuid": "aedefb45-dc27-441c-b2a7-8250179f76c3", "comment": "Malware payload", "value": "0188dbedd2da4c6fcbbda129dcb3a966f4b700b3f1b334f23922ce4d4444736e6e99fa8935e80c7c44d6342dbf87bac2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890648, "uuid": "51adb2a7-bfca-4e09-8be1-399217cd5856", "value": "T182C27D966A867C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D8A3C71DC11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890648, "uuid": "82773e9e-4750-4cb7-942b-5fab20bc2c0a", "value": "768:l8vCB+25j6es8Ra9FYpMSUpi+20qUpi+20YQX:l8l25JMd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786890648, "uuid": "3f8417eb-773b-47af-884f-3208a2df261f", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786890648, "uuid": "87a6b9a4-a6d2-4a43-9e54-920d70298a33", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890648, "uuid": "c7bf4f0d-6a9f-491e-b7fd-a8a76d918b12", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8239b1-9973-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786885481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786885481, "uuid": "52d2a885-c7a8-4770-b3db-982c15854d31", "comment": "Malware payload (Mirai)", "value": "679b79e5d5ece1cf0f526d00467eacc5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786885481, "uuid": "d74e7b80-09b9-4c72-a231-b55205cef7c2", "comment": "Malware payload (Mirai)", "value": "0cfccf7555d6fe96a0e51f3e8238774821c24081c595d66294d44657c13a84fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786885481, "uuid": "d617fefc-2a2b-4e30-b94d-f31f101fb357", "comment": "Malware payload (Mirai)", "value": "f350a2774a8555ccc1315cfc443ef9c69d79da10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786885481, "uuid": "53f5d81e-67dc-4ef4-95d8-5ca4285c2b73", "comment": "Malware payload (Mirai)", "value": "b5e7d7cbada43de515f99b95f7896d0855448075c2ff491ee2e5e914ac63508d2fc94c6b1292b26fbaab56d25e78825e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786885481, "uuid": "5195feca-06c0-4473-9318-989f75396d5a", "value": "T1DB830746FC815B11D5D522BAFA1E018A33635BACE3EE72029D105F2573CAA5B0F7B906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786885481, "uuid": "dcd8a72c-1fb7-4c25-aa33-4b8d055e27b6", "value": "1536:uhnqEnpbxok8DFUapJFtzgYD2lpviTST0BHsl9Y7CP/:x4bek8DFUapJFtzcXT0BHsl9hP/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786885481, "uuid": "20555844-1a37-48c5-b68d-0b38b4bbaf11", "value": 83428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786885481, "uuid": "e01561ac-b1db-4803-8a5a-1a9c0496f156", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786885481, "uuid": "02421427-93ba-4c0a-aba0-cbb6a2ef8659", "value": "meower.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d9b15a-998c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786896427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896427, "uuid": "c7779c1c-9fab-4c2b-8d01-80158bd7ff94", "comment": "Malware payload", "value": "fd46afd4734c30637915d0f1b31b0afc", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896427, "uuid": "158078df-5fec-4275-96db-f328adcaedc3", "comment": "Malware payload", "value": "0d41e63415eb2942dfc0612a653f968a85ecdb6a4e01cb9deaeebd4be6e9988a", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896427, "uuid": "ad0904f1-770c-4539-afaf-54b9c325d115", "comment": "Malware payload", "value": "770ac259104f2083472746b7b3e34dd802b52c81", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896427, "uuid": "9babc36b-bb46-4c3c-9dd2-640c30362fd0", "comment": "Malware payload", "value": "f54c1d00bf40d0e067cecef3fed9082af53940bc21540dc1e5d94302a8a5a1ed228c4a47b37ce2cc65763c9f538d4c36", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896427, "uuid": "f9ca181e-6d6a-4a39-88f8-fff75514fe39", "value": "T1A2062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896427, "uuid": "9ec9f7b9-6b9d-41a9-b9f8-9d19c7a0ce9a", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896427, "uuid": "1a462253-19d0-4b88-9a8a-f467172545e9", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnGm:+MIKhlPGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786896427, "uuid": "b86465d7-0707-4c07-8fcf-6a6c4a0ef6f4", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786896427, "uuid": "71788054-eff6-45a3-b4fc-caf37685913d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896427, "uuid": "b54f73b7-b633-4aec-a56a-885415a215b0", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c371b55-995f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786877054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786877054, "uuid": "64d5423a-7ef6-4bb6-861a-9d7d09bef6de", "comment": "Malware payload", "value": "0d93141625dda947333cdad23f13b619", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786877054, "uuid": "882ff317-ca07-4122-9839-fd9c5a32b626", "comment": "Malware payload", "value": "0d581dac21e6140f342a435a92a52e372cea57bfb75cf41cc135b8ff39b875fd", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786877054, "uuid": "5706ab44-6b4f-43ec-9a68-f268daee8542", "comment": "Malware payload", "value": "03d5560c69c1b9164c5bbde3ba9e3f7ce10a8e34", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786877054, "uuid": "facb8bb7-cb63-4a8b-a29d-8987a22a8fd0", "comment": "Malware payload", "value": "7687224180a1c143bf16055900ae89f9fffc90aa1e0deebb2571fff7d240ded833cd1aa39d3b807372d2c36f1847009e", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786877054, "uuid": "d55b25b0-a100-4286-a994-4fd13542da2c", "value": "T1F4249E2AB5E45BB8F5AFE135C5456B16D1B1700A5B31D39F22B48ED62F03332E22D386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786877054, "uuid": "1c1bd582-d316-4cd1-b58c-4b5ed80f5815", "value": "fe7f94aa993416969fe7ecbcfd98461e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786877054, "uuid": "4df269bf-34ce-4ca4-8992-7d6936483881", "value": "3072:qXHzmd4JiQLXmfRRUEcZOQJNFQpkMkc/J3Sv5VViS95KqA00XxETckZTxrS8GUi1:gHz7iGmbUFwQ/FQpkMkc/Ve/XODxE1Zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786877054, "uuid": "543c8a00-19a3-4bed-ba1d-d6a460b2dda8", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786877054, "uuid": "a1d12517-3c72-402c-876a-3553b948ec57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786877054, "uuid": "c8563fa4-591e-4f35-9c76-c9fa5ff50cf8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dab4180-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "4fa5ca22-e98a-4c18-926b-c77576bc9987", "comment": "Malware payload (Mirai)", "value": "a64ff44dedd1fb1498513721df32275d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "6f80e66c-0c67-4cc5-ac35-635c2a67b30b", "comment": "Malware payload (Mirai)", "value": "0ddc4406efdb5d702c8f808ce599547b1f48f0c106a126dd09f1ed2929f4cc44", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "51c996b7-6d7a-405b-acca-3c155dcc98c9", "comment": "Malware payload (Mirai)", "value": "be46f5953fc51a2f6a2eb7aae544aacce46d2b7e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "b12384ec-7942-47b1-9d23-da986fd7d4f5", "comment": "Malware payload (Mirai)", "value": "b4529bbfa26dd5c3bb267090fed8330c41864ed1dcc37c1d917dec66da313c2e096554a83b460c67394699eba519e30c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901376, "uuid": "2426f60e-d3d8-4a1a-9fa9-69195d6bf952", "value": "T1DAC3F702770D4E03D1533DF03B3B2BE0979BFD5629A4A680742EBEC992719F22545EAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901376, "uuid": "a9c26f8a-f4c3-4f44-8488-17aea11b0b8a", "value": "1536:WhKvHEWr9XSUdxjPaZRTfrISSsPOstCp3vAL3tmeZotlwAvKhaqLlUM:RvHpBldxGDUS1POhILSAUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901376, "uuid": "4edc068d-dd24-468b-b4a2-bed914188d7c", "value": 128696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901376, "uuid": "9214fff7-38f5-4803-915d-a4e1148b977c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901376, "uuid": "3e85384f-5ad8-40a5-a555-020a7d55f05a", "value": "eclipse.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3557c72-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900849, "uuid": "a7936ed5-02ed-4717-8d1a-381c737312de", "comment": "Malware payload (Mirai)", "value": "09953e02287800f43921c837412b9580", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900849, "uuid": "09a40781-5f0f-4c7c-9dd6-827438dcc095", "comment": "Malware payload (Mirai)", "value": "0e1bd1cf275f029ed286a56cbc56f095cafedb38bc8493a2b8c590173208b722", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900849, "uuid": "7ffdb2b5-ad8e-4a8f-999c-febba7ed7d39", "comment": "Malware payload (Mirai)", "value": "c462f9bd7111a9c38fc607d1e7f174f55c495750", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900849, "uuid": "211cec7c-a081-4f14-a353-dbc18683b61e", "comment": "Malware payload (Mirai)", "value": "3f06d0d7be4855f36d488b41fabfba2f9f2a77fa38e29707aa46a8c8b42929f6057389f7bba8c2f51fbb5896c1086907", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900849, "uuid": "11292673-8813-4313-b7a4-b743ece9bd71", "value": "T16E4301EC539EA4A9CFEE35F8562E1386065B7CA06348C99C06180BCFF3DC8B67C52595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900849, "uuid": "7dc2c8d3-aca8-46b4-8ba6-cecda00eca2a", "value": "1536:6VSmIeoRSepk1F8zW31MwCOtsl29XZ2bFP:ASmNoUF8K3yCsl2RQbFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900849, "uuid": "068efb66-1dbc-41ff-beeb-fdf4a145479f", "value": 56440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900849, "uuid": "cca3998f-848e-479d-a7f7-00af2b66523b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900849, "uuid": "5153e861-5069-4358-b57f-fc1bc5d870e9", "value": "miron.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1148acce-997f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786890645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890645, "uuid": "2bfde54b-96b8-4abe-a1a5-064361ab6ebd", "comment": "Malware payload", "value": "278b4985036ee1bc4fed780958eeef09", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890645, "uuid": "10b1046a-b876-4d08-a338-6107fc1be22d", "comment": "Malware payload", "value": "0fd3464c8eb3bb380812b2ccd7ec4812d9cabcb000962de5d96562dc8e93a74a", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890645, "uuid": "d71b2a86-d24c-4539-a6ef-ccd0adfc0f7e", "comment": "Malware payload", "value": "c61957297280c7529e3f07dbeea59a8eafd3bfc1", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890645, "uuid": "33a98987-c784-49b5-a746-1d8510064496", "comment": "Malware payload", "value": "1c5dbfee85363c3bd84b210b2207ee601a5dff74639c8804737750f7ae44b6a9501f2faeb1b6ad02c541b291cbd15b51", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX4.file", "colour": "#2D59D7", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890645, "uuid": "c180d33b-eaac-4abd-89cd-e4c211cd1926", "value": "T136C533875727D52BD64EA2B8B653C50AF2A177243031C85A37CD98924F0F3877BED922", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890645, "uuid": "adb8aee8-fa20-4363-a0c2-00e2ac13e4df", "value": "83b01d6d5f22f1773c9e4a7ffacc7b46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890645, "uuid": "fb27f83e-c996-4add-9fbd-eb3974229f61", "value": "49152:6f8e7oLmMogY9lLSIjm9gi7q1xrg4CEaiCSh1IS8ROZb2mg8UZZa:q8eM1Y94Ijygi7q1O4BdrIS8VAWZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786890645, "uuid": "ca9b1d94-9c8d-4ec9-a3b0-09b02b113b89", "value": 2663800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786890645, "uuid": "089f99ca-cd53-4efa-bfbf-f60d43c43e81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890645, "uuid": "d3ac830e-dc7a-4c46-bce2-cf63f787076b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06a14777-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786915108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915108, "uuid": "50263d58-ad38-42a8-8a1d-354443adc450", "comment": "Malware payload (Mirai)", "value": "30a9f071b7ff70c5514cd7f3252c49f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915108, "uuid": "c7c95937-b961-4b21-970d-2682781c7686", "comment": "Malware payload (Mirai)", "value": "11f329443052d583d5f25d39b505745d64ec88433aae4b55834914e9e93a0871", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915108, "uuid": "919e2ab1-b6b9-4ddf-b8bd-d251a7351e44", "comment": "Malware payload (Mirai)", "value": "3837ae2094955abe0f68e627ac0b24b5b2a46636", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915108, "uuid": "f997650d-405e-48dc-a1c2-0c572812237f", "comment": "Malware payload (Mirai)", "value": "859a4947db48a20ece0c6b27d575f00515f13cf66184658620aaf66676fcc23faf31438bb6946a83d86be87d70d63aed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915108, "uuid": "595a45ae-e9c7-4f99-ace1-9b4a320b9c33", "value": "T1EA047D545ABFAC82D3C3D67EAA8B0E2230267877024CC2717E0D52ACDFCB9D495F1656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915108, "uuid": "1749ada2-137b-4a07-a3ae-016be9f61c71", "value": "3072:LxFxPy7EH+K9Z2b6FN+S2SXSR7xo/N+NBENuhNEGhN4lZI6tPbgxWHb5QACUKhRQ:Lpayc7dRYZxbhHGA/Ku4NlssM7khWo6a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915108, "uuid": "ae2afe48-ad3a-472e-a87c-388e5e24f6f8", "value": 190128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915108, "uuid": "4472148a-e9fb-4daa-bc3f-81438c63713a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915108, "uuid": "2dcee61f-488c-4784-8f9a-6ea1081cad21", "value": "arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369c52ca-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901016, "uuid": "0e2ea02c-76d2-439d-b2d4-689455e12d30", "comment": "Malware payload (Mirai)", "value": "dee4d28c0cee58bf76558593315ab1c2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901016, "uuid": "cacc30c3-13a5-42f4-a407-c6dc79f34194", "comment": "Malware payload (Mirai)", "value": "122bc43f2160a9d5d58d8e47ec2184f1ce52472e9caf31458c2c28188fa593a5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901016, "uuid": "fb0ed440-d892-4680-b375-4cf4ecea53c0", "comment": "Malware payload (Mirai)", "value": "6736034c2e74d004f05a8cc37e4c2175612c3dd4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901016, "uuid": "5c9ba21a-af05-4d82-95b0-fa9883f6f5a7", "comment": "Malware payload (Mirai)", "value": "edc378886fe4d1a842d9570b8bb1f8f91fdd01a604663b7184bb829922c1580ed1129eec8bd7716dae85195c8720efb9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901016, "uuid": "0d1931c1-1c9e-4729-a0dd-5335cdea6ee2", "value": "T1505194C621213F312D669E26FBBE48297183A0EEA4D79FD554D8BDA548CCE08FC42643", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901016, "uuid": "4247cdc4-54b7-4ef4-831f-0eb4095d26f8", "value": "24:Itas0wIhOEx3dAHPsk+TBTGF7JLpGAaLMDNINkssr4j1TlyUaW7J:ibhEx3qkk+TBTGFljaLDJsr41TlVJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901016, "uuid": "22277f4c-3c83-4dba-9d7b-7c5ca14c89bb", "value": 2699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901016, "uuid": "89f57a51-7791-455b-b1d4-d85e2107d2f2", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901016, "uuid": "4053fa05-db52-4328-ab57-97c6f2ea4f89", "value": "nz.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cd80df8-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901375, "uuid": "d36352d2-139d-4558-bf89-be6506390ef9", "comment": "Malware payload (Mirai)", "value": "36cbaeff8db9585b0095751603ad47f5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901375, "uuid": "01906bfa-fa20-45e0-adee-f3808beb939e", "comment": "Malware payload (Mirai)", "value": "124da6a16d0dc8df8fd93f64dcb9fdfba8ee908019d3ce4f6c71059d23fe4d8e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901375, "uuid": "1360687f-19c7-479e-bd06-aa3e9835e349", "comment": "Malware payload (Mirai)", "value": "242956c3c3d856c289959b69225a98717ae11501", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901375, "uuid": "96828237-01d0-4bb0-8d7a-21e7ef69f1ec", "comment": "Malware payload (Mirai)", "value": "e2ea31b056d8f041df8dd541a48293da71e45f823a1fc96855c8b651c79c5dfab86bab96cf1a7d74e7a1adbc4e197e15", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901375, "uuid": "0eb8a5f8-b0b7-44e5-a3c8-9383d17c9d77", "value": "T128E3E6C7FE01DEB7F40BE376449309057530BFA60D625A72722779AAEA3A0D41463F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901375, "uuid": "e3e20953-29a4-4b7f-93bd-3d3073ce2894", "value": "3072:+kyjT0do1VPduPYnPNyippVejbiNLnv+Ogyhg8CN:hm1VluwwipFL2OgyhCN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901375, "uuid": "45afa012-5dd7-4d93-a6bc-7cf23151aa43", "value": 150072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901375, "uuid": "2a3a34cd-348b-46bb-b09f-ec45405a753a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901375, "uuid": "b42abeeb-02ed-420a-973f-4f52bd1c6ed0", "value": "eclipse.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9742f2cb-997b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786889152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889152, "uuid": "9cc3b237-f2dd-4d12-9ea1-552fdbb051df", "comment": "Malware payload (Mirai)", "value": "9d7cf581886ead7341289384eb7b2cd6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889152, "uuid": "c3e9830b-f2c7-4fa2-b820-eedc0823c78b", "comment": "Malware payload (Mirai)", "value": "12cc5453ccb06a8c2cb208d62374b1b5ad1f7bd4caa48a42be4bddad7f76e4ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889152, "uuid": "9d9e49b6-a494-4b63-b7cf-98d8c857f5bf", "comment": "Malware payload (Mirai)", "value": "6f352bb7cbe51904e8284290385db0751a214a5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889152, "uuid": "af9cac98-cc90-4c85-b608-c1ef499cfca4", "comment": "Malware payload (Mirai)", "value": "e14665ead10a3b3740d3dd09fc9c7b04a07161c0e62866988928d0cc79de0cab61cf89e71d40d987e39bcc850017452e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889152, "uuid": "273c63be-cc69-4b5f-8435-0c066e6df7ef", "value": "T1BCE30859FD41AB00D9D636FAFB4E02897353176CE3FE71029E245B2523CAA6B0F7A105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889152, "uuid": "9e601348-b2c7-428c-a91a-4a45edbf9e56", "value": "3072:eBrZ+ukmHd4SiR5GeDt5elE/ZJtX4yAlOf4O0YLAan51ikq5jkhW02kw7oVOKL/N:eBrZ+u3HYR5GeDt5MEpPAkgYAan2kq5a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786889152, "uuid": "c8ef20bc-8416-4d59-b152-03b1224d6907", "value": 153408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786889152, "uuid": "4ac86ae3-d90c-4461-b5d9-603f2a369c26", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889152, "uuid": "af394ed3-67e8-40ff-be2a-c546622f9961", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f791e22-99a0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786905003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905003, "uuid": "04b7e3de-0093-49af-835d-778c28f97720", "comment": "Malware payload", "value": "92dd94e1d6bd1288c355e846c6093088", "object_relation": "md5", "Tag": [ { "name": "974b6b4ed30ddaa4b6f4ec27976e52d8", "colour": "#BF9C50", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905003, "uuid": "889342af-8869-4613-b407-df8954cbd0f2", "comment": "Malware payload", "value": "136c640c2e8fa24a757f072ab07e41563cb178852282fcf4fa36572df94b7fac", "object_relation": "sha256", "Tag": [ { "name": "974b6b4ed30ddaa4b6f4ec27976e52d8", "colour": "#BF9C50", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905003, "uuid": "836a40d1-0fd0-4802-93cc-f706b6c4617e", "comment": "Malware payload", "value": "60ceaf2dbaa5e8ef6a250bc24796267010fd0201", "object_relation": "sha1", "Tag": [ { "name": "974b6b4ed30ddaa4b6f4ec27976e52d8", "colour": "#BF9C50", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905003, "uuid": "b3a10b59-b745-4978-9839-0becc3fcaba5", "comment": "Malware payload", "value": "3b38ba620ed3808c26d11880fe7abe4dafa5b2eb495e863b34d696c8ff08ff9f7c72caa5845f831ee70f9e24df4743a9", "object_relation": "sha3-384", "Tag": [ { "name": "974b6b4ed30ddaa4b6f4ec27976e52d8", "colour": "#BF9C50", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905003, "uuid": "ac9deab7-d546-41e7-b32c-e87aaf58590d", "value": "T153750187AED115F8D193803C929E2A5BF239310967199EFB72DC12543F1628D987CB2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905003, "uuid": "d9af4fc9-fc09-4162-95f3-b33702e91b47", "value": "de85a398477c39117ee5fd3f2278b959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905003, "uuid": "1b6492ad-b31b-494a-83b8-4d52b84938fc", "value": "24576:EKV1SCStqB6AnKbqhuaogtJ4XLTv8aOO1B2F3/f28XLbrMbvuqdLt:E01Atk6SwkuaoMSXLTv8ou32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786905003, "uuid": "ff155b62-101e-47a5-acf3-175844b03d07", "value": 1672704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786905003, "uuid": "727abcc9-08b8-4cd7-918f-a98966c82219", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905003, "uuid": "1ce6cd13-89d5-4d3e-9ecc-febeaa46e891", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050eb3d6-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786915106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915106, "uuid": "2918cf8b-e113-455d-8023-4b41e3e49d14", "comment": "Malware payload (Mirai)", "value": "9eab747071d46ab99516435b7f2a2838", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915106, "uuid": "6ad9327c-41dc-4279-92c1-f627e4f9292a", "comment": "Malware payload (Mirai)", "value": "149760f9e8112c5c1b2a22174127596b8b4835d140cfcaa3ab79f6763fe152fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915106, "uuid": "156cc7b6-fb5d-4b60-985d-bfd269dda849", "comment": "Malware payload (Mirai)", "value": "b4786a4dbec680e9b5bd4bdcf7de5e85108f7d38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915106, "uuid": "d313b2ba-a8a8-4ac4-ad86-186656aa1b5c", "comment": "Malware payload (Mirai)", "value": "5df7cebe2c13e1eb0044ef7f55fc43c3eb898ac80641aeb604910b0e82791c596302e1fa5f1e2fa65e4f3e3e6a17924c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915106, "uuid": "f82fc6ef-0f15-4972-95a9-895f6fd709ef", "value": "T174F38DD06AA3E0F1D993067692AF9B058A36D837011ED651F73E2874AF42520D77B3EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915106, "uuid": "373b2dca-7662-4b36-a0df-49c86c96417c", "value": "3072:cQBVyuvcxsQFxP9fJjKAq/TUwzDVWQuQlssMab/BlGH+Iys61X5hWo81:cQKbDVOzfVWUlssM7khWok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915106, "uuid": "a0b1ea97-1172-4e5d-b0ea-c1b444122993", "value": 171308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915106, "uuid": "c597ab10-2b1c-477f-bb86-30fac790bede", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915106, "uuid": "3093250d-5f16-4ef3-b112-6e8a1b7c2fc6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "502e8f2c-99aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909219, "uuid": "136694ab-ebd5-4a08-a3fc-3a3f86fb696d", "comment": "Malware payload (Mirai)", "value": "c8b11eb72f392d975e24266fbaec9591", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909219, "uuid": "cd116947-7efd-4cac-abc5-31683256d1fc", "comment": "Malware payload (Mirai)", "value": "14ffbb78059c2a98bf5d2bb1ce4b5d4949e047997a304c0dbc0e9b4f5d93f68f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909219, "uuid": "2c955ff2-06a6-4654-97ef-afde47b747bd", "comment": "Malware payload (Mirai)", "value": "96df17256e0e0aba8f9fb8ca7d0c5bc40fa21a71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909219, "uuid": "d58652f2-af57-40ff-be86-e2309f293545", "comment": "Malware payload (Mirai)", "value": "6efede83833745781a2b7b5e751256e038c3f2d7cdcc65beae98926da1a53b56d92636683f5f15f9274dddc7ee03fcd8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909219, "uuid": "59fec13c-2838-49df-8fad-9dea9fdafb73", "value": "T10C530200E869076BCBF5DC6B5F64E09D67E294D0AEB8C43632937B20742395D4D2CAF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909219, "uuid": "3b5eb0f5-6b13-4e25-98c9-c9fdf30d556f", "value": "1536:Gz0MG5piLYalDV3og7MjKmFYKf5rz79BxYf6hqt2A1dArFt4u+qgw09q:BqDV3og7Mj1FXB379BxYf6Ytp1dAn4u/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909219, "uuid": "a0a2d4c9-2772-4a87-9ed5-223b2537546e", "value": 66160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909219, "uuid": "db65a6ef-17a0-4b0d-8986-cd8f84082110", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909219, "uuid": "e464bc3b-27c4-4669-8747-6c44aa9c246e", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9232615-9982-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786892322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786892322, "uuid": "e557ea48-cc26-4046-8eec-596c13a5fe75", "comment": "Malware payload", "value": "ada20190e78b766955b1a248984ee696", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786892322, "uuid": "3cb87b1a-deb2-4cbc-8966-4fa29e087055", "comment": "Malware payload", "value": "1508830244c3eac382d4193717616b81eb8c5dcf02926a6dd96d05a5ed6319e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786892322, "uuid": "b3f3691a-3fa0-4cad-b92d-4a1f52823cfa", "comment": "Malware payload", "value": "3a8cc2fc793e4ca197537491cd73486b2373bc35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786892322, "uuid": "94bb6dfb-5873-41ae-85a1-6ad26fd3a99d", "comment": "Malware payload", "value": "aae98875dd3416043b3fc00c94e9685c1dae916cfbd31288791214bd9bb399316deaa9dceac7b4a54718795748106cdd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786892322, "uuid": "c3d9e362-d003-4d01-88f2-c5f3536e3085", "value": "T162841659F880DB6186C539BAFB5D46AC730707B9D3EA71058E254B3037EB86B0F3A611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786892322, "uuid": "4c6f8ec3-f443-4aac-913d-041bb633e247", "value": "6144:2E9BBcL28noUlu2pAcJYXG2BxBKDfamOTgZ9RI+iLu9fyhapJ54XHv1DLh2xOWK3:V9BqL2Md3AsGmtOyRIRkVr4NoOWPVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786892322, "uuid": "213d1d89-4e2a-4d83-aa65-09ab90823265", "value": 392536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786892322, "uuid": "fa2cd4d5-f871-41dd-9f03-ddc545fbeb9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786892322, "uuid": "3dff45f2-2996-4d26-b095-b39b10bff67b", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "199265bf-999a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786902255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902255, "uuid": "f8ec4f33-bd71-49ff-b8bf-cc64095c4785", "comment": "Malware payload", "value": "aefcc3c72728302392cb72e04aaa636c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902255, "uuid": "64a03cd5-c231-4154-ad1f-52defceafb18", "comment": "Malware payload", "value": "15175a83f07e202b8c20f3c8bd36e2e203a5a474b2be0c90c1722d43fa6426c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902255, "uuid": "89dd7cca-e390-4a12-9b80-3f5374162436", "comment": "Malware payload", "value": "bb2b36c8be6f61f1d8154e2e160bd92e331bf768", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902255, "uuid": "b3830b58-74e6-4612-8c28-b473827df7b9", "comment": "Malware payload", "value": "046de058b93001851a0ea4d6cb12a524e164d8979ad1bf44bc0ab286f8f6e279e483120da2220fe23b8b3efc44011328", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902255, "uuid": "c8adc382-80d7-4d93-aada-eed7d0a38ee4", "value": "T15D567B83F96998B5C184E235887A3255BA65BC8C873073E32DB0AF712F35BE19E35714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902255, "uuid": "b1e05d55-0d16-47f7-baee-7eee5c641db1", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902255, "uuid": "1fc65aac-8ab7-4e02-b470-c004527cd734", "value": "98304:AumckB/UlrHkhGVAPWd6Y+4joTx5UxvN5:AWkB/UlrHkhGVAPy6YvcTjUxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786902255, "uuid": "5a8b6c7e-f1d9-40de-859b-b896425d1505", "value": 6294632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786902255, "uuid": "3eba5898-64c0-4b10-8623-3a1fb82e07ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902255, "uuid": "289d8303-ff90-4603-a3ba-1b621ffcfe70", "value": "15175a83f07e202b8c20f3c8bd36e2e203a5a474b2be0c90c1722d43fa6426c2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db10d1ee-9979-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786888407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888407, "uuid": "37a41bce-68f1-4780-be2a-8631a43ed19e", "comment": "Malware payload", "value": "63746a18b13e56b7167466427dc74759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888407, "uuid": "12e9005d-7863-4dd1-bc8f-dff897c56ec0", "comment": "Malware payload", "value": "1534e8091708e13a24698de848faccac0ccbf82cc625f990bed0c7ec5388c345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888407, "uuid": "c16b23d6-e02a-457b-ac5e-ad094b5945f6", "comment": "Malware payload", "value": "481a119c54fa644c5cf35f9a72f6c86a05a35cb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888407, "uuid": "8129b288-d124-43ca-9da4-b4727e01d838", "comment": "Malware payload", "value": "80e811d5485f0a6ad8778905b45f2c8cb3372dcf38a794567c41b2b559ba79ae08bb0558ad36af86267d0a498a6f0677", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888407, "uuid": "6b7f5370-7157-4bdf-9557-9b8232be171d", "value": "T1B808333BB167753DE02E4B3A757693208937A92298420C1FC7E4C98DDF356702A3F696", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888407, "uuid": "25a9a586-f95b-4b0f-a00a-b557d530efe7", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888407, "uuid": "53dba889-0991-4a48-a018-857d2190fb0f", "value": "1572864:8SyoUioZrM9ABcshf7MCQXuaKA+EHdgg3yMG6TxuEnN6:8LMias1TYKIHdgg3yGTtN6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786888407, "uuid": "43795623-dbb1-434c-adbe-50cc8945daeb", "value": 82379104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786888407, "uuid": "50b9ee1e-fb6c-4959-8fce-2c89d8e11126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888407, "uuid": "b5374c6b-356d-4b39-9793-e85c8b2bddfe", "value": "Policy_PS29.pdf_Notice_of_Material_Changes_and_Updated_Investment_Policy_Q4_2026_FINAL_Updated_authorized_Investment_Policy_signed_by_authorized_representativesae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c877978a-99ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786910709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910709, "uuid": "3cb5aabf-ec22-4d22-a698-bccddc344534", "comment": "Malware payload (Mirai)", "value": "5707ce5c1b958a4e7ecade75b355ddc9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910709, "uuid": "336f2d12-d20a-4cd4-96f9-79d0e8f27ae4", "comment": "Malware payload (Mirai)", "value": "1612a1488d22a1efa9662dc5f44695c654c3f8967ef89640849cfb80a2e6b999", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910709, "uuid": "4f1a8f84-8941-4419-9a07-7cd9d80ca110", "comment": "Malware payload (Mirai)", "value": "67334eb1a3e8a0abe20218a41d5da3ed2cca115a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910709, "uuid": "6552946b-77ce-4dcc-bc3b-da560db47962", "comment": "Malware payload (Mirai)", "value": "26ab74ab83a77be4e47355c2731f86a492067609100f2dab4dba2a244ae89a26d5922648710025e190e0523e735df6b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910709, "uuid": "5ecf3145-e0ad-4804-8ec8-71d042f0f9c0", "value": "T13F530232EB974C608632A53AA8A8C34F51CF3ABFD51D741E0AC1D278915391B7CE82D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910709, "uuid": "3f9cd779-f6b3-4244-8941-b1ff8c045cf6", "value": "1536:nl5h4HIINoF2oF0C/9eG8j/HwIHnwPRekMmHA90nPbQzv:n14zloUGGHGReLmH+WPEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910709, "uuid": "b0337b66-5f51-4cd4-aec6-9f9259b9722e", "value": 65704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910709, "uuid": "b71e9167-022b-4aab-94f8-841c16097f2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910709, "uuid": "866a5f07-f150-4832-ace0-d8b537ba1b76", "value": "1612a1488d22a1efa9662dc5f44695c654c3f8967ef89640849cfb80a2e6b999.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0afbe61a-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900942, "uuid": "598198de-42f8-438b-9ec4-445692415cce", "comment": "Malware payload (Mirai)", "value": "0ce154bfc888766327435ccd408907eb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900942, "uuid": "24dbcd9f-01cd-4352-8e92-0125e54d0bf8", "comment": "Malware payload (Mirai)", "value": "16f66579a5d852e0d7e6024cda90ef1260c59b9f010404fbcb86d13816d3b95c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900942, "uuid": "308507db-d75e-43c3-a471-62894bf025be", "comment": "Malware payload (Mirai)", "value": "74e5625a373b4ac324c81006f319beb2894b6f86", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900942, "uuid": "95a5d9ad-a3ad-46b1-9804-2a6f7fd7cf32", "comment": "Malware payload (Mirai)", "value": "1ba1003dfa13ee50f365893b75e6e4a08dd80d88642a1b65ffcda15735e271be22bca294e5d1059d7f2ccf901eb3b92d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900942, "uuid": "7d8601ff-da6e-401c-9bdd-822657480c79", "value": "T16F243A07B9855ED7F40BCDB049BDC3C23EE161DB52E5AA3A657C89CC7F6B10A0993488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900942, "uuid": "ab934d57-8fed-4ee9-b79c-1281942a2307", "value": "3072:4zTIliEWBDbzQpoauyPSBw8EzVvfOk8NKClnqJC/:biEK3zQpTuyPGWVvN8EInqo/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900942, "uuid": "93568b2b-7b22-4dfa-acb0-7189059d6221", "value": 213632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900942, "uuid": "8ed64549-c9a6-4e60-81e4-dd5f83850d22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900942, "uuid": "88ab48d5-d00b-41d5-8bd5-ff20bbd042f2", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "affa18eb-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786870295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870295, "uuid": "6ee81b62-0812-4e63-96b6-22574b2de870", "comment": "Malware payload", "value": "7a05d1ccb320667e3f9e8d503489c28f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870295, "uuid": "7986766e-6f28-4cd8-81d7-8f4a9847db3d", "comment": "Malware payload", "value": "170f39e4922bb913599ae931aef9352eda0d534434916e8af73ccadade51feba", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870295, "uuid": "b5bc7ebe-b20d-4c1c-8af1-0bbd695f39fe", "comment": "Malware payload", "value": "77596f9cc22297e5e861916b9e5330a3a8460fa4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870295, "uuid": "e6010e6e-3d71-4c05-a061-1400220877f3", "comment": "Malware payload", "value": "fb414ca0f016d1b84941d627d4f5f3524c763e1ea151c59daadda2ddfce38e8281822a86608ee6f147425c9cc7df7547", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870295, "uuid": "33f31b63-86ad-4c4a-a88b-99f98680f96b", "value": "T1BDB2D60FB76744EDC949E43881FB9635BA62BD0888B06A3E4324EB711E95B642D3DB44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870295, "uuid": "b7f2ef9e-78e6-4620-9ff1-6840a9b39124", "value": "5bcfd99140b04a4b24c742176fff15d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870295, "uuid": "1b665304-053f-4d97-b9b7-46f54deb5c9c", "value": "384:HIUGk9iiOgqwmnxZaQdHTrdRHBx4yENPNsDbnL8GVUh:HIhktSxZa6h5jECT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870295, "uuid": "5c17b5fd-3465-4369-8306-0a20e96d1b94", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870295, "uuid": "59c4afec-c4a5-4922-a709-ba1df6ee6c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870295, "uuid": "dde119c9-cbc3-446f-8164-56aa218e1ee8", "value": "18cb72c503457787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d021488b-9995-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786900414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900414, "uuid": "40ef386c-c412-4037-9af9-f670592e873d", "comment": "Malware payload", "value": "ff0828ae532bc1f2dc2f8bf11c81e11f", "object_relation": "md5", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "gopher", "colour": "#C4C245", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900414, "uuid": "1b0d08c8-ecf4-4bc9-b417-f640d290c5c6", "comment": "Malware payload", "value": "1835f744861e9aa6bf965ed9f21cc0109b3d01888d5b8f8c304c5cc297a9d9bd", "object_relation": "sha256", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "gopher", "colour": "#C4C245", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900414, "uuid": "592a57fd-8775-48ad-865b-e65114076c48", "comment": "Malware payload", "value": "1d676bb40975d8ed9ee94fc7251f4cba26e53137", "object_relation": "sha1", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "gopher", "colour": "#C4C245", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900414, "uuid": "e39e10da-6fc4-4a95-82ee-7113c40d250c", "comment": "Malware payload", "value": "6161c77547972c0ff63329e2f4621f4f742b26da120fb8ca92f18d35a79d5df09d45bbaec8b2ce2c927bca427b2c4ddc", "object_relation": "sha3-384", "Tag": [ { "name": "AdaptixC2", "colour": "#FB317C", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "gopher", "colour": "#C4C245", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900414, "uuid": "1dd27834-0de5-4a2a-a15b-1bd6b536c3c8", "value": "T192563903EC9155E9C0AEE6308A669253BA717C485B3123D72FA0F7382F77BD06A79750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900414, "uuid": "8f6a22d5-00bc-459c-9f53-26f0b61cc05e", "value": "49152:Nn9HtgxMP1N6xjl4GUnAnbdGLzZ5eaV/qhO7riezLIV27+EoT7PVPlLHK2KDKnkn:N9NyYydaA4IVt79ZBB/ED", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900414, "uuid": "93b5d591-088c-4550-96c3-9d1f81266408", "value": 6430904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900414, "uuid": "370b87d7-ca77-4a2b-8ead-ef41fa34cc59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900414, "uuid": "221ee972-20bc-40cb-9c9a-1f3015e6c6c5", "value": "1835f744861e9aa6bf965ed9f21cc0109b3d01888d5b8f8c304c5cc297a9d9bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "237b0482-99ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909573, "uuid": "0dd5af84-8a35-4ec6-9098-972223d7866e", "comment": "Malware payload (Mirai)", "value": "bb62920272021491ae27edcffaea6e37", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909573, "uuid": "d75ee9e1-a56a-4236-bef0-139f896c8cb8", "comment": "Malware payload (Mirai)", "value": "1881028e34a924cce0c91939f9a3f7effa91a8ff1d2361c6ad6349b38f6e392c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909573, "uuid": "16ec3786-0e04-4cf3-9fd4-e00d5f2b919b", "comment": "Malware payload (Mirai)", "value": "2c39acc8735ca9da38058511620472d484a2a3f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909573, "uuid": "586727b0-0868-464a-8384-039daa04a957", "comment": "Malware payload (Mirai)", "value": "77773b3c41c301109527cf5601934b9b2c2143cec3fc520f429942c3d8bf3b810156536978511d06df7bc79ac8f5e5b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909573, "uuid": "09863605-18d6-45e8-8099-f65f1c04ea1f", "value": "T167245AA8BA0F6C42F2C2D2FCDE8C43F17A1735E3C67699B16D1213ADCAA78D95990501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909573, "uuid": "5c0c6617-cf04-49de-8b56-f3b232da399f", "value": "6144:VDkLSy696oB3GZtiJF61tAWsu7gzL9oZxyoqc:VZyjZtiT6Qq+IxyoX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909573, "uuid": "2497ce33-fbbc-4dae-a7f6-2ecdb83a5202", "value": 223328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909573, "uuid": "75edf78e-9be1-4994-827c-7772b122f1e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909573, "uuid": "05252d7d-fd00-4f0d-8033-3d11870c6c2c", "value": "27335f46446308d51cb8513117c7f3018e3d23d5d63fe32ae8fc360ed28a6596.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06e5654-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786920225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920225, "uuid": "dedb9847-d80c-4367-9c45-b4c370252e87", "comment": "Malware payload", "value": "6e5f67f9e98a4fd5e42855267ab9e695", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920225, "uuid": "093b1c41-aae0-4334-b0d0-4430ae21d31e", "comment": "Malware payload", "value": "18d0a2a9577ba8d35dc5ac6f4d46858d53d8b5de7a2e3866001318bd6c056a89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920225, "uuid": "e13c0abe-28d7-4443-9bd6-fa9ef8d40feb", "comment": "Malware payload", "value": "0fdbc600574b106622e3958504a374aacda8c8ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920225, "uuid": "325352fa-1e7f-4c2b-b807-7cea1f7b9088", "comment": "Malware payload", "value": "27338867c39f2e4e952bcd039a02d45efef9469aa57923080deedf7a377e943aa6b991101735c031f2db8dbaec5c89a3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920225, "uuid": "458117e3-0027-43ca-ac0d-e0b231fdabe1", "value": "T1CF04E149FE951FDBC01FCF74565B136712E88DBE46E2632A917C8C8CB68935892E3C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920225, "uuid": "4679e1ae-81d6-465e-abe0-5d60b0dfbd67", "value": "3072:oDTIzc663gm4iXNsxF/d3vYWWSSsnLrQ8pZuaTZCUYKchzXKgFxMCLOxiPKoK:rzR63rBdaF/d3zWeQwu0YZtKgFuOOsKb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920225, "uuid": "77742fa3-2fba-401b-b138-a0df1fbe0517", "value": 180237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920225, "uuid": "37cfa458-bb7c-4e79-a414-8c4060b8348a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920225, "uuid": "98040e04-417d-4374-b00e-300c4c54a069", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcfa1d8-997d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786889861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889861, "uuid": "975c3332-00e0-4c1b-867d-d47a40d5a871", "comment": "Malware payload (Mirai)", "value": "6a1365c08aae404ea0bfe0e19267123d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889861, "uuid": "fa43abd2-0345-4dc3-badc-cb046d271b00", "comment": "Malware payload (Mirai)", "value": "18d8acb9d592d1d8b9a10fbe277a29a5a196024477c7d31d5d5c9fd2649f5d37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889861, "uuid": "6840b830-3a33-43c6-94c1-814f095e83cf", "comment": "Malware payload (Mirai)", "value": "11bbfd51555ac4306410f054a2454bbf3380f342", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889861, "uuid": "c5cf8893-1275-41a0-8ab5-b4312eb13597", "comment": "Malware payload (Mirai)", "value": "fdada08665c716861fbb50bd61b7c080166cdd31e9f770cb80b920d9966b5d56939a7526e57c355637489277d9df6fac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889861, "uuid": "737803c8-78d6-4c9d-bcba-317a4407912b", "value": "T1E404AEA7B20B1050C96206F41BCB8BAD3A6321018FEF99E3EC5E763925775DB6C067D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889861, "uuid": "78ee911c-ccb9-4203-8945-9b5ba3abad6e", "value": "3072:SgF+E3ZLlDUJQLl9EobtGMm6I66kNpUATwJXUSTngACH7TNqTDJHBiq:SgF+EJLlkaKDSISpxIXPT9CHvNqniq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786889861, "uuid": "1db51585-e213-4265-b60a-6eb7fee5c0b6", "value": 173588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786889861, "uuid": "3ff993bc-aea9-473c-b84e-a7dc684c5ed3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889861, "uuid": "538500f8-e0b4-413f-be74-977c66920e46", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8349843-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920211, "uuid": "14191014-b068-4387-9504-e8e06f334ff4", "comment": "Malware payload (Mirai)", "value": "0e96b4ee02e4fa4097eb016d054e16bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920211, "uuid": "4c7b2e32-4d23-44f5-8acf-4fc0e773678e", "comment": "Malware payload (Mirai)", "value": "18dadd1b55c9e3220baa3935092f7ce53dc65f6040656428654bb3e32dc8e59e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920211, "uuid": "a9cb829c-fff5-4ae0-aba2-533a5b42e8e0", "comment": "Malware payload (Mirai)", "value": "ec5f4cfdd57b53eeebbcceff6f2be46641f5ade8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920211, "uuid": "3416a0cd-ed0a-4357-9d36-c427d1ca7b1f", "comment": "Malware payload (Mirai)", "value": "475ca0d983773a612ac094e2c5d43502c07125da23deacc24de2a2e918cd85f6d522a1e07641e32441a807dcbdd0ad81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920211, "uuid": "2d2a7fee-f3c5-4d56-818e-8b28f73b719a", "value": "T10BC3F183E9D2C1F6D65748731087ABEAEB39DF354144C68BD345BB61B8B7703682B248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920211, "uuid": "b6fc0365-76f1-4b9d-b63b-f5544b0b22b0", "value": "3072:qa3z5a9yc6DQ4ycdiWIg6lcJJdWILr2R4GU2Di:qqm10QNCzdJJd732R4GU22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920211, "uuid": "fcac3853-4163-4a0b-b1db-ac1db6121a23", "value": 127073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920211, "uuid": "b44c0216-14cb-4f4c-99a3-05fe0cc868bd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920211, "uuid": "f3ee2f63-cf17-43d2-9052-cff572480fc3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "478e6e5d-991d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786848645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786848645, "uuid": "c8a463e2-628a-40c0-888d-4a9b556ab9e6", "comment": "Malware payload", "value": "502980f51438a18715ab1e1e611851fd", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786848645, "uuid": "cd0034bc-3164-4669-9b88-63ebc79d4cb9", "comment": "Malware payload", "value": "1980cc97101e1dd2975f2b3618ad64b1d0b35c5ce6bb2674a66f3832aba53cd3", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786848645, "uuid": "4b387807-f034-46dc-9540-61587fb49037", "comment": "Malware payload", "value": "affeb2892b806c758fbf8abb2435a01674fa5777", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786848645, "uuid": "d73dd20b-1253-4007-827c-89947be79d36", "comment": "Malware payload", "value": "0c50d25538a660d75bd08ad614b153dc66c8a33113f4e66a1f392a7152967ce889337df84b018865039cd110fb703f20", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786848645, "uuid": "bb423c56-7f15-45c2-99fd-8eec56da844c", "value": "T1E1236D651A857C14AA98C4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5A69D910871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786848645, "uuid": "315a640a-1aee-4fe3-8fb1-47b4cffc447f", "value": "768:3XRWNGxVT9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:RlxWcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786848645, "uuid": "9eae8a0c-fbd5-49e0-b0ef-e653d8cefda4", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786848645, "uuid": "acd56e93-3c8c-4a5b-8876-0f1dabd4087f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786848645, "uuid": "79e0b52a-9196-4c05-80af-5c12e9681980", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7f7a7c-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786915120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915120, "uuid": "099edef9-fe09-4d40-ab50-885ea2bed970", "comment": "Malware payload (Mirai)", "value": "54bd7c2fa9f532dbd7cac5b9f156072a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915120, "uuid": "0d925451-5ad8-4951-befd-b2fbc6d7f566", "comment": "Malware payload (Mirai)", "value": "19f929bc44a2c6adce76771cb94ea0d75e35b4c522b1f101052f8171a56c6f73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915120, "uuid": "116c34bc-79c4-4af4-9ceb-e535b86491b3", "comment": "Malware payload (Mirai)", "value": "48bb562d6cc4f7ba52d151166be05c798ef716ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915120, "uuid": "11371e44-4ff2-4c40-9857-2919aa11d23d", "comment": "Malware payload (Mirai)", "value": "05fa9cf9ea859b3d83988dfbed33d0ff81d13a7f2ea17df16fb282197f04b92a05e36a3b316d71220fea24018a46c917", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915120, "uuid": "4063f948-1314-44d1-8495-14ed41f7c586", "value": "T172C35B2229B26607C1D7943E57971322F05226C710E8C20BBD3E4E9D7F5A36036FB6A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915120, "uuid": "93d306e9-de89-466f-a6d4-42e65cc08545", "value": "3072:RW66sbdhd1DsQPVoo4eleuQlssMab/BlGH+Iys61X5hWocd:I7sb91DsEFlulssM7khWoa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915120, "uuid": "a393b992-3d37-470e-b996-78f4c286039e", "value": 125348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915120, "uuid": "4ceb2db9-5e0e-4d00-9b67-ddfa0505165b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915120, "uuid": "5b3c17ef-4f4a-40d8-89d2-a3ab96564ded", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718c0a91-9964-11f1-bd95-42010a9c0009", "comment": "Malware payload (DCRat)", "timestamp": 1786879210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786879210, "uuid": "6ef57c90-2e7f-42e5-a5e8-dc995b651575", "comment": "Malware payload (DCRat)", "value": "11f45214e400e24c21f27371b26d5275", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786879210, "uuid": "c954799c-bf0b-49c0-a1b0-1cd55134bc10", "comment": "Malware payload (DCRat)", "value": "1a73320195db851f5cfb2869b2b44e28453510e1da7e6a669d7bafbe674da290", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786879210, "uuid": "fa04724b-38ee-474f-9f9a-9ca819024313", "comment": "Malware payload (DCRat)", "value": "b1b4795864d07571873b07c9d2a54acb947947b6", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786879210, "uuid": "1d2d4976-698c-4b4e-8550-a5f724787503", "comment": "Malware payload (DCRat)", "value": "c6ddc1b1294efa5ae5fdf379a3dac362c373e406c882eb0206b2effca428f790fe5da654e77b87da9af017ff2849fdcb", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786879210, "uuid": "47680261-d9fb-40e8-afad-e186b5ad97e4", "value": "T13E15F5027E44CE11F4191633C2EF494887B0A9526AA6E32B7DBA776D15133E77C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786879210, "uuid": "b430edcb-1a98-445d-8587-c698e22b8743", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786879210, "uuid": "f531ad55-896a-414c-9134-f2eab8f81866", "value": "12288:KOdR3l6D8o0VVksBFoocikbEG7ZspwxNDE5Goxbls7cTE:/l+8ogJBFoocikJs4NDEsoJq7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786879210, "uuid": "4e2f1254-1375-4793-9ccb-53fe1e7bc7ae", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786879210, "uuid": "8db338cd-90a5-4617-922c-1d06b577c732", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786879210, "uuid": "14710a1e-d9dd-4fd8-8664-07dc3de8e529", "value": "11f45214e400e24c21f27371b26d5275.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86384e3e-991d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786848751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786848751, "uuid": "2629cd51-e4ec-4b36-b68f-9ac0231623c0", "comment": "Malware payload (Efimer)", "value": "506559e72563e1c509818c8aa644e969", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786848751, "uuid": "f7b2f19c-2936-4f71-b65e-8f181de797f1", "comment": "Malware payload (Efimer)", "value": "1b3c95255961ab817b01345fa1095b52766117572cca86b5b75064dada960641", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786848751, "uuid": "cd173809-fb25-48f4-aba2-f7fade168661", "comment": "Malware payload (Efimer)", "value": "d74468e2a3a8fb06ea2d6cbac4eeb75d67e94e13", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786848751, "uuid": "a1f28174-5ef1-4353-b5f9-541c0b94fa1a", "comment": "Malware payload (Efimer)", "value": "f56a410fb93b5679566df20eb9a2f3eb7a71b677c9027d9fcc4c19600bdc0c720e3b6a2649b2eafa954ed8444657faa9", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786848751, "uuid": "fb2220d6-0786-4efb-9ab7-86fbe792a11c", "value": "T1CFE6334DA2D012BDE5A38138EAE24654E7B9B8BD1770C8DB6B9853D5BF633D0443C623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786848751, "uuid": "b9a74c25-aba0-457e-be8a-6cf349ac337d", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786848751, "uuid": "66c748b2-60ac-44bc-88e9-d536653452fa", "value": "393216:P7/x9k2Wghma3qI50zXMCHWUjqcuI3/PGTAI:5WMbh50zXMb8HH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786848751, "uuid": "b2603cec-9e56-4a75-875e-01466f7cc664", "value": 14069710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786848751, "uuid": "809a25ec-8f20-4f05-a3f4-57e8d742fa2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786848751, "uuid": "88f9ffb6-f332-4c89-a0f4-a26de9a7e59d", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414188d0-99ad-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786910482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910482, "uuid": "f810a68a-a3c6-4f93-944b-27278cdc2d79", "comment": "Malware payload", "value": "ad8ee2d1399d3270291f2197092d63c4", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910482, "uuid": "c5c161fb-a60a-48c6-9ca5-733556c92f97", "comment": "Malware payload", "value": "1bca17b53261c54c5882788c2767e5674bc8951a53314c803668202ff2b9bb56", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910482, "uuid": "a384dff2-d81c-4724-aef7-6b69d5061444", "comment": "Malware payload", "value": "a49b2d16ca57496eeb9ead49b8717455ef33c775", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910482, "uuid": "633e665b-ce9d-48dc-9381-03fd725785ad", "comment": "Malware payload", "value": "281a3b5a8270e023da1e1a89ac2c9b082d71354246417f6462a60c6cff9325e8c8e94e779f28d72c1dfdd631eff21268", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910482, "uuid": "ebbd5236-8c63-4c83-a6d7-1510846ac834", "value": "T148C27D956A867C44BEC98A3E4CBD2B0D6DF5C3D1324952AC3D8A3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910482, "uuid": "c34122c8-50db-4c23-bc49-593cda312e9c", "value": "768:Q8vCB+25j6es8RW9FYpMSUpi+20qUpi+20YQX:Q8l25JAd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910482, "uuid": "ddf8c8dc-9a3c-4f4d-b019-ce3e826ea495", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910482, "uuid": "3d80f5be-e86f-4f8c-bb5a-16ac50f10017", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910482, "uuid": "73661382-4d4e-4762-9355-6cae3b296887", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2036e0f2-9939-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786860605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786860605, "uuid": "6ad04038-1cd0-47cf-a4a5-e01155236afe", "comment": "Malware payload", "value": "b9dd11f5fde64f22b0b7bfa6e84fde0b", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786860605, "uuid": "94e9e7f8-91a3-47f9-800a-1994ae731819", "comment": "Malware payload", "value": "1bf6af424722904e51666ebac53b88193a2df3ec3db5d06d7999967788afcf37", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786860605, "uuid": "4594b03b-b19f-40b4-8618-ea7e75cc6673", "comment": "Malware payload", "value": "6d3815390e03fa84a14e67ab99d9b774d674ee84", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786860605, "uuid": "54f2e61f-93c9-47b5-ad24-2afed81470fb", "comment": "Malware payload", "value": "41fa8631b37da8a478c2668ab755831091e66b83abb8eb2d10d1f88089bc82f8c77eaec6b356ad7bc3778764091e13be", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786860605, "uuid": "6172ae96-acfb-4fc7-ba22-eb6edfe4fa3e", "value": "T181062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786860605, "uuid": "c930a792-2da2-424a-b4aa-71c5f6ea0dce", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786860605, "uuid": "6359bce9-88ab-4d95-9ce6-15e090fa3e5a", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnGU:+MIKhlPGU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786860605, "uuid": "f3cc40e4-b944-4675-b4f9-5aa0ff100241", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786860605, "uuid": "29a1a026-b650-4218-a981-88eaa9417ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786860605, "uuid": "fbe97c9f-706b-4aa8-8332-38799259893e", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d5e26f-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786915406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915406, "uuid": "19c2ec3d-4e1a-48a1-9e0e-5acaaaeff20b", "comment": "Malware payload", "value": "736220e6f71e6ad2d603bce12d9b4066", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915406, "uuid": "da7edf00-be69-44de-8f84-2d4492c50136", "comment": "Malware payload", "value": "1c90be80c0b27aacdb0bd861c1601bede5d45f628a0bb530d065dbf525300d7f", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915406, "uuid": "cc05c0c1-95df-46af-8ee5-e8009f127427", "comment": "Malware payload", "value": "41561d8c676de79f484aff18be8b2748a69c7cc0", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915406, "uuid": "2b2e28f3-1a4c-4c49-be86-eca02e8ffa4f", "comment": "Malware payload", "value": "e8d43ea68d49636912dfb316fc7d1383c55afee14710ae26427e4b6946bb8da29364d898c68db58e0d475b4a733632b9", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915406, "uuid": "0c309473-5e93-42f8-b13e-854c76280b27", "value": "T14CF58C077C9081E9C0AA6B32897361A5BB75BC1C8F3523D72EA1B6742EB27D15D39F40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915406, "uuid": "e8d0f125-6a78-4b38-93bb-0985716542d1", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915406, "uuid": "a75389e6-3be5-48e0-b89a-bf46401b1868", "value": "49152:YmOVsBwrArOpbHLbMiBAz2aVr0+lzMZ7/o2OuJqNes+:Y1FOuBAzI+eN7a0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915406, "uuid": "a9b7443c-2773-4cf9-b365-958aae913f27", "value": 3371368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915406, "uuid": "b5d0040c-045d-448c-8806-b22e5336adf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915406, "uuid": "8916e054-b931-44a7-a583-2eef23d5cb42", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30115494-9911-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786843452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843452, "uuid": "8af93973-2374-4957-a7e6-09c9d556e303", "comment": "Malware payload", "value": "7150cf90fe9b3a1cc2ce8a9060a7d23b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843452, "uuid": "22bd04f2-8cca-4cfc-8da7-9b0fa7344e77", "comment": "Malware payload", "value": "1db6b60a7989a6c1dbba63d5a78463f5a4d4fbff75af27c281e1a93a11bfe4ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843452, "uuid": "379f2b09-7d86-45c1-a55f-445208699b33", "comment": "Malware payload", "value": "2983fdf39bc257de7d8d20021fcc6f357d70095a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843452, "uuid": "051516a0-bbdd-4eaa-971c-8385a02a3b2e", "comment": "Malware payload", "value": "5ba49e34401005045014e45cb480c6c2a2d69757725e5cb76ab2bd4211fc1fcef1dc12b01470a8b666f2d8d848862800", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843452, "uuid": "e7151747-b8c7-4b41-827d-63b47d138937", "value": "T17706AF076F9046A6E4DAD339C4A612217334BC0CC33677E72EA4A6742F267D19E7AF50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843452, "uuid": "d883d0f2-2c7d-4f48-bb09-d5a29b43b530", "value": "42efe1abd8d48a3188e7e7b82e17c631", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843452, "uuid": "13879756-c971-4163-afae-0850d001b840", "value": "49152:gOa0AhLLotdl6YAAZaGDLbQidX91+wZg04dKtcU9OxH:OLL1DLItZEfxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786843452, "uuid": "6593fdb5-7783-42be-85f9-dc7568fda333", "value": 3826824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786843452, "uuid": "3b1c0634-7340-45e1-a335-f9f6fb96d976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843452, "uuid": "afa1fd4b-68ef-4e7f-ac23-8b3db98a56a5", "value": "1db6b60a7989a6c1dbba63d5a78463f5a4d4fbff75af27c281e1a93a11bfe4ad.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a887273-997d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786889855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889855, "uuid": "014b56d8-be77-4e48-b733-47ce5bb92fa1", "comment": "Malware payload (Mirai)", "value": "15205a53e1ed200e99a99d0c65dcaaf3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889855, "uuid": "cdd449db-c9ad-4582-b15b-816d96879e7e", "comment": "Malware payload (Mirai)", "value": "1e078b97ea6f238e8b6759a1720355530826171f9d2dcc0e15e282f42f241680", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889855, "uuid": "cedd320b-06cb-4b37-b628-a7570eca665c", "comment": "Malware payload (Mirai)", "value": "91e38aa1cb9407111f4363308cf3fe451bf5675e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889855, "uuid": "4ec4a045-65f2-40b8-a2f2-f40276fde7c4", "comment": "Malware payload (Mirai)", "value": "e8ecdff97a7d00f4db601e9607916f6bb6ef89055b21884afe2a2f9fa95b2f5375c02e42b49a5db02a660ecadc977dff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889855, "uuid": "fb9398ee-59b4-4705-abf9-0022375fb321", "value": "T11BF31855BD418B12CAC326BBFB4E428C772617A8D3EE720399255F21279B86B0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889855, "uuid": "c0528ff3-cb6d-460a-84b1-cd4e1ee7265d", "value": "3072:nHk98o1H+Wqg3/KMQHPEy0w+dpystNOwqT/LK+dU43VYzX+ZHdrHLsu:nHk98o1Hhqg3/j4PEBTztNOwM/LzU8Vn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786889855, "uuid": "fe1a055a-b77c-4c52-bff7-05d869d74390", "value": 166552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786889855, "uuid": "5d6ff7cc-0d8c-424a-8993-696c00ba93a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889855, "uuid": "b3584fba-e9d2-485a-a918-6ad110682aff", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8002f4c1-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901139, "uuid": "347b89b0-b403-4c94-a96c-d484d30f702e", "comment": "Malware payload (Mirai)", "value": "4585893fb625c4bb95ada46ad497a4fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901139, "uuid": "1f0ac552-47ac-43b9-8cb2-9def6c33c929", "comment": "Malware payload (Mirai)", "value": "1e4de459e9dd70f6a2e77dc5bfc3723a9c9745018f8e9193a5deddcd84223512", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901139, "uuid": "f95deed1-8342-48a6-a813-6da6bf841a0e", "comment": "Malware payload (Mirai)", "value": "f863ca4062a54da6265d24eea933c43bcd7bcaa3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901139, "uuid": "40dc3c54-1d44-4fb0-b06d-179aa43ea031", "comment": "Malware payload (Mirai)", "value": "68f8b7835d980e8909252ec6a39ccf855255cb2767002da1aba5dfe5f880518fba33d0ae9d67885a5b48b56f05adabf7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901139, "uuid": "7a351d48-5def-449f-bc9c-2050af2c66d1", "value": "T182A32946FC814A21C5D512BEFA1E318E331357B8E2DE73229E149F3173866AB0E7B615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901139, "uuid": "4630dba5-de78-430d-9870-268f58e58e64", "value": "1536:gAnky0u6MdiA/5JHa9yiqppUGBEyQxGc3k72aRrtOXrDxRiMpux/V8v7Ph5GYWg6:Axn+ppUlMak72aREpux/VULhULg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901139, "uuid": "beb7528d-739e-42ce-a1f7-2a91938b58f5", "value": 99804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901139, "uuid": "4725f8fb-e670-42c5-8488-26e072d6395f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901139, "uuid": "c52fb7b4-2198-4c79-8393-916e67127339", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a70cb5aa-9945-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786865985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865985, "uuid": "b4007141-6126-4ad5-8538-c355f1549e0c", "comment": "Malware payload", "value": "5e2782f4f0b3d38cac12b45d5aafe36a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865985, "uuid": "044cebd8-52f1-4d5c-949b-e59b85dcb677", "comment": "Malware payload", "value": "1efd51b02281028421c490bfaccc41bcbcfc1ec288772e6af239fbec05cccd88", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865985, "uuid": "c75473fc-b2b8-477a-88ce-f1346e4bd891", "comment": "Malware payload", "value": "047ce31016b2e3c3a4448d5cb0310bc42463228a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865985, "uuid": "99f8eaea-0681-4f4f-849b-24c7deb218b3", "comment": "Malware payload", "value": "92b532aa908cee4c0c2b974e1e37778fc411a7763136f5306bce98f7d0d7c679a306a8135ed9a7d71c6e5a0164be085c", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865985, "uuid": "cbd9e2b1-ae52-4170-8e05-70ec62c2baed", "value": "T173235C2516857C24AE99C8361C7E2F0CB9AD43E6324452EEBFCB3CF68C4A69DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865985, "uuid": "7808e84b-ad2e-48ff-907b-4592a8a0e044", "value": "768:a+c9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:a+Rcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786865985, "uuid": "58a7d049-4c19-4491-8cbd-1c0942e116f5", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786865985, "uuid": "857e1518-2880-4af0-816d-cf23f2717a13", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865985, "uuid": "9e4fdf97-e30e-46d7-ae26-03892c68e5a9", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cee2a528-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786900842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900842, "uuid": "a732acdd-347e-44c2-a73f-302f856843ab", "comment": "Malware payload", "value": "dd6099afecd9dbc66aea39e9f48f1b08", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900842, "uuid": "5f48da19-1193-4d81-bc2f-521d352d9f69", "comment": "Malware payload", "value": "1f59787f0d557d701ba036a08e294ab16c4a4df63a8bfda4e8c72382e19b28c3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900842, "uuid": "8b018d9a-df2c-4929-a66f-da80fbd4c5fa", "comment": "Malware payload", "value": "cbef73b7f9135066f9c451724c8e05ee309d2407", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900842, "uuid": "f2e6d109-97cc-4ff4-9f21-08951550708a", "comment": "Malware payload", "value": "c35106976984d3aa651789f69eb76fce3bbdf3b9bc6931b663d96e87188978f1019aafdbb07acddb82741068f9a5d7fb", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900842, "uuid": "db07351e-0172-480b-b611-c7257ea81dd6", "value": "T1463112C525196E21965F8F4CB1B44FADD00A37F8BDFF1646D8465C4369C4A8478CAE32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900842, "uuid": "faa80dc6-17bd-4669-a3b3-cfb89ab00d05", "value": "48:eBZMZiVZkZhVZUZUVZsZTVZ4HHZ4kZSxZJcZUZdZQZIVZGXZ+Z0HZiZkZFZkZZZD:USgVqfVauVCtVSv8xDcK7GqViw4gC3KZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900842, "uuid": "72313ec0-4e9f-475c-9550-779be5ce1583", "value": 1599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900842, "uuid": "89783412-7257-4a3c-aa54-30fe35e7e2c6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900842, "uuid": "a424d8ca-ae1c-4940-a682-f0696e9c78a3", "value": "a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "360adb3e-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901015, "uuid": "392401a3-85bf-4ad1-85d7-47ffc6abac4b", "comment": "Malware payload (Mirai)", "value": "795e80be446ec3833acbb2f897212223", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901015, "uuid": "bb8c7050-e71b-4e0e-ad02-7d7206c1bced", "comment": "Malware payload (Mirai)", "value": "1ff2d63d2613bfa5ffcd658fa441d8b92396916f7e4e3b40c38ef61971a7520b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901015, "uuid": "d4095ba0-481f-4857-b852-0363ca274677", "comment": "Malware payload (Mirai)", "value": "f9cae25ecacce15f9169b9bd529de637a4b995e3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901015, "uuid": "7f0dbca4-0659-48fa-b55c-4e1749afce6f", "comment": "Malware payload (Mirai)", "value": "251cc30bf0506bf640ff83dd3172559e6e07405ede6528d83f0ae90ea747f25127f0c856156e6d3c72f2952b42fe9214", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901015, "uuid": "0df34406-4622-41e4-9297-61fed073c85b", "value": "T160C3BE97F68B24A1CC6147F007C77B9D2A6362019E6BE9E76C0E763B097A1DF19063C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901015, "uuid": "92828362-79f9-4fcb-8efc-cd5375143b71", "value": "1536:D5LQvJrKIEcfzXhS8SNB4ZPLaLWq0IijTQEE8+FCUxZJ3eg0P/LWg:D5LQv5gqrlmqZPLetETQC+FCkeg0Pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901015, "uuid": "bebaa9ee-8fc1-47a9-b586-feb03f487f44", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901015, "uuid": "f214d234-840e-446e-b35b-fa7971c430f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901015, "uuid": "57e7ad27-38ae-4d7a-85c1-b47810000798", "value": "nz.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f20e761-9934-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786858429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786858429, "uuid": "b498bbc2-3039-4fd5-8c72-6eefd7e09d8e", "comment": "Malware payload", "value": "7226d373d47ff1a604faf9237a67c515", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786858429, "uuid": "ff61afcd-f23a-4175-9981-b138846ac173", "comment": "Malware payload", "value": "207ffddee39f9341283403b86786f667e5b38162b8cb05cfa7296178daf1f0ac", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786858429, "uuid": "4e614c49-a898-492c-bbe4-88cc9c97e309", "comment": "Malware payload", "value": "d113d10016f05a7976e9b9bd7caa511c59354c36", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786858429, "uuid": "bee8cac0-7040-4e96-9787-9ea701d045d4", "comment": "Malware payload", "value": "78fe2f07a6166295512e75c2ab2e714d1dd29f2ec5a3a85f689e2d55fa46aa89d983656508ce19efd5109667330a50ef", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786858429, "uuid": "99402d67-2dcc-4e87-bbe6-5bc7d39fda08", "value": "T1B5F5C03439FB5029B173EFAA8BE474D6DA6FB6733B07645D1091038A0623A81DED153E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786858429, "uuid": "4631e0be-2e54-4eea-aa29-6d88875d203b", "value": "49152:Xn9oktzlOhIk/CmGOLvPJB4mahT6N9i5iCDjD:X23SPOLvBB4ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786858429, "uuid": "9719c195-e2f9-41e2-8e40-c63af953e6bc", "value": 3556352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786858429, "uuid": "fa8ef588-6f59-4532-8ae8-00434fa2a6ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786858429, "uuid": "675f350a-6322-4e7b-843c-2bda4f0b747f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f14da28-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786901379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901379, "uuid": "e800b703-ed77-4604-af52-b94b2421aded", "comment": "Malware payload", "value": "9292e917315773fea8b4cbf706debf37", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901379, "uuid": "3a932b5b-8c41-44e1-85f0-acb702a8f47e", "comment": "Malware payload", "value": "2101bfba26d814a9e6445c1486a15aed19a3ea596606eb29c44be6260e8fc428", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901379, "uuid": "bea5c6c8-2c68-479d-be0a-440d81084494", "comment": "Malware payload", "value": "c61b46dc2739d295ba45cec206ef32823d027eae", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901379, "uuid": "d091aea2-833f-4a27-8f24-fd6e3d247a97", "comment": "Malware payload", "value": "5849b6ccd03db2f6d6db0602448b142070ac2132c70d776f630c617df7094cf2a6a48c4325542f76dbe8579c5b688c46", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901379, "uuid": "8d33c75e-1319-4244-90b5-f66003e690b5", "value": "T18E858D56F6E364BDC097C030435FDB63A935F4A911227E7B26849E302E66E705B2DF22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901379, "uuid": "f2d24afa-73a6-4d1b-bf72-f524978eb15a", "value": "49152:Et7eQ5dIb1/tyNBvMPuX1G3XgfCIxwyD3:s6UdIbu4PuX2XHIL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901379, "uuid": "d831e4d2-757b-4cf6-851a-03e42ab96846", "value": 1714696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901379, "uuid": "78af493a-9df6-4ca1-a148-423dd9932f93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901379, "uuid": "cf6a0f05-3b86-49aa-ba08-4c9eef72dba9", "value": "eclipse.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e387d1b-99bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786918369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918369, "uuid": "d9df4fda-b15e-4575-a8f4-22d783dfc1fb", "comment": "Malware payload", "value": "e6ffad543c7e4320edf2dae721545525", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918369, "uuid": "2b74edde-4024-4423-91e3-b8775d2cf839", "comment": "Malware payload", "value": "21be996dd54dafcb13a9d9fe1c90eb362e8b417b1d125f00de346fc7b1372cf4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918369, "uuid": "6cbd8899-3b43-49d5-9529-c762436cc4f1", "comment": "Malware payload", "value": "5619c6926084584faeaaa907c730754c85e32503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918369, "uuid": "bd45492b-11b8-4a86-adf0-220878da29d4", "comment": "Malware payload", "value": "d94fad76c493a38ab1f5d7ef7e8ec4ca91e738b9464af6c52a4211f6ebd58e3a675670af4832dad022f2fceece4ec087", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918369, "uuid": "84fabdaf-a828-46be-8e1a-b0c2299f1c3c", "value": "T16BE5AD17BC910478D0AA5B3D89B71682B675FC048B3633DB6E90FA382F357D19A39B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918369, "uuid": "f9995deb-aac7-411b-a70e-380a4d084bba", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918369, "uuid": "32140110-30a8-4418-b0f9-2acd12b87214", "value": "49152:ccHNs1HTivAVjUeUZYIzAeAp6uHXRwLGXEnNe/Im3LAdKAG:cT4vYIzw6+rck/Im3LRAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786918369, "uuid": "f1446846-bc0a-47a7-83e9-7f3006bdd3d1", "value": 3271184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786918369, "uuid": "9a40a10b-7bc5-40b2-950b-92b473e21f73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918369, "uuid": "e5c0ec68-d87b-4f46-ab5f-860d161074f6", "value": "21be996dd54dafcb13a9d9fe1c90eb362e8b417b1d125f00de346fc7b1372cf4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9ea551c-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900914, "uuid": "5954f824-4819-4194-8007-49123241c751", "comment": "Malware payload (Mirai)", "value": "3079dc169540b1097b114e5c63647943", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900914, "uuid": "20ee9dd5-4965-4f18-abb6-606e08078adf", "comment": "Malware payload (Mirai)", "value": "21c8cb877e183ae6a2a595ba6b15575bb88e0a0a807fd92393b28b1e10b63803", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900914, "uuid": "120ade52-ed84-4c8f-baaf-1b6601ac08e7", "comment": "Malware payload (Mirai)", "value": "cea4bc9e4dcf4ff2fa71380e7024fa9f4914288c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900914, "uuid": "7a570441-d1fd-490f-abae-86b96f4ced4a", "comment": "Malware payload (Mirai)", "value": "3b96c468c5ccb88b051204efa699cfffdacf491f2bfe89439ab6a9d9aedbd95b82a78eaee08085bf684180560e7ddff9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900914, "uuid": "2757670d-82b9-4430-8190-d687c5730c44", "value": "T118D30B49FC818B13C6E161B7FB4E428D772A0768D3EA71039D196F25379B9970E3B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900914, "uuid": "2558b6ca-1ec6-45bf-aed5-0ac2e382869b", "value": "1536:fFxM2QPXEiu3RR63sRg3U4G24VQbd4Vjs6TNZ6Ww2kW+pHPDFerl2lqYwywDxpmS:f/GEiu3K4l4Gmd426pZ6WxknHrFUDQL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900914, "uuid": "8ac5c9da-23e3-46f2-a11f-30260f1b6808", "value": 133984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900914, "uuid": "e8ef6f98-a974-41ca-8918-1c428dbf8a14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900914, "uuid": "467d2fd7-be54-4848-9d93-2f3b945b4bc2", "value": "miron.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfcd020-9950-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786870722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870722, "uuid": "7d46dffc-e825-424c-8cae-bc45d9b94a14", "comment": "Malware payload", "value": "54389a575bb986c4dc8ebf597b4d4e8a", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870722, "uuid": "702caa18-cf12-431c-9a1f-a5c3dcca6df6", "comment": "Malware payload", "value": "23816b9d231723aa956bca13516806eaf47ec4fe9aacc695c86e5b30726a4920", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870722, "uuid": "368f8e40-c1c9-4b41-8200-a43097cea2ee", "comment": "Malware payload", "value": "696cbfb1dae3df814b9a302506eab448cbaf6570", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870722, "uuid": "06edbabb-380c-4ff9-91dd-b84763b3a1ea", "comment": "Malware payload", "value": "3d7769d8747228b0fe8ebb6632044d3b27a6d353645214cb61be68ad8e301d6210ddfd81e520bf68a07063b85090eb07", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870722, "uuid": "ac905642-8ea7-4a04-8f17-a3b159d618c2", "value": "T130C27D956A867C44BEC98A3E4CBD2B1D6DF4C3D1324942AC3D9B3C719C11F9CC618B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870722, "uuid": "74e727ba-4d4a-492c-a3b4-af96a72aa037", "value": "768:48vCB+25j6es8Rl9FYpMSUpi+20qUpi+20YQX:48l25JDd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870722, "uuid": "b6f9f71f-1357-4d8e-a406-cd2ebf7e4443", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870722, "uuid": "5598eead-4b72-4047-88a9-d86e76a8b550", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870722, "uuid": "52169d7a-f060-46d7-9f46-dbe4c17db67b", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ca9cb8-9937-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786859856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859856, "uuid": "317ede2d-c593-4b3e-bda9-6f3a34c6eca0", "comment": "Malware payload (ConnectWise)", "value": "c16f4547b8382591f560e1e37ae34f76", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859856, "uuid": "db4ecb88-88e4-4f38-9099-520462d9a86a", "comment": "Malware payload (ConnectWise)", "value": "25cd054fe1d163a5fa1bb32a7bc23dd7139111a727a5021b49b7d764335fef7c", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859856, "uuid": "3f557c82-bcc0-4e72-a018-03114cb96953", "comment": "Malware payload (ConnectWise)", "value": "c5538f79da9c43cab9850082a286af4d2b4c4744", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859856, "uuid": "6bb08e15-0273-4a9c-8643-9dba259e151c", "comment": "Malware payload (ConnectWise)", "value": "9260e0b84a208447f1f2cad1c43d8829ceccdff11291a364082e0f27ee34afa0df5cbf2595d00392ad512576eadd5601", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859856, "uuid": "6eb9ba37-4895-47b5-a221-baa1b5e0866e", "value": "T18C835B53B5E18476E9720E3118B1D9B4593FBE110E648EAB3398423E0F351D19E3AE7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859856, "uuid": "f6b38770-3a30-4ff7-8203-ad4f508b93eb", "value": "37d5c89163970dd3cc69230538a1b72b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859856, "uuid": "a080fdd9-4b6d-45b9-8a0d-8558ccecb140", "value": "1536:7oFsMHqzISrGqx0WiwbqKHxfd6dldV0OCJRpsWr6cdYV7hsYYYo7U:a9q8tC0C+axfdalBqRfbYRGYYYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786859856, "uuid": "0e375c6c-9c59-4783-a59b-0aedeeb1d722", "value": 84248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786859856, "uuid": "3b0a7fca-bf2a-49a9-8099-f3161b1171f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859856, "uuid": "a3a81fb3-a247-41b7-8e2a-494e9ae91c72", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1247599-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900845, "uuid": "7152f413-af18-41f9-ad8e-cf745e1c0721", "comment": "Malware payload (Mirai)", "value": "f7e7c5ccdfac5ca6fc8bb43e03fe5d39", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900845, "uuid": "0c73ec97-ab00-49df-ba24-cb221daf68a6", "comment": "Malware payload (Mirai)", "value": "260c68f899d55de1ca2acec4608a098e2333149c26cc40d099e8f59cdfc8420e", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900845, "uuid": "f0511ec7-8de1-4351-a7d4-1cd45d0f2392", "comment": "Malware payload (Mirai)", "value": "85714084be41b7e9c0a90d324838f7855c1b2188", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900845, "uuid": "c64892e0-40ab-4193-9a66-7046d687386f", "comment": "Malware payload (Mirai)", "value": "77c5f0f9ee975f574dfed059e992ae9e860bc0e8a4425d33a981be2b5de7cf31fa62697a43c9d04b3d1fcac4270acc0c", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900845, "uuid": "d5c59dc3-6086-4420-8af1-8589f5f770da", "value": "T1F72301EDE3826C6AD6B0A53CA7BD8D60BB3251A9D369F8F2327006D957DC04B7475402", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900845, "uuid": "04680451-ec1d-4ffb-a513-542e4b217b04", "value": "768:mIBwJI6zXvan5OV/sXw3sGs0cEwQrjgkcjrzldHK28XfvifHcCp0xuVs3UozM8:m3I6zfqQsXwvLcLQv4JRK2OC/F08Yzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900845, "uuid": "4c294d38-b192-459e-8860-0992ffe0ec08", "value": 49048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900845, "uuid": "0be32b10-0a5e-4e4f-a660-2b7cb76b7b97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900845, "uuid": "b8de4589-9498-49a7-b419-a19e112cc502", "value": "miron.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab360946-9918-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786846665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786846665, "uuid": "82de6c1a-aed1-4a4e-9261-278f4d1717ba", "comment": "Malware payload", "value": "b9d85237c62ee7002354ac9826463a72", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786846665, "uuid": "29a6f164-6e8a-438f-9596-b82dfa7541d9", "comment": "Malware payload", "value": "266d74e04745b5548043abc2fd61a855f48eb1bc9e2ef71ac2aba6f9469c1f14", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786846665, "uuid": "a169beae-15e1-45f4-863d-85f76f4c05e9", "comment": "Malware payload", "value": "f3e33a4ae9e1e38830a92445d6155fcfc4b0f4b4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786846665, "uuid": "1016405c-5854-4221-89b1-062648dfca08", "comment": "Malware payload", "value": "dd5703d2b5b8dc6f2c176db7811a5d369ac8814a806e7f1758dc3f956b08e7cf8c224e5e26c56c00c32681318c214a56", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786846665, "uuid": "ee8225ef-8554-467f-995f-00bebe5b2c13", "value": "T10C236C6526857C24AA98C4371D7E2F0CBDAD43E6320492EE7FCA3CF28C5A69DD10971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786846665, "uuid": "eaad53fa-5f67-45e8-af1f-b9560a1f76fb", "value": "768:GXRWNGxV59GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ilxccr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786846665, "uuid": "7ff37d30-4b05-4954-b7f1-d255d7fe5b48", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786846665, "uuid": "b5ec1267-c9aa-4940-80b9-801d8df969e6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786846665, "uuid": "eda46ea0-4fb8-4734-8119-289b5cacc54d", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8526c6f2-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901147, "uuid": "8d97507b-d3ae-4c35-81bb-75b0e386a9de", "comment": "Malware payload (Mirai)", "value": "ed81809a465ddc179db82890ffb34f50", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901147, "uuid": "086552ef-b441-49a7-a6e7-7f2de10a9af0", "comment": "Malware payload (Mirai)", "value": "2679cb65a23dba3650351c3019c258ee46837f36fa1faba84edf791ec07ac1c3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901147, "uuid": "4cb0ed9b-eb97-47d4-a0cf-7c2aef2d7807", "comment": "Malware payload (Mirai)", "value": "b3d9bb136e147898da7410a3839f8625c5035b90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901147, "uuid": "3554b7ab-6e8d-4ae6-8328-7cf2ebb165ac", "comment": "Malware payload (Mirai)", "value": "cd365da40510587e31575fe1e6be27af33dce31941f119406544623c4146f4d6e851ea60799ce45709cacd4df76bdb22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901147, "uuid": "ad8e370e-0c37-488a-b992-58fa2d8989ca", "value": "T1ED432885F9D2996AC6D013BAA72F358E33A1B3E0D1CB3603CC945B2173896CF5D66B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901147, "uuid": "8579723c-1aa0-44c9-9a80-1561e3d740f9", "value": "768:vcya+3ZDyZoEJdCyN0OXj0QoyeEFMyiBL5EvSe4kT8sYcjJKIoNSitRMfgrBNNTb:vXpDnwJNTXjX+EFM/E9AsrjJKDtR7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901147, "uuid": "8a90fd07-8ea2-4121-a045-9e0c788acdd2", "value": 55876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901147, "uuid": "2726388d-7ba3-444e-bc6a-2131c41c0b11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901147, "uuid": "2d0ef267-15d6-43e4-b285-9589e99352ac", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05da161d-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786915107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915107, "uuid": "116952a0-19f1-4953-9b33-a2ef2384358b", "comment": "Malware payload (Mirai)", "value": "499bad122ee9b74b5116e5d5d3827800", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915107, "uuid": "b8b5cd9f-ab53-4616-895b-ab9016737bee", "comment": "Malware payload (Mirai)", "value": "26c04427dcbc94f30a2ab80d8cb377c88df3521fdcbd97825cf5bffeeb5a9b21", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915107, "uuid": "3ecfa5ad-31f5-4b26-ad35-097435830644", "comment": "Malware payload (Mirai)", "value": "e516fe21a2f405bda08903da9331f0d3089a20fd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915107, "uuid": "93f71be6-f970-4fed-bee4-d594d508e19e", "comment": "Malware payload (Mirai)", "value": "cc1efe3b5c9465f9d3f64952acb8ee4933fc2c24c5a66ff55d0349999cd52c361764a1d3238495fe9be11bbf22109514", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915107, "uuid": "27822757-f9e3-4250-935a-54a0128c90f7", "value": "T1DA048DD06AA3D0F1D9630676126B9B155A32D437022FDA51F73E2834BF56220E7AB3DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915107, "uuid": "2b156936-de30-4f78-9e33-4ac9493c70b8", "value": "3072:qLi4YDfQchISCcTYO9m7eUPSGdtT9mGuQlssMab/BlGH+Iys61X5hWoI0:4KDfQWc6wJ9mGlssM7khWoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915107, "uuid": "68931265-d251-4f23-9dfd-af664406a997", "value": 188588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915107, "uuid": "a26e0b1a-f5dd-4bd5-985c-29165eea2d22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915107, "uuid": "abf060c2-d292-4150-b769-ebbc9f74847e", "value": "debug.dbg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eead8309-99ae-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786911203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911203, "uuid": "58bbe748-4729-48b6-9ca7-5fff14ed87ab", "comment": "Malware payload (Mirai)", "value": "fcf55f94e248364a2a239248488528c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911203, "uuid": "4fb93935-b5f3-4be9-93cb-934af73c89a1", "comment": "Malware payload (Mirai)", "value": "26d61987f55508b5756094d3d5675baf3aae3b0bf3ce370c7dfd8b2418c1c124", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911203, "uuid": "0318b694-02b6-4426-ad9b-bc7d63265fed", "comment": "Malware payload (Mirai)", "value": "74e23a595d2edf237746beed793f2a808ead13e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911203, "uuid": "110a26e4-512d-4044-967d-40dca0a58b77", "comment": "Malware payload (Mirai)", "value": "5a012886f5e04b1995eb4242367f1450aaac2034dda727a6ee73b940da366f1e69eb5e0d1a876a5b74b7bb593ccee5c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911203, "uuid": "c42e159d-73dd-4bef-8bc4-058ef64cc3de", "value": "T1F46302DAB8B148EAFE3DA3BC57C9679829781D01A405F20CB78EE845DD56E8090D6FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911203, "uuid": "1e0712df-c68b-4711-97c4-746835a6f436", "value": "1536:DYQXvkTMZP32bVnewrM8uOM5MaAz5UhBWNsnte+jRDMAKJ5cyxGlG7ESVJuP:DYQsKJBR5MpaWj+dDDC5cyxGMVQP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911203, "uuid": "32c30b8f-b165-4747-8a16-63bf694f17fd", "value": 72668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911203, "uuid": "977b6b35-2a1a-4a7a-aca0-e7a822860795", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911203, "uuid": "35868712-1e70-4cbb-b5db-f59ad7210804", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a361fa-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786901475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901475, "uuid": "8ac703ee-3154-42c6-bff4-776262773ad2", "comment": "Malware payload", "value": "6f6c43bfd1e58e36ff100ff63fbcab34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901475, "uuid": "15ba43c3-2f31-4aa7-a489-8b51151c0124", "comment": "Malware payload", "value": "26de84c8bb7cc95a1fbfccec4ade4320f415f4046d574da92361559f13024df6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901475, "uuid": "d4848292-4cc2-4364-8b5e-be32abe6a649", "comment": "Malware payload", "value": "0ca1d76c5732d78eebe2819843169b5e34f83a18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901475, "uuid": "1fcd4407-b30e-4624-8700-215f25bb7e97", "comment": "Malware payload", "value": "0473ca7635f95708915841329edcc0e151d9c64a91d1777ad239a29179e6d7a0eb3210866085dd4f622354d59fda38d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901475, "uuid": "176e6fce-e18c-4d6c-b93b-8532a195a08f", "value": "T1FB466C03A9A19878C0A5FB3085BA8292F616B84C573837D32D71EE7C2F767D25E35B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901475, "uuid": "4792dd7b-f1dd-4d1e-8fb8-38fe32fe2d36", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901475, "uuid": "b9053bd3-de7d-4428-bad4-d87141f9864e", "value": "49152:2uPbSKqkkF6arXNt23KvwME2lSUQpYM+1ecgh/aljZMlAgCgNbqKT2DSOQcvX:2ooPisZMe0cvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901475, "uuid": "72440c1b-462f-4d59-9f45-e0a623c2d11f", "value": 5700280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901475, "uuid": "1a0e2297-caa7-4117-9976-741f47f85e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901475, "uuid": "f6aef4fa-1dce-486f-b2c7-bb1b19b89582", "value": "26de84c8bb7cc95a1fbfccec4ade4320f415f4046d574da92361559f13024df6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a8be3a-9992-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786899195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899195, "uuid": "c2064a57-3b1c-4fbb-ab17-24de7834fa07", "comment": "Malware payload", "value": "917f6cd606d6cdc33de8318a77d5a0f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899195, "uuid": "6eb8b379-f899-4c18-9541-4784c1810688", "comment": "Malware payload", "value": "27209c96524237b40c8929ace946658a80f773675691c83782bcb31ce0c782ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899195, "uuid": "28e98731-9198-4dc8-aaf9-b647d34de8d0", "comment": "Malware payload", "value": "4596c5fcb0a02f0eaf270e9ffb2eb6b58474cd23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899195, "uuid": "33bcac31-6c20-40fe-8255-67f57ac12ee2", "comment": "Malware payload", "value": "6d90f6f6072ae326dcd6706268081240ce004de8bb8ff01057b1078a61f89719603cd39fd81b418ea9fe3f42ca0deecf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899195, "uuid": "4165d7ca-eb48-4907-839d-053a3589c0bd", "value": "T1D70833C0EE2CE2BBF0416478599133A11DA5F52AA74FB10F78590DE0B771E07D962E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899195, "uuid": "6cc0baa1-a719-4633-a076-a76256357289", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899195, "uuid": "aae87570-fe9d-45da-af8a-95eda3670f8e", "value": "1572864:zDdBK/XoFpp390evThlWoL1rmzHxBncdmFNb3mYFEmxNq/3A:zDdwXoFX3jfWocbntFNb2YNS/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786899195, "uuid": "2dd9e442-a6cd-463b-b77a-0d6e7b3b55b4", "value": 77578891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786899195, "uuid": "99468828-a5f0-42ef-a7a5-28e3934a25f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899195, "uuid": "fa92d40a-655c-4998-87d1-ae08aa4df5a5", "value": "ELLIPAL.Wallet.Setup.1.0.0.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb11d27-99aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909510, "uuid": "deb8e944-a9eb-4030-b744-3d6d77321a97", "comment": "Malware payload (Mirai)", "value": "16f3c96305c6a4348d3a3640951747b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909510, "uuid": "f7ccd6bc-7318-44bc-a348-dea5a361cc12", "comment": "Malware payload (Mirai)", "value": "27335f46446308d51cb8513117c7f3018e3d23d5d63fe32ae8fc360ed28a6596", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909510, "uuid": "a7472d76-d39e-44c2-95ee-d44e17ba647e", "comment": "Malware payload (Mirai)", "value": "bd0a65681010dc2089496ae45eb7ee1a218063fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909510, "uuid": "626d931d-9a2b-4943-87d8-d9991a33d4a4", "comment": "Malware payload (Mirai)", "value": "f0e344be1bb2dd8a564868c4724b6e5e33bc381120849818b5188887968fe5bf807512ae19ef9533090a3563a2a83597", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909510, "uuid": "cd4c9c42-12fa-472b-b5bc-f96bd5bcf765", "value": "T1109312706894EB27F28D0B72C71A073438D9C9BFB6C5846868303E98FD78AD65E5CB11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909510, "uuid": "1d495e83-56fe-4cd4-83d4-d14c4ece6786", "value": "1536:Cno39HWxsYZogoLzGzwPQ3YME5l1ZXOTyWQGT9+a/Z4hcrJXBjAX9pWd8SQrU:0xsYZTkzG2eE5zZ+TyNq9SKrppX4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909510, "uuid": "686f4d26-67a4-4995-a97c-78d7e4dd4196", "value": 95712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909510, "uuid": "1ccd81cf-0c22-4561-a3fd-76fda7413bcf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909510, "uuid": "38d0015a-c19c-40d1-b11a-abba34df0620", "value": "27335f46446308d51cb8513117c7f3018e3d23d5d63fe32ae8fc360ed28a6596.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "589f301c-9971-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786884752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786884752, "uuid": "490bca5a-7676-4b36-8a3a-049c015ae4fa", "comment": "Malware payload (Efimer)", "value": "f63516ca88cd02e727a9e6f3d370ec24", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786884752, "uuid": "249df39d-40ec-4951-b7dc-eb6dfa1e3353", "comment": "Malware payload (Efimer)", "value": "28255d065e55e13e9953b4b88338fa6f6e201e986f69060dd19c3d8d02725d66", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786884752, "uuid": "589d7904-b79d-4021-8623-c93c2d966144", "comment": "Malware payload (Efimer)", "value": "fa93302641d43f9047dc309a3152420ad2d0cf0f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786884752, "uuid": "8ed77dac-cce2-49c8-a5b7-3e1d5269006e", "comment": "Malware payload (Efimer)", "value": "a37468263e2ee2769c6014f16aca5975907feb229829e5e647fee78d3aa7ef1e60f88110ae102470fb13e72077c14b08", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786884752, "uuid": "d4c0b306-5d4c-4b83-8146-6967e95088d4", "value": "T14EE63388ABD441EADDB3513CFBF246929479B4710372C6CB87B826529E2B0E08D7D713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786884752, "uuid": "9530fa4a-0eb7-41a7-869d-bc502544e671", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786884752, "uuid": "6604e7b5-a935-42c4-b130-e6778fa902f1", "value": "393216:Sq8B4o0X7semHgnVENVz0YyQBXMCHWUjkcuI3/PGTAI:Sqa4oA7q+2z0YrBXMb8xH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786884752, "uuid": "ceaf9508-4d82-48b9-9fc1-a521c189ab46", "value": 14088869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786884752, "uuid": "81abb44a-509a-4821-b404-a6442de59019", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786884752, "uuid": "eeb467da-34cc-4543-b0c9-8f92ec18588a", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2217a6a0-9924-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786851589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786851589, "uuid": "49f2154f-d2a8-44dd-99cb-1f51681188c1", "comment": "Malware payload (ConnectWise)", "value": "bbbdf9dbfe95c55aea146916884effad", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786851589, "uuid": "afd93af5-a841-430e-8fdd-2cb7721fcbda", "comment": "Malware payload (ConnectWise)", "value": "29e7a5cc1f89dc2d20386ad1a25148f0d700b19b8b93f0f721b8fe5efb2366d3", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786851589, "uuid": "d3c3217d-3313-4b79-ac99-41e2978cc649", "comment": "Malware payload (ConnectWise)", "value": "4c04ef71baa5aaa6af3827a5a5cb82b89d818315", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786851589, "uuid": "5bdd3fde-7e0e-4f92-b5ce-645cb92d19f9", "comment": "Malware payload (ConnectWise)", "value": "997c692ec65928a59ab023f85cd9af5fa2a55192a381ef033d785b51a6a3f3aecffe03e48305ae64554fc8f091699743", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786851589, "uuid": "a6d71ee3-4df2-4a6d-985c-1515535ed239", "value": "T1F6A6232063E58466F1B70A3EEE3586F4597A7E25DE12C08F63A4791C6D32E50CA72373", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786851589, "uuid": "932caa38-c63f-4de8-b5e8-e59d81efa25b", "value": "196608:SgHxiFSsYwwSA/OdB+j4xzeeqgHxiFSsYwwSA/OdB+EgHxiFSsYwwSA/OdB+LgHJ:S2xiFxbwpahCn2xiFxbwpaD2xiFxbwpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786851589, "uuid": "14ec2971-14f1-4e61-9767-1e1996a8fd5f", "value": 10227712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786851589, "uuid": "3733958f-3f82-4311-8da0-c522e59cc007", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786851589, "uuid": "6b06c55b-c05c-483a-883e-f4501b20e20f", "value": "29e7a5cc1f89dc2d20386ad1a25148f0d700b19b8b93f0f721b8fe5efb2366d3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d88d5dd-99af-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786911362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911362, "uuid": "55adeea7-ec19-4b9a-b95f-660b76504f9b", "comment": "Malware payload (Mirai)", "value": "6a3d035233962d405eaac77d2fd5b4d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911362, "uuid": "87fce38a-2617-4b08-a918-5a8b3575a3c2", "comment": "Malware payload (Mirai)", "value": "2a471e22899650a2220be4b16f0a4c53d21dee3d7513a7be39f6ac91e05963d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911362, "uuid": "93af26ea-4032-4454-8d9a-c11b8effdfa3", "comment": "Malware payload (Mirai)", "value": "c115db0084ea56e3b271b90d6da0a747a782be05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911362, "uuid": "9bf5bdae-d4c7-4995-8f67-b3d4422dbd67", "comment": "Malware payload (Mirai)", "value": "b10b81f845617c3707a1d0937f4a1cf14d58102749e9a3965d323f63487401464aa7ed253e664777b04bab4a18b898ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911362, "uuid": "8e3e9968-e7fd-44a5-9db4-828110f1e006", "value": "T1A604184F7710DF61C72DC93045B3C79656E926622AE28849F31CDE08AE6534DA82FFE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911362, "uuid": "84de44cb-fc40-4601-94bc-1d50068d5d2e", "value": "3072:wUajbAHBNiiFo+non21tmD5jVNt4X7Hyy1DdjJ:wTABNi8oAon2TEZTSLyoFJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911362, "uuid": "1f9e89a3-a79c-4821-9879-3387a9833b28", "value": 181432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911362, "uuid": "49f7958f-5a7f-49cc-8444-cb0874dc7dcf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911362, "uuid": "01a426af-94a1-4e6d-9551-2c3af1cdfd61", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "316433b6-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901007, "uuid": "a4cce77c-3205-47f4-b23f-c75fa6f2b442", "comment": "Malware payload (Mirai)", "value": "7d80a9e2e693dadacc718ae31bbe79b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901007, "uuid": "3367c38c-073d-4639-848d-2a3f2e3ce773", "comment": "Malware payload (Mirai)", "value": "2cdb92dd94150a468a5f231cdbc37d1243e43b82fbdfecde8cdbd021f2372170", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901007, "uuid": "3e9dbd1c-eac2-4f6d-b52f-60fef87e533e", "comment": "Malware payload (Mirai)", "value": "05c25ab19f2e91d92446885953e3e5dde59aae6a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901007, "uuid": "a959b336-2bfa-4e52-ab5b-02c8deb26a94", "comment": "Malware payload (Mirai)", "value": "8617b26ecba2d51fdd9ef2da38daf8c3ccce9b019ad5ee1c416d5dbd7296ac4199cb604190d1e23b056a9aef09e4b09f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901007, "uuid": "d325e035-a4d9-4810-8c60-498a90094a74", "value": "T1A513E1738507A773CA615079E07C89817B976C78A0AE74678F6285EF61FB805B6D004B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901007, "uuid": "4053a0f0-f716-4ec0-b7df-a622106cd918", "value": "768:SI/dQyco6cxYsVj9ClFglMnYLDhdaa7GhEbjvSqmeGng4PkocXrXVwW9q3UELn4:SI1QA6cxYsVj9EFgenmnahubjv1Gg4Jq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901007, "uuid": "06ce792a-252f-4698-89fd-0c7c7d8b5811", "value": 44768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901007, "uuid": "10f7c578-de82-4ec4-abb4-757ccb4f9a99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901007, "uuid": "dec023f7-07cf-483f-8c40-2e843d578d33", "value": "nz.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c22b404b-990c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786841550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786841550, "uuid": "24b617d3-e257-45d0-9813-2d8d0d861fc6", "comment": "Malware payload (Efimer)", "value": "4cab81b8fa6b59e3b06b3aba29204a21", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786841550, "uuid": "a2f5dbc8-cf1e-4395-a347-d3692d6284ae", "comment": "Malware payload (Efimer)", "value": "2dfe533cdd6c2ea50640338fd3a53ffb5620e82009575bd27aa10be5e7444897", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786841550, "uuid": "ea8bd417-900a-46bf-bc2d-606384b42ac5", "comment": "Malware payload (Efimer)", "value": "a2d100f8c337b073b53f0b34c4b1c22581476178", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786841550, "uuid": "1da17b17-9b37-4c1f-b4bd-6af6021b9a91", "comment": "Malware payload (Efimer)", "value": "72ce2bd9dee4ab5b281b1ca25bf9d3708fbe012a93c640dce908bfbc6fd49d0acfb79319209587bc1426b29f35677f71", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786841550, "uuid": "5dfb4ead-a96f-4642-b8d2-28e3601a51fe", "value": "T1F9E6330CBAE411FED973C03CD9E21592EAB8B9351B36C1DB47E447229E571F08938A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786841550, "uuid": "df0dd892-1243-46e5-b477-561659bdeebe", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786841550, "uuid": "9cd3312d-69f1-4875-90b0-546ba60f60ee", "value": "393216:Y2pLhljlQs3N45EVgb8EH0bPXMCHWUjWcuI3/PGTAI:YOnlj3N43bVH0DXMb8rH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786841550, "uuid": "c3b4169d-8574-464e-b751-af71c3c3e936", "value": 14038081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786841550, "uuid": "ce6fe99f-e4c1-4aef-ad74-76d5fc5ce0ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786841550, "uuid": "b583813e-014b-4783-8121-a9dcfd171b95", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1345a7-997e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786890581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890581, "uuid": "2794d57e-10f0-48e3-bbae-e63a68f964d9", "comment": "Malware payload (Mirai)", "value": "7cf499bb2894e827102d5a04eddabe4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890581, "uuid": "0096b322-4dd9-43c2-bf2a-96a3d642c2c6", "comment": "Malware payload (Mirai)", "value": "2e005307f8370f350d4380dfd497100ba11e8e9656eac2625e09b3083b2f89fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890581, "uuid": "6da67bb8-b3ab-486c-8236-f6a9fe2814eb", "comment": "Malware payload (Mirai)", "value": "b802c82a79cd91cc88ae5d5df774aefbaf377e22", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890581, "uuid": "3c29a2d3-2ba0-4992-9677-36c036665a28", "comment": "Malware payload (Mirai)", "value": "250f23a1b369faf81f34ebbff3021851663c2e8007f98040bbc66bdc133a570a4ba2e81fb60b4ac5fc5f9b954793d3e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890581, "uuid": "0f6f7c7d-3206-45f7-98bc-82227b95bab9", "value": "T113530266CA8A44F5CEC4EF79AC5CD8D127B81F59AB6CADD1F1CAF711830385AC404AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890581, "uuid": "c070b30b-9825-4eac-bb2c-45e2bceeff26", "value": "1536:7ro/qhExWL33CzgqlUyppgSVweIDnSOzf4u+qgw09E:3vxL33QpKSbYSOb4u+qgwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786890581, "uuid": "91888d78-1805-4fb9-bbcd-3125715fc2ae", "value": 65580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786890581, "uuid": "1dc3fbb6-9016-4cbf-9ad2-53729b93a097", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890581, "uuid": "d5d0a057-43a9-461e-9b84-c6154737be6d", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40015282-9939-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786860659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786860659, "uuid": "4299582f-1017-4db9-8060-e1f2b925d628", "comment": "Malware payload", "value": "62a4c34137aaff80270b2110dab1e123", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786860659, "uuid": "ee56ca0e-d86a-499b-922a-e0a2f436d0ff", "comment": "Malware payload", "value": "2e7df93396449d1df7b2b3503209860cd2add9c8b8dafd7fe166e695f6fb822d", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786860659, "uuid": "799e41cd-4f2e-4214-98cb-2aae59e73cd4", "comment": "Malware payload", "value": "47eb76b8d3c20cd9934d5cab0eae1548d76152fc", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786860659, "uuid": "ef0c5e56-58d6-41b5-b865-8ec66b740c66", "comment": "Malware payload", "value": "40bec96bfb18d48b2d4772cf4bbbd9884083497206307127df0ddd7eb3ae72648e0c42a4f6b45ab164e710dacc0e0e85", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786860659, "uuid": "dea2af3b-09fd-454b-8c2f-6d66279acdea", "value": "T1BC15CF0923949B65F97E9736C428411183F6BC16D722D6DB3E4A2AFD3B31B8389D2713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786860659, "uuid": "636ef80e-1445-4d6b-ae14-2ee65e55a4b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786860659, "uuid": "5f553242-7977-458e-9b68-00f9a29bd5d6", "value": "12288:SLlEA2bGCiE1jZQ4KyQyhrkywyV1UuYS8+dk1b2gskBbyi3E:c7ZEjZQHwbHYS8uVWowE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786860659, "uuid": "4651ea79-2f6d-4b49-8027-0cc611da08af", "value": 954536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786860659, "uuid": "b76d0168-483f-49e3-b638-4e90ff7cf413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786860659, "uuid": "47b8886a-89c3-4d3f-adaa-7fb62458e939", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0913b8-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786915118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915118, "uuid": "3b45748c-cc2a-423f-b1af-065404aece32", "comment": "Malware payload (Mirai)", "value": "ce41cb66f5bbda5ffd5b95deebd76e99", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915118, "uuid": "e9ecda34-b5d2-45c8-a873-016b603fab9b", "comment": "Malware payload (Mirai)", "value": "2ed6eab26dc78ccccbbed93d4bbf83a53c63466031c48976ca53968eab7c4694", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915118, "uuid": "085c08ed-5ff4-4394-b571-34a7b0e16ff8", "comment": "Malware payload (Mirai)", "value": "bcaf00fd7caff5ea44acf0d5fb5af5ffbb2b7554", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915118, "uuid": "84136dfd-5f30-4440-a972-766e7fafa513", "comment": "Malware payload (Mirai)", "value": "2a068a207c135513cb0cd02996552925d8b4e3b6673e2e7a70facabe5090a86028686a2e815eb1b1c167160e512a6fed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915118, "uuid": "d20d6ade-c714-46a1-ab04-f77508f228ea", "value": "T193244A02B7690943D2632DF42B3F57D0D39FE49320E4F644790FAA899B729326586DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915118, "uuid": "69d0e228-2b8c-4835-b21e-607f4ec78182", "value": "6144:HGu5R2ulC01yI9BvzCSWn/xc+utILlFN3ZXlssM7khWoCp:zdelDdlssM7khWoCp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915118, "uuid": "46a26439-a8c3-4726-af83-cb9e61b1deaa", "value": 224792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915118, "uuid": "5a9a79fc-7b0e-42de-ab44-f3b08091fea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915118, "uuid": "67e853f9-3920-4607-84cc-22a2ee0a60c5", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f97bdbe9-99ae-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786911221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911221, "uuid": "d670e134-c192-45bd-ac96-5c6e0f3cafd4", "comment": "Malware payload (Mirai)", "value": "e03d3f4245c4dba9cbea2fa5d5a7a86e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911221, "uuid": "437aabef-d4d2-4abb-9cbc-eaca8e5ba682", "comment": "Malware payload (Mirai)", "value": "2f18af00ae5efc8655ad39339c15e565734cef7e127b71f8e50b1e83d2db54cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911221, "uuid": "89353382-de04-4097-91a8-433e4459cd77", "comment": "Malware payload (Mirai)", "value": "72cfe9e4a947063a1dd5871b9a07e744d36c2c29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911221, "uuid": "7ea344af-9dd6-4fa4-87e9-fe023c14c34c", "comment": "Malware payload (Mirai)", "value": "b3a051416249c2dbbadda3631fdd92061539270c14ca7dc67dfe8da30a0c66050c867360e04590191ceb098dcae57959", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911221, "uuid": "63db6186-6648-42e3-ba01-325c1632df77", "value": "T1ED24A55E6E328F7DF278C73447B74B34975D22D626E1D694E1ACD2042E2034E642FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911221, "uuid": "1fa43660-c155-4b0f-88b1-768dfd6c4c6e", "value": "3072:U8EAG3JxlFOsbtERo2sakdfUhXdpesgRPlnFInkBKp8xHQjX0AMBHdb:U8EAG3JxlFPOBsaXNsdnFiT8OD0Agb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911221, "uuid": "747901c9-52ba-4a87-abd8-4dc3762e1687", "value": 224112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911221, "uuid": "f094cfb1-799e-4315-b083-57436bdcefd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911221, "uuid": "99607c24-b1c5-4e6e-8bd1-a8749b8f2d3c", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8bc898-9930-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786856814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786856814, "uuid": "cf2bb9d3-4318-4430-b968-c22bffe70fd7", "comment": "Malware payload", "value": "bb858477742104e6934e63e0f3d19943", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786856814, "uuid": "e0b318b6-9197-4afa-b707-de0c79d8f148", "comment": "Malware payload", "value": "303affdde7018550d6666e167d38a2d3c4fec7053ed3d7c9939ed8986b9978cb", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786856814, "uuid": "f13b6524-574e-4471-ba13-e17a2805457a", "comment": "Malware payload", "value": "ab98aaddf06123aede3b7cb88b76c8907bca965e", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786856814, "uuid": "992a7943-b77f-42c3-9b9e-21f300291edb", "comment": "Malware payload", "value": "c83232153a304487e7d6ddc2a99f58657b74de9f01fc1884d6ad988e7bcc79d715c9b277222b2d2897d33441c5fa48cc", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786856814, "uuid": "cc18f704-45c9-465c-a5b4-c6aa47f85ca3", "value": "T11F062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786856814, "uuid": "26fbec70-a51f-4939-9a11-87d112b78b9d", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786856814, "uuid": "48ba0b4d-8df8-4883-b0a0-d31225747e7f", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnGj:+MIKhlPGj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786856814, "uuid": "9425b3a5-22b5-4c47-aa00-48ba0f7bda92", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786856814, "uuid": "5156d543-be1b-4700-a773-4c3c17ed375a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786856814, "uuid": "ecd4dac3-a4b6-4cb9-af24-8c487dfc229e", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b756ff-9915-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786845344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845344, "uuid": "1f210027-d2cc-4414-bf3b-566a4229d15a", "comment": "Malware payload", "value": "ec68193e9ab5db241649de53c22e28bf", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845344, "uuid": "ba6924e6-2c2d-4d71-ba05-b350376ffbf7", "comment": "Malware payload", "value": "31098d6ed96cce3c4c78dc3880b6c43235bb370cbdf633fa586089ec1dd13247", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845344, "uuid": "8cb65cf9-3c09-4b0b-b0c4-67c0442ba1cc", "comment": "Malware payload", "value": "9d84b5e933908e738620a1fce7900c619812d56f", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845344, "uuid": "a53ad7ee-47de-41d4-bae4-77a78934107a", "comment": "Malware payload", "value": "ff5fe15061956ded3240e4d7180bc9c0731c3e0c0a95509c4d386d129da254b57232962820c454df10ace3ed9a7f7de0", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845344, "uuid": "70c7c71a-4faf-43e3-8d42-d6feccd6ec7c", "value": "T10FE633E63D13B1A2DCE6C5F13239EB4B89830191CA0B706DBA5D3F6A6735D01076972B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845344, "uuid": "0801f390-c751-4ce6-a119-50503074460a", "value": "393216:kbDgNJjnIMn55jNbA0VzhMc3xpRkYql23AJ0Zvc:rfPtbhVNMc3xpRkYqKxNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786845344, "uuid": "451f3a73-9169-493c-87c5-9a06174d41cc", "value": 15056896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786845344, "uuid": "c250237c-e9c7-49be-99b9-25b269422122", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845344, "uuid": "86fb0e11-b5d6-44d8-8a95-b2635516a374", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39367eef-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901020, "uuid": "f177c666-f78e-4a31-a7e1-b378c11a3e12", "comment": "Malware payload (Mirai)", "value": "7258a6467ff5d15830e5ce2e9c236a00", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901020, "uuid": "f8eae2ae-abe2-4979-9d28-a087a7835b38", "comment": "Malware payload (Mirai)", "value": "319d22bb12c6f7100524cd4ec6ed25b8ed89b64e166fbac10023c81c627ec008", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901020, "uuid": "9d180032-e676-45c9-86ca-771679a10557", "comment": "Malware payload (Mirai)", "value": "2842e1c8c312525fe6b749f1a4deb410785a31ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901020, "uuid": "fcc4a1e9-df48-43bb-b3d0-1752605c86e9", "comment": "Malware payload (Mirai)", "value": "dc572a65d3d29e309ccf368872117453d0368a4a2c0fb1b9597e1366a0d7ff562699a57887100449a54217aa6f2fa8d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901020, "uuid": "0182c85b-7035-4f91-9f92-9707b906dece", "value": "T14513E1F727BFDB7CE03B41750AC25644FEB60A17D7628B8748C851BBB6A65485B40383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901020, "uuid": "c8244827-aafe-445e-b3bf-1770c95cc608", "value": "768:/xCamcw1GTi3P/aKbSxUUY63C/kh0LGiX76a+sB6HXGc01hIACBx05L:/xCamcGWCP/DkUUY63iq3d+hIAmAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901020, "uuid": "23e84881-3580-4554-9bdf-942765d1ed3b", "value": 41988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901020, "uuid": "1586bc67-f588-41da-ad38-12f4580afd79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901020, "uuid": "3c07ebfa-c0db-4c17-9b2b-b36797aaa601", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fc3a7b-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900773, "uuid": "adb25136-2808-4535-b438-7896d432f915", "comment": "Malware payload (Mirai)", "value": "43733eb1079a32b1b685d9e050ccbadb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900773, "uuid": "4003b37e-5a2a-4d74-899b-d0861ac396b6", "comment": "Malware payload (Mirai)", "value": "31cd898fd42a6b1dedbb16f3f0a5639d054222e826428c0eaea3125c1de7cf35", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900773, "uuid": "c5db9533-1273-4e53-9457-d801b6a76ecf", "comment": "Malware payload (Mirai)", "value": "a951df36ab59b6d63cb6774418869793642731e7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900773, "uuid": "d5d85106-3ee5-4976-acec-b4d30bdd4cc1", "comment": "Malware payload (Mirai)", "value": "310c0aa73aa70e82ec8946e43e935aaeccafe577801d3118fc76f88ba1a7d1c1a716d6892df4b3ceead5ea6ba36f2cdd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900773, "uuid": "c9522986-fbf4-4a71-ac0f-ac50970b0d11", "value": "T1E1242946AA408F13C4D727B9FB9F42453333AB54D7E763069528ABB43F8779A4F62201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900773, "uuid": "a9ecf7d9-a5dd-496a-bc17-1b25c416834b", "value": "6144:UN8zKKxc/qZkQ4aGTJmtP2orE8/MCrZHtUdM/R5Oa+:UsKKeqZkQ4aaJmtP2orzUynUm/3Oa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900773, "uuid": "45523675-a085-4e26-8e50-04311b2b714a", "value": 214963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900773, "uuid": "54903903-82c7-47a4-831d-7ad660090bd8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900773, "uuid": "17e34c55-b4f7-43f7-9789-1c605d6d556a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "118ad835-99b0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786911691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911691, "uuid": "ad39e91d-f9b1-4f38-98e0-f8ad8069bc1d", "comment": "Malware payload (Mirai)", "value": "903ec5c2072af31a9c67e6263f8cb1b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911691, "uuid": "8e4a45c4-4f07-484a-94f2-418190c81cb1", "comment": "Malware payload (Mirai)", "value": "3207102864582b541a347a125f4eef6655ddfd9e82c62dffe4b344967b756d48", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911691, "uuid": "43b9ed98-5a0f-45b9-a344-cc88e56366a3", "comment": "Malware payload (Mirai)", "value": "f231e1b590d8c91077dbca0ce39e87e8c14deae4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911691, "uuid": "5c507b1f-94f9-45b5-a15f-e732d585b45f", "comment": "Malware payload (Mirai)", "value": "32d474f6965febc40c822b6cfac8bfc7a7bbbec1b4da28b1849ede49c081dedc0449adcb021e6c81fd8d78bf915283f7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911691, "uuid": "ff4bbd45-2db3-459f-b751-40b8f37c29b5", "value": "T14433F2022A07C6F1D3E9487AE93C9B52115A33F0F8A0B236B703666A174CF551FB5F56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911691, "uuid": "d09c9df9-8171-4b92-8859-049ae87f0ee8", "value": "1536:8Ndr3jWJtC5PwhvYdejZNZxVXZ+QmoWl0fw:EPGTYdmZ1V0Q604", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911691, "uuid": "3e539544-2670-431b-b186-a1081ff8a74b", "value": 55080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911691, "uuid": "e18eacc0-085a-4831-807c-5cd33e10e4c7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911691, "uuid": "35a9d138-c566-400a-aa33-1214ba50592b", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "305fdc32-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901005, "uuid": "2bc8a7b8-249b-40b0-84ef-d3d41f4524ad", "comment": "Malware payload (Mirai)", "value": "317d93a1398bf822410ab7b8fed61a39", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901005, "uuid": "e867f5f5-f511-4163-8168-c442c3a162e5", "comment": "Malware payload (Mirai)", "value": "32e2817aa7f00288db24e2641e32ef8fb30aa5557c6391c89c64d18629a7f653", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901005, "uuid": "c827052c-0601-470e-9f2d-492d179fc74c", "comment": "Malware payload (Mirai)", "value": "f0f00942efbb54eee7011448ac18dec3c3a5fd8b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901005, "uuid": "397817f2-2427-4c8c-9c3c-d47530ac2b70", "comment": "Malware payload (Mirai)", "value": "acd9c62bb519257997758f29d1659889323b59155f63a7b4caca0c6f7a6656af784c3415b52c9f98d1cc82e891478059", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901005, "uuid": "ca66a530-4849-4afd-8a05-9afe56874966", "value": "T1B61301CEF769B405C8AE4E3269CC0BE71D80A9A1B2AAD157D73E1C86915F94F70CA40D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901005, "uuid": "11c72490-84b0-4f81-9c36-7791d39bf2fb", "value": "768:Fjnoa8nUFPUvyVxL2+SR0FQqNnN+BJK7VHEEdkut1+ERUq6Z5TbWNa+HhMWHg:Fj98UWviLY0FjL+B2BFjRUBT+BRg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901005, "uuid": "aca97062-c94b-45f0-9ddb-60ee0ee0a37c", "value": 44532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901005, "uuid": "5b02d890-9615-4580-889b-f6ace7a0065a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901005, "uuid": "cd130bf4-884e-40f4-807a-0ac482fbcdc6", "value": "nz.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64b4f8e9-99a6-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786907535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907535, "uuid": "6010064c-006c-4ff0-988c-7af966605d50", "comment": "Malware payload", "value": "aaca0b65abd4d51b5e2f682c766ab6e3", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907535, "uuid": "f56583f4-733e-4d82-ab49-cf7070c6222c", "comment": "Malware payload", "value": "330ccd858cf2ab6adc9dc694331396b0cb555c707d0dbef5d3c7967afb25e8f4", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907535, "uuid": "acdb4749-0ddc-4f5a-bcd1-c3459a238b73", "comment": "Malware payload", "value": "94b3700bdfd18b05603cf96ff161ced72ca653ed", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907535, "uuid": "44bb9de0-bf1c-42e4-bc82-e0c0265c0239", "comment": "Malware payload", "value": "b49ae8556a10ac24dd30ee77d5df54bff7021ca25e6d84fb491c70dc896b04bf052ebd0db3915e7180ca20f4d97ebd4c", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907535, "uuid": "a0b55b76-2bb8-4b75-9c6f-e8c8d83930bf", "value": "T160062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907535, "uuid": "baf8d7c5-19bf-400f-9f8d-75c1d49b45b4", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907535, "uuid": "ab3c68ec-08db-4c08-a4d4-baac8a51e7ff", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnG3:+MIKhlPG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786907535, "uuid": "50aa0483-b859-41e3-afb9-ea4c4d138469", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786907535, "uuid": "9f282c93-f465-459a-ad8b-3ad549f08176", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907535, "uuid": "1a9484f0-b30a-49d2-8687-c8be68cfd82e", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7667779-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900910, "uuid": "8999a28f-ac8a-4a1e-9fa3-1b9d72056461", "comment": "Malware payload (Mirai)", "value": "95d688d54887613af053fa4bd10cba36", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900910, "uuid": "c91135eb-3c35-4a35-9f2c-85fc9a68466f", "comment": "Malware payload (Mirai)", "value": "331a2879b81f98ad754d48239ead7a6fab1543c2596b55bad6972c1c68773449", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900910, "uuid": "e7d0d31a-647e-41d8-a745-df46c4d52e8a", "comment": "Malware payload (Mirai)", "value": "c3071881ddf2a7950c91d5ee302eb646a4dec5fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900910, "uuid": "fc839a3b-3530-4ba3-8030-32acdd1c315a", "comment": "Malware payload (Mirai)", "value": "c64821382adbff110f9bfaa35a10885a0482d9ab1d486329a98d53163f3eea84d471176f0443a2ef8ab5aea6d89df22e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900910, "uuid": "1b7b4898-4d33-45ca-a50c-c1e53425ae46", "value": "T15404B85E6E228F7DF27887704BB34E25975D23D623E0D684D2ACC2105E6029E585FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900910, "uuid": "66d346cd-da85-41ec-8b19-0ee38ced5844", "value": "1536:Q6/7TG0iDtx/4TTSk5eGLQQxULoKzwGbF9OpkilQe62VlEZwThZHTLN6XsgJwjEu:/7aPOedQxUEVGR9apVVlEAT6XLJLu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900910, "uuid": "cbfb2cce-c0a5-4c6e-9d81-551fa80c45c0", "value": 177712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900910, "uuid": "1b7e50fa-cf7c-47c2-8f18-53135045bcfe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900910, "uuid": "94191987-176f-46f3-96bd-1c1c6e8f2fe5", "value": "miron.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed49844-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920222, "uuid": "90c20473-403b-4c04-8ef2-a2adf6e11ebe", "comment": "Malware payload (Mirai)", "value": "02f48936e75ea8b0feb2cc6d0a2b59c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920222, "uuid": "f756808d-cc77-49a0-9414-df9ccd7f3a98", "comment": "Malware payload (Mirai)", "value": "335bf3d222da0b0e4f1493ebc35b68b24e8482a385de4393ac20fe8d1c1ff9f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920222, "uuid": "2dcad1bb-e598-4a15-8ecf-2d06e8813f93", "comment": "Malware payload (Mirai)", "value": "9083f41b0301b669c691b67454a1a7175ab3ad34", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920222, "uuid": "46ad1da2-6854-4388-9fe6-ac3c0f384e98", "comment": "Malware payload (Mirai)", "value": "802c4c50fabd26c8814a9cf2417185279defbb1974f2706fdab79bebad062ab959f80f71f521cfcf0b6f94767dfb608d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920222, "uuid": "f0d4e58f-1a77-4655-afbb-b340d7d681d9", "value": "T1E2D3E146F090EE72D3D4657AFB6F118437031768E2E6330ADE12DA2137A785B4F3A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920222, "uuid": "44d427fb-e568-4f59-b41f-52895c0d859c", "value": "3072:foTTImvmBw3z42JM6xKXjuIzmmAVPRyD3VOmVDxaDASp:fgIwWw3z4z6xtpVPRy7V5lan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920222, "uuid": "7b35b47d-d349-4184-9921-e5fcd1aefaa1", "value": 142115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920222, "uuid": "5c833117-43d8-4bc9-99e1-217f0c6a2ceb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920222, "uuid": "88f6959e-e8af-434b-9e2f-b537f4fbc2ac", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "460ff870-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786901471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901471, "uuid": "41bcf63c-5aa1-4228-a9c7-592dc65918f9", "comment": "Malware payload (Vidar)", "value": "657deb3560ac8fe975e76233e3d21e01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901471, "uuid": "03d8c929-f516-424e-a60c-082a7412b810", "comment": "Malware payload (Vidar)", "value": "33da4bccea193c23eacc46b21a800089e7fb4ec69a6ea393dc3bc52f7fb93849", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901471, "uuid": "8854a003-ce02-4238-8227-976f67d74ca8", "comment": "Malware payload (Vidar)", "value": "7df4584781cd8af6eebb1ace20fe630997ad26ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901471, "uuid": "21e63213-8e96-4c03-b62c-22fa48276ea6", "comment": "Malware payload (Vidar)", "value": "8ae559a6935a73f7590aa831aa0cdfe6ad5d421cd05e3c58008b5361a802f6c4396b4ae99f870844c04b462f9f0c5502", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901471, "uuid": "ef4e6017-d3fd-4062-a83a-b5bb3a764f05", "value": "T167467B176A5548EAD0E9D731C9B7521ABA74BC0D8B3033D32E616E782F723C1AE75B40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901471, "uuid": "c79dbe99-df95-4f1c-a803-c63027b62832", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901471, "uuid": "438923e7-ef01-4e16-bdda-bbc643a3e212", "value": "49152:/TogiGJmcBzBaVkWoy5z68q4V/RjQHWUdcJhRRnZRat4UPH8TnnMg9p9/k1j:/2uaXJUdcJhRJZRUlHgnnM+pV2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901471, "uuid": "1ac2c8e2-50a7-4d7d-8831-8b36bc8b01d7", "value": 5514600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901471, "uuid": "4bb15dd3-bdba-41b5-ada3-acc9258e7d17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901471, "uuid": "8f3a9e4f-d567-4160-bb3e-5efe503d7793", "value": "33da4bccea193c23eacc46b21a800089e7fb4ec69a6ea393dc3bc52f7fb93849.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf91315e-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900843, "uuid": "b8346885-1d59-445d-b279-92de1ebd98a6", "comment": "Malware payload (Mirai)", "value": "77296cb3d632c35e397cb40bdef8a1b3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900843, "uuid": "2ee081f9-c105-434b-b0ed-af18d8c0205a", "comment": "Malware payload (Mirai)", "value": "341005869a492bce0269482759ecef45877aea2a40bb2f0bc0c4fa12847eff02", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900843, "uuid": "5765b39b-4718-4e50-b871-916cebc8c569", "comment": "Malware payload (Mirai)", "value": "7ddfc9af1b50193d46beaec9cafa8cdd3dc414e9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900843, "uuid": "175c6878-c2f8-4c1a-b078-410e76a4edec", "comment": "Malware payload (Mirai)", "value": "d8008a47bc30dadfcbd858138bbd6d59463656cd66b0d10faef662fe24c226f1c04215f09c3a6b466f3c39685730ebd1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900843, "uuid": "4530bf8e-450c-47cf-a963-12f8e658a6fd", "value": "T1ABE328C7F800DDBAF41EE77688170509B130B7A109926B377257792BED3E1A91463F8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900843, "uuid": "551b3bbc-0719-4417-8c78-2ae9bcc548d7", "value": "3072:oxmk6JN5TP/PBxgGLKyImbrh/VsjbitLMdwy7MJocf:zrZxgGmyprhhLny709f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900843, "uuid": "a8dc9099-62f5-4c6b-a041-dc67487c381b", "value": 152960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900843, "uuid": "6e9c0e3f-e0c3-40f0-8f39-034467b16ced", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900843, "uuid": "f7a565ea-6eff-43b4-979e-3d84f97ce4f5", "value": "miron.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a483fddd-9920-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786850090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786850090, "uuid": "a58b076a-b00f-4f2f-a978-805b0dbdea18", "comment": "Malware payload", "value": "307fe3eabd0da3f7324824a5ca30c66a", "object_relation": "md5", "Tag": [ { "name": "974b6b4ed30ddaa4b6f4ec27976e52d8", "colour": "#BF9C50", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786850090, "uuid": "86272bd1-efda-4ead-a9ba-cafdb0270c30", "comment": "Malware payload", "value": "346b1b33d90911bc0e5a00f4bed37e1f648d94bd7e0466a5acc4d853904f68e1", "object_relation": "sha256", "Tag": [ { "name": "974b6b4ed30ddaa4b6f4ec27976e52d8", "colour": "#BF9C50", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786850090, "uuid": "9f3dfe4a-0509-4d4e-bb1c-05668b5fd292", "comment": "Malware payload", "value": "42f86feda4100401f78f0d5677b178168b767a41", "object_relation": "sha1", "Tag": [ { "name": "974b6b4ed30ddaa4b6f4ec27976e52d8", "colour": "#BF9C50", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786850090, "uuid": "8276bc50-0c44-4d38-9d1a-87222f96c6a3", "comment": "Malware payload", "value": "09db52cfe7daeba2281ece708eb38443190add7bb5ad2032f30ddd4c465cef3f0390d592841475efc5cfa5b317288c78", "object_relation": "sha3-384", "Tag": [ { "name": "974b6b4ed30ddaa4b6f4ec27976e52d8", "colour": "#BF9C50", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786850090, "uuid": "1ba01610-82ed-4ebe-b8c3-17e23f3b5b9d", "value": "T139750253EFA202F4C0A3993852BE6617E238380E87199DFBB7CD15903F2575859B9B1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786850090, "uuid": "39205657-1da2-4af1-bb26-c6f5664579f1", "value": "de85a398477c39117ee5fd3f2278b959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786850090, "uuid": "bd55ee94-f975-4b13-a2e2-1caf2af0405d", "value": "49152:TN7nKCgG5xJDW7Ph1OqiPjB01p+TBgUCqBXVCQ:dKqR4OqafT2EVCQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786850090, "uuid": "bbbb3b7a-4e6b-4def-81ae-7a471b43d907", "value": 1661440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786850090, "uuid": "1ae6ba87-00c8-422f-84d2-efa5723004f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786850090, "uuid": "e40115aa-840f-418c-a4e1-2e7450739e34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308d37b5-99a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786906159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906159, "uuid": "b95c366a-4cc1-49aa-86ad-565b6fc700e8", "comment": "Malware payload (Vidar)", "value": "5522dec6fccdcd6ea1f1b9e10916aba4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906159, "uuid": "126969f4-2b4d-4dbc-a7eb-226a6425164f", "comment": "Malware payload (Vidar)", "value": "34af595bccb56073e4067cd1bb0546fafd61a0f2e2cbb3a4bad1a002b2a011d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906159, "uuid": "67e4e325-77ff-4ddd-8dc0-f2e4cf11334e", "comment": "Malware payload (Vidar)", "value": "69d0ae1273d8ec0d052289aecc381174a6e81ab0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906159, "uuid": "80d12f62-db7c-4f8f-8231-33203f34153a", "comment": "Malware payload (Vidar)", "value": "a26de209aaa839fd4c83ae7f9f7090831e6d3dc3cd70c603dab64e74020d124bafa0b46ddca9b7c395427cf3d3074064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906159, "uuid": "a4b53ed8-f1b4-4d88-acec-ff1b70a456a0", "value": "T1CDF59C4B7CA048E9C4AEA33289675251B730BC498B3633D72E50BB392F727D19D36B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906159, "uuid": "78e8cac5-e976-4b03-a230-8b30003dfc9f", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906159, "uuid": "528f2b66-8422-4a1d-b657-ba97eb4c1c47", "value": "49152:MfbzNS33O3mF8/5n7qj1Gd9vD0OmYy063p9aocif24rUlhhYaq5ek7hBd5:MVae7w4gaocQrqq5P3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786906159, "uuid": "51cdbb6b-c914-4c9c-8b02-0a5862710f8f", "value": 3342704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786906159, "uuid": "ab458da8-fc00-4b00-83ef-bdff4a2271f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906159, "uuid": "e45a623a-5ace-47d2-8103-5db2ec22b01a", "value": "34af595bccb56073e4067cd1bb0546fafd61a0f2e2cbb3a4bad1a002b2a011d8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c818ba-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901014, "uuid": "3c23e760-fed4-40bf-9eb7-27810aa65e37", "comment": "Malware payload (Mirai)", "value": "d65e473ba1242b9169ff600f1cb2f9d7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901014, "uuid": "ef8adcd6-aadb-416e-a254-500c8343f5f3", "comment": "Malware payload (Mirai)", "value": "353d1e5958c4f1c0162fbe374f668b88f863196d884e634683040471952a7f50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901014, "uuid": "6655c672-db13-4dc3-97ff-b060a339a9d0", "comment": "Malware payload (Mirai)", "value": "893b82bd0fc90ae80211e7128bb25b451deb4b63", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901014, "uuid": "6ec062f8-3af4-48d6-ab69-f1c2f36101cf", "comment": "Malware payload (Mirai)", "value": "22fc721199721701e63dcbe38c118706b68e7deacf4ab71fcf533824163671006809c50b24dff4836da5c2f5a9a4d410", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901014, "uuid": "bdb393d9-582a-475e-931d-f3219aa13cb4", "value": "T19E6302B1B83872F04B10183DF1E0CAC3A6959F795EAB0166131A77B451E270D2FF59AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901014, "uuid": "3d67d4fc-0121-49c8-8dee-5bbb120709af", "value": "1536:hdEhCQZ+SjLeUsuIUeWKAGqu+b+OL8B9PLVq1xqA:yCQQSmBU+ErbBLKuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901014, "uuid": "b37b0578-75b3-4880-acbc-8fb089708e86", "value": 67396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901014, "uuid": "7bbc9a99-654c-4f88-91f2-3ae886686a47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901014, "uuid": "182229d8-aa46-4a35-9961-af7ed34ae03f", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9d4c31-997b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786888919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888919, "uuid": "e9d4e3b7-94fc-4bf5-8dd8-a40db082d7ca", "comment": "Malware payload (Mirai)", "value": "6fbc2255038f00d1d177ce023156e457", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888919, "uuid": "f166bcda-fb15-4683-9bef-3d9ab6e1b762", "comment": "Malware payload (Mirai)", "value": "35ee0aa00646fedaf7dd77f51b9732cc2c5c2fc7a1bcb26c6ab699a3adf90ed8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888919, "uuid": "67acafb7-49f1-4c5d-82c3-77eadefc35a5", "comment": "Malware payload (Mirai)", "value": "41aa60b71e2c3bca984c68139a405dde8a323cc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888919, "uuid": "17049a88-5b3d-4baf-9f28-fcee42af56af", "comment": "Malware payload (Mirai)", "value": "2c6723fc7ce5ce5b2754cc14e1da0475ff03fc3bf07f5860b7c3b3359c8039a353bac898e3658c45c21a9b1fa770d360", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888919, "uuid": "2407b530-597c-4b79-999c-7d2a1caa6190", "value": "T10DF34B01B70D0943E2632EF4373B27D1D3DED9A124F4E784291FAA8992B6D325586DCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888919, "uuid": "069ee08d-a1db-497c-bffd-7eda84bfee33", "value": "1536:VF2nQbQopGyqZgrxGfTxVobeAUsLY8Ocus3FWxN1SGFFn5MnMZgquvAbpSkb03dD:/2o9GykSxhRz+SGXnvZxbOBH/Cc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786888919, "uuid": "89cb1fbc-5df7-46e2-a695-e29192427ad3", "value": 170780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786888919, "uuid": "b2089e41-d4c9-4efe-93ca-2d3fe2a23deb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888919, "uuid": "54d9e62d-2b9d-4623-bdaa-6e1a717a62e4", "value": "9184d5f43df1e46d3c44d8020b1cb2d6d40c9a89c90440884abd5b49cfc9ee05.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31aead2c-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901007, "uuid": "0580022b-3d51-4b6c-81c6-cfde22370747", "comment": "Malware payload (Mirai)", "value": "8745f8949b655485d23bc08ca773d7f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901007, "uuid": "6fbbcefc-ebf3-4caf-875d-92040e02a2ab", "comment": "Malware payload (Mirai)", "value": "36354f7f2724edfade129d3e1cd1dcd577b5c7e682ec3c05f3dd1be6890b7979", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901007, "uuid": "72a9c615-5c11-46fa-9340-5818d4298abd", "comment": "Malware payload (Mirai)", "value": "9bb514b5688ab59997010b310526438253be7ba0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901007, "uuid": "4618038a-e11d-4f95-a24c-0d5e4bb80f39", "comment": "Malware payload (Mirai)", "value": "0cc74ad8dcdb4082e7f11a49e59e912fad98abe62d436bdafbb747b185cb2f976e3d7ebade2afe2badc522b207561b62", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901007, "uuid": "6969fb07-439b-4449-9f3b-3d4d45ac60ac", "value": "T12903E0B691F8AF54E43EA73509DE24070E60D66F41E9D8B2D2C4189B3A89B71691C782", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901007, "uuid": "61b198ad-2306-48b3-8bbd-72b4a068e7f3", "value": "768:4pOvrpTtgjULjsPz4/LbNr7Zn0Lnakvlqn1NJWcQ5AO3VSA0aocKwnbcuyD7UHQE:3pTtBUL4/3pt4akwnljQnlW0nouy8Hyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901007, "uuid": "efa6b22e-85b8-474d-bea8-a48a1064b09c", "value": 41304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901007, "uuid": "08224773-79db-4ac8-97bd-33941deda84a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901007, "uuid": "6255874c-76c3-4e36-964a-c2e84504cca8", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb267860-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900916, "uuid": "262b3c4c-5940-4648-8bd0-e148ce1a9bf3", "comment": "Malware payload (Mirai)", "value": "66ba40bb5a59630fd5070266a8d4f9c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900916, "uuid": "5b416602-b065-4165-a27f-8f579a317530", "comment": "Malware payload (Mirai)", "value": "39a8c824ff333bebebfd1f88b2746aed20e2153828d3e0744bd9c9cec996eee8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900916, "uuid": "023a38af-8857-432a-93e5-a3e74e51fe27", "comment": "Malware payload (Mirai)", "value": "a681df1655cdc7a908e6a5614c1b03f5f79dc953", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900916, "uuid": "6788cc39-9327-45b7-9749-8106fef9e292", "comment": "Malware payload (Mirai)", "value": "c2cafa2f353222ceac440399ae5d591cc35100517080acdd06c0fad5d8963a7c06a48fc2b92a84218e578ae5f5254dde", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900916, "uuid": "b00018e6-cc6a-4468-a9cb-4d011110d695", "value": "T16FD30A4ABC818B13C6E161B7FB4E428D772B0768D3EA71039D196F25375B8970E3B252", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900916, "uuid": "93f8e550-ec6b-41a0-b184-2374a8e52518", "value": "3072:XpgjL63UJJvmD7o4XcKeBPRxkFKO/SPA:+je3UJJvy84XJeBJ64O/YA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900916, "uuid": "58ff25df-e97d-45dd-94a0-b57acdffc679", "value": 138080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900916, "uuid": "2a26588b-7d72-4992-a679-d528ee944bb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900916, "uuid": "0d66da0f-c712-4c94-b166-5ef2f067fc85", "value": "miron.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36745c40-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901445, "uuid": "205d001e-8e9b-490a-b386-1a2ccf5223a0", "comment": "Malware payload (Mirai)", "value": "c6b7aaa7d3e45b08c8072a90315b8d88", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901445, "uuid": "5497e6de-b135-4bd3-8108-a1b65f1f5a99", "comment": "Malware payload (Mirai)", "value": "39f9dc4520e018356d2b6678d248f5c7b8c70449bc356a6e86cd243ccc0adc1d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901445, "uuid": "497eb994-3f19-42ce-81a3-deb0a1182acc", "comment": "Malware payload (Mirai)", "value": "592167596568a96a4de464c86b40af5c4a202bbf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901445, "uuid": "c3bca8a6-2fdb-41f8-9b2f-db0063c09fe6", "comment": "Malware payload (Mirai)", "value": "f169e15b8b3b18e8833a4ed0eb0c5ec75fecb4066827b7083ac928481fc0c56087d9d77e24e6ffe929b3176f14689386", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901445, "uuid": "17b8b642-40c5-4803-8314-d3adb0fe6cfd", "value": "T1D6D33A2275791E2BC4E4A87E22F74761F1F157DA25A8C90E7EB20D4FFF212206507AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901445, "uuid": "9c91b8b5-0098-41cb-aa9d-a625ccf0a914", "value": "3072:nZUlV+Fawd99IVWFjKc7RgyROFe30Hi09lshKwah:ZUH+FD99IVWFtZOgEmhPah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901445, "uuid": "29d3ff08-e1db-4218-aacf-3d1f97d26ebf", "value": 140776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901445, "uuid": "b6a74a86-623e-4b2a-9486-210f2c278ece", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901445, "uuid": "7b7cc550-bbd6-4b1a-85f6-8c525036b9c7", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abce3c60-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786870288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870288, "uuid": "6c5cecd2-6eae-4a6d-abab-5ed2fae06a05", "comment": "Malware payload", "value": "75fcd2d1af9841a724b1d1f2843215f4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870288, "uuid": "ef00a98b-a6d9-4eaf-a018-898ce95d1e3b", "comment": "Malware payload", "value": "3a4c77e9d25f71cab7a1029b3ec99f6173b3df33f9a104d75b899fecde3aac82", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870288, "uuid": "70b89297-75bd-4a96-996d-6d4297135456", "comment": "Malware payload", "value": "697dd2c2c2d690cc982968b66cd772f0e0cb0b6a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870288, "uuid": "80e49fda-9b6a-4864-b3ee-0b49d0f27793", "comment": "Malware payload", "value": "da7b3f0050cba0a51acb104b43b4585ef0f558171a11e9459c8fce6e1329d6e44771d43a826702c63ac1461babaa690c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870288, "uuid": "fd0c6760-1b1b-45ca-a11a-01fa0b8d16ae", "value": "T1F9B2E50FA32744EDC94AD47881FB9636AA72BC0849B12B3E4324EB711E95B643D3DB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870288, "uuid": "b6598269-4613-4d8b-8b4a-827fb3cc00da", "value": "5bcfd99140b04a4b24c742176fff15d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870288, "uuid": "3e07dffc-f906-4150-8776-721a9bc968cb", "value": "384:npUlGj9idaq1eln4n1RjlcNRHBx4ykdPh86cnRJCVUh:npnjm1el4Hg5jkQg2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870288, "uuid": "13bd14e9-49ee-46ac-bacf-f58bc3e6c8fb", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870288, "uuid": "52c71a51-7393-47fa-8e66-86a2ce128c80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870288, "uuid": "267c6621-3bcc-4e30-b92a-03690c3b330f", "value": "18cb7ca62cfb04e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f844989-99a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786906158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906158, "uuid": "c734b413-34ca-413c-b4af-a6467a203bf5", "comment": "Malware payload (Vidar)", "value": "d70224c4b0cfe885779e3471c60a5d2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906158, "uuid": "de4bb0d2-476b-44ac-b2d0-50ff85a1eb91", "comment": "Malware payload (Vidar)", "value": "3ae4781bb915a4c4801ee0452937feb552aed7e287e61201547e94e486ae1ed4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906158, "uuid": "0b088bbe-1c3c-46fe-997b-9f61938fb6fe", "comment": "Malware payload (Vidar)", "value": "6ad442adfef2e87984fd3d1cfed197e2b5cad970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906158, "uuid": "b13131c6-6cd0-42a4-9c99-149c6d9af911", "comment": "Malware payload (Vidar)", "value": "dd5a859e92492484d95eecafa3a808a76d2f27644be016ea614dd5473cdebcc9dac2d2d752c01aba59a5a36d5a1f22d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906158, "uuid": "a3db4a21-abbf-4fd7-a7e8-cf8b601f5356", "value": "T103F59D0F7C9049FAC46EA73188A66291BB75BC494B3173D72E60B6382E727D09D35F60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906158, "uuid": "3b32f62d-900d-4227-b951-a33feae6a034", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906158, "uuid": "1a19dee5-7ef4-4f44-9ba5-467ec8fec62f", "value": "49152:G4w4tDSBQBWaCT5+6KKqKadBdtqlmEmUhG7jfkEVFeRg4bdgOGq7Lp:GyS/+tycffkV5Gq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786906158, "uuid": "44e5277b-9439-4e0c-ad40-5992a07aed0f", "value": 3338080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786906158, "uuid": "9fd2efac-7c6b-4efa-8e20-334a0f4e7010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906158, "uuid": "3e33ad98-b6cb-4b76-8066-030ce8b91706", "value": "3ae4781bb915a4c4801ee0452937feb552aed7e287e61201547e94e486ae1ed4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dff70c5-9931-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786857380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786857380, "uuid": "c0e81002-8979-46e8-be2b-6c7bc380856d", "comment": "Malware payload", "value": "6b3c2fcfd66aff4b408dfe7bef500204", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786857380, "uuid": "835b49d4-c5af-4c80-94bd-683280ad2fab", "comment": "Malware payload", "value": "3b7bfdf290cd3e8a16b6398f9cb4539af0ce319dd98a0d75a4f593ff4adfe495", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786857380, "uuid": "2868cb95-0d15-49c7-a8b6-54c81e8b7f31", "comment": "Malware payload", "value": "df9d8787145c023ee5e73723e2c0b218c0f5258f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786857380, "uuid": "1055fe2c-3b0e-4bfa-be97-65e8ff11bfb9", "comment": "Malware payload", "value": "66d15b8db535b6ab1721045668e4efd38ad204584b7b3b1d49c527d80b0ebf1af5b0d8d453d11f37910eb2b37257605b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786857380, "uuid": "42a38813-5922-466c-8490-9d0b6400b33c", "value": "T1F96633902A9CD196EA23597B95CC5FCEF9270E823C8536020B4F34DDBA06CCB6D39D52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786857380, "uuid": "cc9604f8-80c0-4118-a9c6-2e592715da89", "value": "196608:ypetMjo0uSmQu+zw/CDzMifOO4rZpeGbvXJqn+T5TfkDwD/nIVxZJ:yDDNmQuSDzfGZZVvaU54mOxv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786857380, "uuid": "27f7570c-2c06-4121-acb0-ab502d812269", "value": 7091331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786857380, "uuid": "ffc75f28-5e10-4a64-9186-a5ad09147c6b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786857380, "uuid": "6a38c6b4-5656-43bb-8f19-d823ca36a092", "value": "3b7bfdf290cd3e8a16b6398f9cb4539af0ce319dd98a0d75a4f593ff4adfe495.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a655a758-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900773, "uuid": "1b127d45-19b4-4bef-b4ee-ed895ef066f6", "comment": "Malware payload (Mirai)", "value": "7c3468bc1c248743d72a3be019c9a90d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900773, "uuid": "15015d0e-5f61-4486-9736-576d53c2eb2a", "comment": "Malware payload (Mirai)", "value": "3b841f3073ae24f2a1eb1bcb26691fb611e24ff0a362e6359cfbc6dd72293f90", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900773, "uuid": "cc7d8313-94d2-4729-a936-00494836acd5", "comment": "Malware payload (Mirai)", "value": "b44ec8050708bfc820a0a111c9940a2c163a5236", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900773, "uuid": "1c6eeede-3be3-4d9c-838a-66b38d847ca1", "comment": "Malware payload (Mirai)", "value": "442e2bccf5a0f36b8a89c6f18913dc30069da49bc7d67c40ed86bfd27f7202c910f4423977ae72f175df36d5bc40edf2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900773, "uuid": "da6250bb-ef09-43d1-87b0-523ec9b441e9", "value": "T11014A51E6E228F7EF66CC73047B74A34976923D627E1D644E2ACD1105F2039E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900773, "uuid": "5d90928a-a669-4d6e-8d80-f44c2ab52f19", "value": "3072:YQNt+UHUyLXRwpin7QXb4Q+lUYGok5sxWpD3a9:YQvHUaXRwpiCM7ly5bpDq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900773, "uuid": "f866a243-5f18-4bcf-82cd-e5005869aaa9", "value": 203448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900773, "uuid": "3ba93497-2879-46e6-af18-61058ad04bec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900773, "uuid": "9434f2a0-9180-4d30-a626-b6b31ea9b75b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e76f5982-99af-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786911620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911620, "uuid": "b2206555-5149-447b-a8e7-18c6011c5431", "comment": "Malware payload (Vidar)", "value": "574315a7d046a1836e1405bfad3012bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911620, "uuid": "adfef707-90fb-4bf5-87cd-6ab2ec17236a", "comment": "Malware payload (Vidar)", "value": "3ce0a3189dc2d698ee3fa5169cd8e6ca0a208920874c85162238709d0463fba2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911620, "uuid": "963e4729-3461-4941-b7a0-a5d3d7ce8fc7", "comment": "Malware payload (Vidar)", "value": "57578f4b8c2808d1448414ae8b2ed918ff8d21f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911620, "uuid": "8f7201ca-5ea4-4b23-8cb6-570c10db4cf2", "comment": "Malware payload (Vidar)", "value": "0ec84dacc4905e5699dde27e59edb8e810bed4789379c89defe9f35d6a895256a3b3051d32702fcd7310d7fde855928c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911620, "uuid": "361e02f5-1e1a-4ce4-8885-17fa9bfa7981", "value": "T13F26AE07BE9248A4C099973584B642127B38FC4E8B3663E72E50BA753F733C15E79B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911620, "uuid": "00925a0e-622d-4523-99fd-3ee1fd07dfb6", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911620, "uuid": "3eff38bc-395e-439b-ac60-799e8ca9a833", "value": "49152:UZqAQqDAk2b5Edh544p3P2AKhMRWUFeCEer0EAa5hzjGdmYx6u4z:UZ4M3eZPOEeIvaDzKn14z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911620, "uuid": "f9d67a4a-4809-44ff-b7f9-2c9617da0b45", "value": 4671464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911620, "uuid": "9a16eb3e-b311-4b36-a4f6-37e60fa43663", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911620, "uuid": "489ebd53-3f2e-4d13-a35d-5ae4b66e014d", "value": "3ce0a3189dc2d698ee3fa5169cd8e6ca0a208920874c85162238709d0463fba2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18aeb7c0-9910-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786842983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842983, "uuid": "ea312866-fff3-4e42-b296-59ec284d0e12", "comment": "Malware payload", "value": "7a17f28ebf42977baedda23165888b69", "object_relation": "md5", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842983, "uuid": "5314bd35-0e75-40b0-9b10-40df0ac46cbb", "comment": "Malware payload", "value": "3ed7f672f3f3f0710bce5be789cf707c21e64ec24fc6ebe6f2153d462f287a71", "object_relation": "sha256", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842983, "uuid": "655c686f-a231-4b3b-be1b-970e1935223a", "comment": "Malware payload", "value": "711612fb87fcc226cce168ef2d1928663ad50ab5", "object_relation": "sha1", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842983, "uuid": "5b158dae-c940-44f5-91de-a5f5a27c37e7", "comment": "Malware payload", "value": "9eed55b6dc78a1f788e459b6fe8ec1dd393e6f383b1eff39a35d75b6cfb36364205928983802a7a779c1035b7ab53695", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842983, "uuid": "c2c8fc84-03c7-4627-addd-3c2f0bdc4076", "value": "T1DC061204EB5435AAFC729274CEB38AE1DE31380A036196EB1BD4755B1EFB1D1CB2A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842983, "uuid": "db695034-c2a7-493f-9522-88c482800a9b", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842983, "uuid": "a80a3668-e621-4dc4-99da-8464d847f444", "value": "98304:rKAfOh0Z0a5lpJqP5SNinafI9GLJ6riazFTdbvum8AD:rHqlEz0hSUUCRi6fbvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786842983, "uuid": "cf37b301-d700-4ce0-b1a0-d908ff737227", "value": 3995444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786842983, "uuid": "00408145-fccc-4119-93fb-cee40966d90b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842983, "uuid": "dfd8b0d1-5db0-4e79-8b7f-a79c2fe946f5", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb90b438-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786870422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870422, "uuid": "87c93906-047b-4977-85b3-48aadf4fb0f2", "comment": "Malware payload", "value": "13eab7f5e60720f14fbbaeaf60ce80bb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870422, "uuid": "dd730f37-7a55-4d12-b4f2-7e599d7f4a8e", "comment": "Malware payload", "value": "3f097e2a0b9d1467ebf4a6ffdccda55a2f90857863e4aa83aae9be3e5fe5fb8f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870422, "uuid": "755d49e3-5eb9-4dcb-afd9-73cb91e55cb1", "comment": "Malware payload", "value": "2f80b44341ac4d79d9c576d6c452432e21c8b16b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870422, "uuid": "9d52323c-c8e6-46fb-951b-759965f56d82", "comment": "Malware payload", "value": "8261a7fc8088e05d6fed9b601c72b58a45cf540a342eabb2a8c681a060b3564748d20329bae3dbe273be86fe4880459a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870422, "uuid": "0f8abda9-5977-4b83-8763-3c5d334c7f90", "value": "T16B940659F880DB6186C539BAFB5D46AC730707B9D3EA71058E254B3037EB86B0F3A601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870422, "uuid": "3dee3cee-b9e7-4727-9b6f-977372c98b74", "value": "6144:2E9BBcL28noUlu2pAcJYXG2BxBKDfamOTgZ9RI+iLu9fyhapJ54XHv1DLh2xOWKu:V9BqL2Md3AsGmtOyRIRkVr4NoOWPVgPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870422, "uuid": "c659db2e-f3c4-4794-9346-52a877e88ac6", "value": 419920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870422, "uuid": "0d366ac3-2552-43df-bd51-944d316ce0c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870422, "uuid": "c49d65f5-2b8f-4a95-9104-b84efeafde3f", "value": "Mddos.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0de643-9994-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786899847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899847, "uuid": "6a7a5c1b-3c36-4a82-ac7d-26900192bf1a", "comment": "Malware payload", "value": "8979c190522895456ff0e479540bce9a", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899847, "uuid": "1b5d8091-46bc-4e2c-8f18-2431df96f882", "comment": "Malware payload", "value": "3f7ae0c318f1d859cd3a18f1cfa251f9ca632507ff67d02858a6110072d88b79", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899847, "uuid": "92746756-02ef-4df1-ac00-1cf58b6d7747", "comment": "Malware payload", "value": "b4f0a618ef251f2e556a7b1d4e01a1c780919f6b", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899847, "uuid": "0f23f30f-dca5-4c0e-be9c-26be16353e99", "comment": "Malware payload", "value": "e9592f5d71b397d5125764deb3f8a5b2023f142a7b479139f030fdf850355c5327935920dd6718cfe03fd51462b962c9", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899847, "uuid": "40f9522d-77bc-4720-b1e4-710d2b518278", "value": "T1E20833E62A30DA7ADD50E13FF72E6B09AA2D407846D0265ED1F4148EA176D44F33837E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899847, "uuid": "d5c4a89d-ea8d-4d55-8d3e-b0f4003b67d7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899847, "uuid": "01c5d58b-02d7-4c5e-85b2-bc0807d2e8ce", "value": "1572864:dejOYfNG0x2LOLAl/jNEmFgK8BRYC7BP+v5bIkmK5eexezgEyG27:d4M0xAIAsmYPYCt+v5bFezvX27", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786899847, "uuid": "9a74789a-4fad-430b-829a-da4776576141", "value": 81679005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786899847, "uuid": "5bc81e5c-d05d-4274-892a-142b526355ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899847, "uuid": "5ab3f88c-ee24-43a2-8a51-654a20b93977", "value": "WatchTogethers.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ec8878-99ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909819, "uuid": "b7e4cf9e-581d-4063-8a79-601da439c585", "comment": "Malware payload (Mirai)", "value": "fda0517552d3d764542c18983bb7344f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909819, "uuid": "6aad5e5b-c516-4898-a691-142deb4430c5", "comment": "Malware payload (Mirai)", "value": "3f9f5987c3fd5e439f221faf0ef80009853e3ff4b366494b228de56f78e89cf1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909819, "uuid": "6b9f7ebc-b85f-4b8b-8341-a243ec3ae93f", "comment": "Malware payload (Mirai)", "value": "a7d0075555d501b3a6cd0c17726a3ca2dd248279", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909819, "uuid": "394bafd1-0af6-4faf-acb7-e4280a17d820", "comment": "Malware payload (Mirai)", "value": "00274966e9fb31d998462043ba6d26f39dfe4fb1344839af88f9fce280ab2b6f7f20fdc4be2d6f3d6e301c00135f6a63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909819, "uuid": "e58d64f7-63b7-4211-9c75-592e7d55888a", "value": "T13573021FE1D5621BCD2EADBD7C850BB53DC9900B22E97F75062D46CC733A8263A0626D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909819, "uuid": "73077b1d-b03c-4878-9d6c-3510e96569bf", "value": "1536:7DhnMnYUcpcvr3a70XuT/vZAJ3m1JphOYRMGwWQ9R7yxYfR9j:N9ncvjQas+tm1jhMGw/3/Rd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909819, "uuid": "3d7552a2-964b-4d4c-947c-9c3bcf4e52e5", "value": 74112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909819, "uuid": "03f80641-61a4-414b-9d3b-9bb0a5d84a02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909819, "uuid": "7abc1901-67af-4a93-b743-1ae22d75019a", "value": "3f9f5987c3fd5e439f221faf0ef80009853e3ff4b366494b228de56f78e89cf1.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e54a78-99aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909415, "uuid": "29ccb75b-c424-4cd9-8705-1de16e97ed43", "comment": "Malware payload (Mirai)", "value": "a722e47032b8b0beab067ad018205604", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909415, "uuid": "58f16d78-428b-4b78-bcf2-89f4fef54b9b", "comment": "Malware payload (Mirai)", "value": "3ffadff09762937c5ec1d4e28f3e7d793ce4f68f6d533677d1882a237fce2d2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909415, "uuid": "c915c271-e3f3-40ba-964a-7fbfb7a51c4c", "comment": "Malware payload (Mirai)", "value": "4ecf76dd973991b7db26455bb5b4d35a0b364ae7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909415, "uuid": "2cb59f71-9d7b-4984-b6f4-05a01a07dd74", "comment": "Malware payload (Mirai)", "value": "31c50dc70141ea110bf62009194340816265215306f43127b6d5b61023032a80245a89d086f437e0b8435f170316c8f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909415, "uuid": "d2bba1d6-eb16-4ea0-9941-90c990413b2e", "value": "T16EC32AA9F890DE52C6C52676FB4E418C33231778C3DA7105CE249E34F7EB95A0E3A952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909415, "uuid": "9b0accbc-8206-4ad0-a56a-6217bf4fef7f", "value": "3072:a2Ve7MKyRwUTB6FzcYEEUjCdsVOivLehCRovLPNTFxNBguCf1DlR:aU4+izcYEEUjCds8KL4AovLFDC95R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909415, "uuid": "3d259346-41ad-47d4-b3f4-89cc4a9b5744", "value": 124368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909415, "uuid": "16f792db-7dc4-4f25-a133-6cc3e50ab0eb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909415, "uuid": "bb11c0c2-5fab-4373-ae01-e0ac73634c82", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63d94f9-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900908, "uuid": "ac7eab16-fe65-4381-9a4b-f18ff72bef7d", "comment": "Malware payload (Mirai)", "value": "01991d53dd35b7d4ee87a6d3255b8ac2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900908, "uuid": "273697f7-f81b-453c-baad-3de303bb0cf3", "comment": "Malware payload (Mirai)", "value": "426da5ba5bd6cd10cc2aad4edf4fe36ba287252e23c29d6ccadc0a2d07aa548f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900908, "uuid": "0e9abf53-7a24-4556-b54f-ccc5fb59f3f1", "comment": "Malware payload (Mirai)", "value": "1317382b90eb6b938988d523fe42f22a378d45e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900908, "uuid": "637c110e-a7a6-42cd-98ce-caa50c122dc8", "comment": "Malware payload (Mirai)", "value": "2beb8c7125e338cb710c5ccfd590e255f888ad24e238571c63413471a0a2b85a0eb1b657603fd49bd0ede1d927e3e7be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900908, "uuid": "44e89661-f8ea-4a46-a2a0-088bc91dd87e", "value": "T1FE533A89D783E4F0DA4206F0516BFB7F5531C9612130CCFBDBD4FEDA9A22A929056A1C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900908, "uuid": "ec5d6ef9-31b2-420f-aca3-cd11d70a1f8d", "value": "768:brO7h1pbMezzPFLjhy5v4s9OL6FZhuIkL4oSfCNV01SD2PMUmVFUsM31gOroXYlK:uVciB5y5v4yNhuIc0NUFUd31gOroIwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900908, "uuid": "29e1202c-63e8-4104-a6a8-41bd9fe48232", "value": 62452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900908, "uuid": "66480014-ff2f-4f3e-bcb8-3a333bfdc6c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900908, "uuid": "550df1bc-9c48-4892-9635-76a795049d3d", "value": "miron.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37eea105-9936-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786859357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859357, "uuid": "220e848a-4c59-4e25-bc0c-81cea749b755", "comment": "Malware payload (ConnectWise)", "value": "76140a140f1ff931a2a4a8032276edf3", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859357, "uuid": "81532e7e-ce56-4707-a5a0-0271ea1b656f", "comment": "Malware payload (ConnectWise)", "value": "432460c4b42c70d232c0fad2c0d293016066d3b231fc4f2168ff5db0af0e8122", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859357, "uuid": "15de8c47-a828-4eb0-8ba2-94a8d9808ef4", "comment": "Malware payload (ConnectWise)", "value": "d497f427defb5d7c4c94feaa9cc91936dbf63024", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859357, "uuid": "6e522a95-a38f-441b-8b18-dab32ada4d5c", "comment": "Malware payload (ConnectWise)", "value": "e8e4729d2bb7beb23623133fa2c88ec043203a707e45ce98b2d1a8d485d1ad18e0d5619acece7f6d87a3105ed5d4be69", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859357, "uuid": "9ec5d8e0-6c97-497f-b007-beef9280e302", "value": "T1E656F141B3D695B5C0BF0638D87A42A65634BC148712CBFF57E4BD296D32BC08E7236A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859357, "uuid": "267c45a7-af80-4855-885a-e8db7fec1da9", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859357, "uuid": "937eefef-e959-4824-8a98-566bca5c1f2e", "value": "49152:8fRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:gqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786859357, "uuid": "12c7ba8d-ba08-441d-9c62-56c34ddd97de", "value": 5898128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786859357, "uuid": "3f437947-5800-44a8-a15f-49e3bba202d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859357, "uuid": "b2e1c9bd-8a75-4fed-a5fa-15b0213d4cc6", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1039bcef-9995-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786900092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900092, "uuid": "6acd3534-b333-40c3-9689-a1c32cb036ab", "comment": "Malware payload (Vidar)", "value": "1fb3eb94a79ce949ad409fff52b3f5f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900092, "uuid": "205ee60c-1502-41e0-b82d-2382edf5decf", "comment": "Malware payload (Vidar)", "value": "4357b8fd6eeecbcd40a0a7e3e6097fd050f378d97ea692f57537a9bba3f1d0f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900092, "uuid": "cfbb981e-cda4-441c-b2b4-0efab50abddd", "comment": "Malware payload (Vidar)", "value": "fd679a6386bc8dc877a130e1988d9d5d75bb6060", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900092, "uuid": "3f2fbd3c-68e8-41ee-b78e-b759e873991d", "comment": "Malware payload (Vidar)", "value": "97edbf0e1a3e5f6ff5330c1c2ede8b343996a7450769c781e3f048684327eb1a1fff903ab76d98da87ce996c76364ded", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900092, "uuid": "98853ea7-4900-44a8-b5cd-b75a1be62a22", "value": "T1FDF57B0BBE9048E4C09EA23289675596BB35BC4D0B3633E32E51BA783FB27D05D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900092, "uuid": "2eb1577e-2ad4-4878-bf43-779493ad5d8a", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900092, "uuid": "af56f08d-16e8-47f2-b423-43c54703798d", "value": "49152:gfLhIgdrmNapWSIFab7TcgGXJ2qPWDY5k1nmQKY9Ly7UZ:g1ul595knl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900092, "uuid": "94d8ed80-a7de-4da4-97fb-16e8e3c94240", "value": 3557200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900092, "uuid": "1c910e36-f176-4ff2-be01-41282dfbe3fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900092, "uuid": "79c8fd1e-8ba3-44bc-b7db-7c2cbd7db38a", "value": "4357b8fd6eeecbcd40a0a7e3e6097fd050f378d97ea692f57537a9bba3f1d0f3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87dd57d-9985-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786893529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893529, "uuid": "d8f5da0c-2f10-4768-8fce-a27bc6c9a56c", "comment": "Malware payload", "value": "f412882f01c17ccdb4f3c0ddf4716bb8", "object_relation": "md5", "Tag": [ { "name": "29033904bdc36ecf8e04cf3549a2e264", "colour": "#7BF3A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893529, "uuid": "906b61b1-d795-4033-a3b5-fa9fac699385", "comment": "Malware payload", "value": "44da9c84a1c69a63a661485db45ac537532e9426772c4c8415bfe50dfbae0f10", "object_relation": "sha256", "Tag": [ { "name": "29033904bdc36ecf8e04cf3549a2e264", "colour": "#7BF3A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893529, "uuid": "3fda691c-9543-4074-abfb-2f10b76d2bc4", "comment": "Malware payload", "value": "1930cb9b8f79863fe4e1b81e2b0c5985c8bbb012", "object_relation": "sha1", "Tag": [ { "name": "29033904bdc36ecf8e04cf3549a2e264", "colour": "#7BF3A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893529, "uuid": "207f5b5c-308b-4753-8d9a-1571b22642ce", "comment": "Malware payload", "value": "f3370a2b4c0ef6919d0ed7ee9cfe45436786f1c10713f33b09c62e46e5cd1205042e110dc3e325c7b45ecd33af185e33", "object_relation": "sha3-384", "Tag": [ { "name": "29033904bdc36ecf8e04cf3549a2e264", "colour": "#7BF3A4", "exportable": true, "hide_tag": false }, { "name": "dropped-by-Remus", "colour": "#67E625", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893529, "uuid": "d9257a5d-bb6a-407e-9d59-1299f4cc40cf", "value": "T1A2C633B1DD23A776DC9E8EB2899ACFD7983A0C551327D16AE26475CDB533B22731C200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893529, "uuid": "70c38f51-940a-47a2-9499-72e60f4b76b5", "value": "196608:gRboKh/qElhPA4WeNE/xxUC4swU6xGJ8xZvdjwUy2MJ/FWMZMXXVi2DZAu:gRh9LifJ/xx/4swfGa/vqMMGXlv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786893529, "uuid": "2347d0ff-397a-4e9c-8251-71e50201cf8d", "value": 12496896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786893529, "uuid": "325ebf35-01b8-4527-b1ac-fa297f7f8a2e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893529, "uuid": "436d8af5-468e-4e87-8a14-e3a9c180e96e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130039bf-9912-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786843833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843833, "uuid": "da95d82d-e29c-45c4-9397-61d915b138a5", "comment": "Malware payload", "value": "ed5d545cd22e31a36a72cfd0a13684f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843833, "uuid": "83e75072-15db-4875-bf51-c99ac90c3ae1", "comment": "Malware payload", "value": "45183829a069e60c58437947a9212423db974090ab8a56a0f28c491de093df15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843833, "uuid": "5066ee6b-2703-4880-ab28-2384b3174432", "comment": "Malware payload", "value": "9e0af0154957f028e2925f94db5c9bc96861440c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843833, "uuid": "ce95cd62-73c2-44b7-bbfa-9f3616959b26", "comment": "Malware payload", "value": "f8d0d6711ac1a10495006f72a29f95be6b789de8c20f632a91f0a26943c7acd4b36f920c13c9046e3405a8fc90a3f90b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843833, "uuid": "4da1afa7-5efa-415e-ad55-280188326602", "value": "T118866C73945224D8E1ADC974D5141212BEB8388B573863CBBBC476F617BABE48E78730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843833, "uuid": "1f44719b-a7d8-46bc-9367-ef619e6372ae", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ1:cqYUQuVDt0TZEe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786843833, "uuid": "d67b8b0e-f9ce-4469-9b68-b9924bb1dbaa", "value": 8159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786843833, "uuid": "2a77f898-4e91-4e64-9a14-c3b065e7cbe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843833, "uuid": "4ab423f8-47d4-4955-82da-f7e4e94052b9", "value": "45183829a069e60c58437947a9212423db974090ab8a56a0f28c491de093df15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1156a784-9995-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786900094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900094, "uuid": "80ad3d1c-fc9f-4cc8-bbac-c490839194b7", "comment": "Malware payload (Vidar)", "value": "117ff2ee57147543739ed075bb013ad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900094, "uuid": "d877cdf6-2bdd-4788-b63d-2047244dbdad", "comment": "Malware payload (Vidar)", "value": "45b13eac0b75706b474118f69b6fef22eaa90521e70dbcd823dd5e67b1e4a1aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900094, "uuid": "2bc16d34-7247-417b-9d3c-37ed538fee95", "comment": "Malware payload (Vidar)", "value": "bdda514d213d40610c92b489a605313001fdd08d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900094, "uuid": "c33daa73-122f-4b93-a47c-95897a3a5ad4", "comment": "Malware payload (Vidar)", "value": "c462dc0b9cb2728462a647eca3802fbf789ef2104512819c2adb7f6df7a8aff060353c5a3162b96adc90a1f6cee70a10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900094, "uuid": "fe8b8a45-32fb-4f8a-a83d-dc29ec094b29", "value": "T18CF58C43BCA109E6C0A9A23188B252927B75BC451F3223DB2E90B7783F777E15D79B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900094, "uuid": "4429fc8c-cc59-4005-9a42-11cea07d500d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900094, "uuid": "5fce2b8d-a840-439a-8d14-a2e29b8f4af7", "value": "49152:D9k+46NKVDskZpmZKHnxlDEegpI66b+SLrBG5rJgfhy3TSH0LClY1t0Hr7o/kqJQ:Do6enu/gZyj4yClY1WA/x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900094, "uuid": "ad80665f-1b3a-476c-a673-9c45e9c22fc4", "value": 3560792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900094, "uuid": "209cb8ef-c5ef-4392-909b-a05b08705683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900094, "uuid": "b2623e93-def0-4eae-9a46-b4f4d7e13960", "value": "45b13eac0b75706b474118f69b6fef22eaa90521e70dbcd823dd5e67b1e4a1aa.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd6deb3d-99ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909939, "uuid": "c68514da-c1b3-4573-a9c0-f4903c48a51e", "comment": "Malware payload (Mirai)", "value": "af56b1bc4a3e6dbdeb584039fe78de04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909939, "uuid": "73082b0f-1edb-42cc-9905-ba36cfb665d7", "comment": "Malware payload (Mirai)", "value": "468e72f473f5d64cff1777448823153615670e968abc8af138639ec1d32f1aa1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909939, "uuid": "fbfdf40c-baf9-4619-9fe9-e555700768ea", "comment": "Malware payload (Mirai)", "value": "b501496cc1d6241b5745e815c439347919252aa1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909939, "uuid": "dd24f5c5-940e-4729-91e1-0a05dce5724d", "comment": "Malware payload (Mirai)", "value": "d08092b7683acda892718c005000d6e1e54c0883b9b7c9907a5f3004be3b3e9343e27f3a9120982ca16ec693ecfa8868", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909939, "uuid": "6566ed50-3a96-4aeb-8ee8-21cc552451d4", "value": "T1F38302CE6ED0ADB0E3810AF686F3C2515EE6DC0FA916C519211668A7EE081E57116F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909939, "uuid": "a4090de8-fc53-4c83-811a-9ec992f2164c", "value": "1536:2bghgY3RQ/1jMacs2dQXrYaso16TfRCHB36Pw2mWoWVqdu0h:2QBQtHUsfso16jRCh36jmWoM0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909939, "uuid": "57ff4593-1000-40d2-8b65-339387c326d5", "value": 82968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909939, "uuid": "7ca3b216-2b8e-4bc1-b14b-59da7f7b4d8e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909939, "uuid": "0c6ca403-bc41-45fa-a997-b492c8672ac8", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d8de8b-9975-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786886712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786886712, "uuid": "810d0cc5-0a32-4305-bbf9-0de2376c1651", "comment": "Malware payload (ValleyRAT)", "value": "6359fb861803da153e69461c9677a93d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786886712, "uuid": "fc6ba25e-95d5-47ef-9985-1598efa052ca", "comment": "Malware payload (ValleyRAT)", "value": "470a41a0a6c204ac849fd7d224d81983fec2f27e91376a5025a6002508801639", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786886712, "uuid": "e1f5a645-5d2f-48f3-9fdf-cf0e31af4183", "comment": "Malware payload (ValleyRAT)", "value": "a5e556e69ca0f49701050c607d660ff1181dc6e3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786886712, "uuid": "559e4157-2a92-4989-8c18-c796aa6ffc10", "comment": "Malware payload (ValleyRAT)", "value": "fb8625461a347705b702bc9b33521aee784c8459e59c2d43a1da8e9fa47dc5bba23abc8caf8948241f6b2b7b3b1af0b8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786886712, "uuid": "deaf5bf5-f03d-4776-a4bf-6befd867231d", "value": "T100F57C20A341C13FF5AF14B1893D4A6F5558AE721BA450D7B3C86E9E1BB29C36631F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786886712, "uuid": "2efc7dfb-6783-441d-aef9-3120777ab476", "value": "1d734ee18d75fe858b9c6e7a63ca0fb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786886712, "uuid": "958e5e0f-28ba-4392-8b60-227a85c5e9ae", "value": "98304:aDqPLIu+SYbMFzxr91Peclim/HhCoIjba+:aDkLIuzik6z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786886712, "uuid": "333a3174-cebd-4aa1-ab9d-a4320cf5944e", "value": 3391488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786886712, "uuid": "a7cf87b2-f3c8-476b-b484-3c81cb9efa66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786886712, "uuid": "78a2b6fd-4050-40f2-afd8-4dab1ade9375", "value": "6359FB861803DA153E69461C9677A93D.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1460c3d-99a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786905194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905194, "uuid": "82f13cb9-e386-4f70-bc07-e93eb23a2d0c", "comment": "Malware payload (Vidar)", "value": "6ff21ed4a92b731575bbf577f26324e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905194, "uuid": "b6a45bb8-904e-45cd-8b1c-cc2484a9c26a", "comment": "Malware payload (Vidar)", "value": "474c3519137b62addf64b5634df1ac67f8ec5faababdc39535bf8b714b49dabf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905194, "uuid": "331755f4-0a2f-4c16-8fb2-e1905b8d322d", "comment": "Malware payload (Vidar)", "value": "46edfba7565ef82813f58d1f46712969cc3aea89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905194, "uuid": "bb5c496e-43c1-4bb4-bb2d-23939141a69f", "comment": "Malware payload (Vidar)", "value": "bc92aae3c230b5b8eba0f16b32db4ebceefa7f0f16d80eae9f2a3613a0e9e84854ca71d0974a485b2af45518ffc2661e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905194, "uuid": "bf8ae271-948e-496a-8d2e-af626e9b3d51", "value": "T1F4F59D07BCA148F6C4AAA73189636226B771BC085B3633EB1E50B7782F727D05D36749", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905194, "uuid": "688f90dd-304d-4763-a63d-6232d145e694", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905194, "uuid": "deb8b28c-5261-4003-ae83-e5d1f331f4bf", "value": "49152:rXRJr5nBHhrO4ZUjtNSTreIw/uV+dp/xI8rHYrMIyRiRD/wJ:rXjcwUjQeBLZX4r701J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786905194, "uuid": "e8b2e3fe-078c-44ec-9eab-5ffb45f76c0b", "value": 3533160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786905194, "uuid": "0be78514-e420-48c8-b126-46ede7c3b83a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905194, "uuid": "d544b286-0a2c-4849-a199-75b970b303a4", "value": "474c3519137b62addf64b5634df1ac67f8ec5faababdc39535bf8b714b49dabf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2cb394-9992-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786899010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899010, "uuid": "f14b630f-cfca-4979-add4-a08f51913da5", "comment": "Malware payload (Mirai)", "value": "9b9e3c7d020b067467e415855f00fdcb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899010, "uuid": "6a962d87-d354-4bec-90d9-eebefda8376b", "comment": "Malware payload (Mirai)", "value": "4761db60d6a1727521098f97729f339a1f011717eba30d433a62cc24476e4831", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899010, "uuid": "93fa0c5c-547f-42c7-aa43-35d9e4349ac3", "comment": "Malware payload (Mirai)", "value": "82157d191e6bcce0cb01672b88f541b5f86dba38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899010, "uuid": "663827fb-64e2-4410-bb2c-642150f4fa89", "comment": "Malware payload (Mirai)", "value": "75714a212dc3ff3d03977ffd54802930cf7eef0e3a67e24c3fe0ade6bc5a42c726aa8528e00b0e40a37861ca7c7bdee9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899010, "uuid": "e7360a9b-7697-45c1-88ba-4620cadd1f8d", "value": "T1DEB36C21F9781A2BC5E4A07711F35736F1F6438A24A89A1E7D720E8DFF182D02667778", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899010, "uuid": "f7b19aa2-6c17-4e6f-8a7f-61303ceaea7e", "value": "1536:ukldnLyP58tOuKEtq70ubfxbtojF8vD8tYsoD5ElCg5QPJitBPNCqM:3nkrbf3aF0o2so9kHdPNCqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786899010, "uuid": "bba014cd-188c-4e07-a41c-2b5b5d3bbd12", "value": 116268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786899010, "uuid": "b69effe2-9fce-4d4e-802d-237fe529fdb9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899010, "uuid": "98a1d33b-dbc4-444a-bd30-fb7499b6024c", "value": "4761db60d6a1727521098f97729f339a1f011717eba30d433a62cc24476e4831.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f2d9f9-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901145, "uuid": "a33b4d98-e890-48f6-bace-c80e8ae594fc", "comment": "Malware payload (Mirai)", "value": "f84750ee3294fe24739bf20b04693f11", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901145, "uuid": "70513301-86fc-42cc-b5fe-53a20ee3b1eb", "comment": "Malware payload (Mirai)", "value": "477db8b7c8998da288e945ba765c59dec89fb9058487094c3e96d878a05eb13f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901145, "uuid": "ef9faecd-ea03-4c84-9788-db9c135f9790", "comment": "Malware payload (Mirai)", "value": "401e6c6c168f7d04e296456ccd6bfe6e35082127", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901145, "uuid": "905b8c56-5132-4218-84c8-f79fa94ceff7", "comment": "Malware payload (Mirai)", "value": "16b9190822ef9d313586d9c922339f65b1ad15f74ea00be0a1ce675c9b6b431c8b3b1565879f0237daace7aa8b29949e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901145, "uuid": "d4e87fa4-0423-48f3-b3f1-8433d768d38d", "value": "T123836DC5EAC3C8F5E92209311172BB665AB3D13E2268EA83C3AAD575EC135C0F51679C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901145, "uuid": "694d755f-8666-47b5-b3f3-b28cfeab3409", "value": "1536:OZtH7MIlsW4CoN+HWvGO3NAjw19K01d1YQRXBE:OvHzlsWJJHoGsNi+9/YQBBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901145, "uuid": "e58eebbd-0c2a-4bb0-a64f-c39ed816d658", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901145, "uuid": "3e226435-55cc-4e5a-9040-ed95d606899f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901145, "uuid": "6040a6f5-4b80-480f-bbd6-fe48008d63cb", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8749ae3-9918-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786846795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786846795, "uuid": "9fc73dc3-eb27-4604-81fe-11c90bfb3834", "comment": "Malware payload (CoinMiner)", "value": "bf88a2fb1ef5472160508c236f3969df", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786846795, "uuid": "4059a370-2f08-4707-977c-4565aac54113", "comment": "Malware payload (CoinMiner)", "value": "47ec52063197ba9437b840fb297a0d8258f0a268856d961cd52732b4b80ad5e3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786846795, "uuid": "13475094-9f25-42e6-9303-83b75cf91580", "comment": "Malware payload (CoinMiner)", "value": "db68b3edf9d3166b4743ecc63883de73fee620e7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786846795, "uuid": "ceefd187-eb44-4fd0-bbc2-6511f027e708", "comment": "Malware payload (CoinMiner)", "value": "593f102c3afa64da97d0c65d074a032ecf570d69d03588a1745f97469be05474779e7cadad97c646d994645854b9c123", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786846795, "uuid": "b77c2455-c352-4465-a536-9ab2114eeda4", "value": "T1043633E63DD224B9D052DBF49302616CB23E7B52422DBC127BDC3E099F275582A3E791", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786846795, "uuid": "c2acf0ba-8a11-4835-8467-34fc09bfa4f5", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786846795, "uuid": "c03a861f-bbd1-4a18-b1f6-d9a9b8b0b6a1", "value": "98304:h6r/ucKQf55QQKWdOQ88qAcOp75PmdygHnPLJSgd4Dsj6rXAg/e:h6r/RRzJdhtqjw0HnPLVAU6kg/e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786846795, "uuid": "9b337fb4-649f-475c-a6a9-8e2b4c1ea12a", "value": 5224448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786846795, "uuid": "56465260-609b-4e10-801d-5488833e4769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786846795, "uuid": "f8b5631e-c17a-4b8d-8480-6d6ec384a0ae", "value": "47ec52063197ba9437b840fb297a0d8258f0a268856d961cd52732b4b80ad5e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829ae20f-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901143, "uuid": "57bee74d-c294-4c2f-a9bd-af46f0138e51", "comment": "Malware payload (Mirai)", "value": "80812c26c565f65bebff4735950cc408", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901143, "uuid": "e5ef575b-45c1-4a2b-9d2f-6acc693c15f6", "comment": "Malware payload (Mirai)", "value": "4c797011c9f9bc594df7d499f3d51f8fe33889b7e94d3f45f6d9a9e9e7179115", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901143, "uuid": "751eb257-84f0-49f1-8257-6f3bb90d9fca", "comment": "Malware payload (Mirai)", "value": "76c79f8171e9c7a5acb1c4c0a7fb88c822772704", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901143, "uuid": "2094fd19-078f-4f21-a0cf-8d3daf252093", "comment": "Malware payload (Mirai)", "value": "af90f76b217b3b8429feef9b84647cda27e35ae5a13f64a1331e5de80ba70eb86c41136d0733b4673a5d8bf09e274105", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901143, "uuid": "836f31d2-1d6d-412e-a8d7-facc37e855df", "value": "T109934B45FD919612C6D1137BFB2E328E332663A4D2DA3203DE25AF22338659B0D7B751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901143, "uuid": "0ba1daaa-927d-4583-9436-070d611c4575", "value": "1536:ujti8LGudTkpcqOPwSb86PVLIzAX5iXffdXLamvtu:uBi8jd4SHC6PZIzhPjtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901143, "uuid": "ca445a21-1ee1-48c7-a19e-39a389633503", "value": 92240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901143, "uuid": "c5eb05f7-5b71-4e16-a7d2-ecca1e183509", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901143, "uuid": "1e2347ed-42c1-44c6-9732-81841224b2da", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c8079b8-9973-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786885483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786885483, "uuid": "bf0a2432-8750-4e3b-abfe-21ac4cb01101", "comment": "Malware payload", "value": "30308baf14475c020d8aeecce1c18aa9", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786885483, "uuid": "df610173-a53d-472a-b489-f4fead701cd2", "comment": "Malware payload", "value": "4c8f70b1df9e1c2a3e126daf04ba2ee1ad1e4efed5fdfed79bc4cf68d12af2b2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786885483, "uuid": "3e265f19-cb62-4eaf-9872-5d168b879878", "comment": "Malware payload", "value": "168b83d7345000098d5a67eb2da36d54c8866c27", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786885483, "uuid": "60ff10e5-76d2-479e-b802-e21fb5010e09", "comment": "Malware payload", "value": "7673ceb3393ac823670c8f2318ad86c46c2c568cc5f98cfd6ab5b0ea8b9103e9afdbdb23db3dbfa1e7d1eb80e88ddeb6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786885483, "uuid": "ef715902-912a-4137-95bd-8258e6dda32c", "value": "T171529772BA65957638ACC22C998F9110392B3AEB3618345474ED76043FFC31D51F277A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786885483, "uuid": "3db37c86-072a-4c4d-a2ba-d2a8adef3f15", "value": "192:2875r4u74COKyAVF1mBt6e4egQq1GZ0HRit4Nmn5PH03/BNGBggGQd:T5cT4LyMiXn5PUQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786885483, "uuid": "edda4d4d-fc6a-4098-89e5-445c4f4ca2de", "value": 13886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786885483, "uuid": "5054c276-9cd8-482f-b11a-f58063194570", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786885483, "uuid": "859baca5-1886-4650-8e35-1f53fb9529e9", "value": "deploy.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47363e82-99a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786907915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907915, "uuid": "e411cf3d-b758-43fe-b17d-dcb5359652d6", "comment": "Malware payload (Mirai)", "value": "c3c05731cb68bc8de5622035f1177263", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907915, "uuid": "3b31fb2d-6290-4bc0-8514-50484953fde8", "comment": "Malware payload (Mirai)", "value": "4cbf6afbc9096f9d67b4d0fce94e57e94cad41578116e99242e20e9864f2d1b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907915, "uuid": "305c3f82-000f-415f-b62c-add8b75096c1", "comment": "Malware payload (Mirai)", "value": "e3bc0c1611d56800708da316deda6ea768bf6068", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907915, "uuid": "4a1ea7a3-0f22-4660-a534-4e3681425a23", "comment": "Malware payload (Mirai)", "value": "4ed3805a388d0f3d7742767ddff45bff71ff6297ddb9917e0c66cd91e313d9951c1da5b625a2ed4d7bdbec6a5303776c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907915, "uuid": "34f9a240-e323-4f3c-b0fe-54604af4c8b6", "value": "T132E30759FD41AF00D5D636FAFA4E028973531B6CE3FE7102AE245B2523CAA6B0F76105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907915, "uuid": "e413795f-cb32-4a6c-ac7e-69a38dbc9e5e", "value": "3072:+ve0SgJ2wvglaa3ozx2//ZejQkX1u9gBvEK5/acBZUkTp/7v9cjsN5ogweERKDwl:+ve0S42xlaa3o1OAlX0aBr/aQykTp/7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786907915, "uuid": "2dda60ca-02d7-453b-9575-f37c19156894", "value": 154536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786907915, "uuid": "a131bd82-7f45-4c3c-9243-3b6483faa842", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907915, "uuid": "fb1b1fba-123a-4d24-abe3-fe9f27b496f5", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85301338-9936-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786859486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859486, "uuid": "7ab45c15-d970-47a2-a4cf-0de77d6df33f", "comment": "Malware payload (ConnectWise)", "value": "b948a85eddaaee53dfa68d4099ecb93b", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859486, "uuid": "58cbcaa3-a35b-4cb9-8a1a-f7652c501023", "comment": "Malware payload (ConnectWise)", "value": "4d605371799007380d724ce132ffff8c0648e146373ab66444294efc5ae266a9", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859486, "uuid": "e6037e79-d3ab-4e26-919b-54fa8bc1b094", "comment": "Malware payload (ConnectWise)", "value": "d530de44ea1ebebfa07d20c4feabac2c677b3c8b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859486, "uuid": "854fb05f-3250-46d5-8642-da8e808e44ee", "comment": "Malware payload (ConnectWise)", "value": "ff13dc2817493faac672ec129df205451028e8a44d280407cc0ad6a59643dc34c2a16e10670947314147d296bbd92681", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859486, "uuid": "38750cd7-cd69-4bdc-a831-dec6f9254830", "value": "T1C2646C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859486, "uuid": "89000ab5-1796-4832-83da-8b67bd56071d", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859486, "uuid": "84debf76-172a-4aa7-9e34-720ed3bedb80", "value": "6144:KmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9hI:51iw7gryNkSV1hy1Z1u2JLI9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786859486, "uuid": "ce38640e-b0f0-4238-9506-da4af9eb7d76", "value": 312584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786859486, "uuid": "3d874969-a082-46e4-8f41-171eca244f47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859486, "uuid": "a5a130c4-c54f-4e17-af0b-e0bd51d2681f", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d60bd2a-9976-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786887015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786887015, "uuid": "c8cad24b-5813-4ecc-ad70-d7193505af25", "comment": "Malware payload (ValleyRAT)", "value": "59e66485a38fbf72d800c129ed9d8de2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786887015, "uuid": "ef484d2c-52fa-4759-8d8e-e5b3a4a433bc", "comment": "Malware payload (ValleyRAT)", "value": "4d9a9a1a347b39365dc19b7697f76c7be3ee02b99adfcd588221ac52eae0f358", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786887015, "uuid": "2f79153a-45ba-4b22-aa79-40b1b801f932", "comment": "Malware payload (ValleyRAT)", "value": "d1987f988247f74b986a9294b121d75cc369453c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786887015, "uuid": "102ac497-1af1-4e93-85f7-189507629552", "comment": "Malware payload (ValleyRAT)", "value": "75a7e2d0b7e761608a8c7ea5c7ead944ece845d55547a61b7b1c1153e98cdc6a118d607aa3217d1913d2e7352227d36b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786887015, "uuid": "b7a1c916-dfdd-4456-bd8b-eccac509ffd7", "value": "T12746CF173D5C00AAE05A1233CE59B2ECF1AEBDE83B76019715A4B71EFD32741CA2456B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786887015, "uuid": "0ba96dbb-b995-4836-9095-81915e2cad25", "value": "cd05b47cee90842fffa772636d8cfc8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786887015, "uuid": "109e57e7-c4e7-4ac1-ad75-4fd92f3a8595", "value": "98304:GgWh7V40Yl94AvfqeapSkMdStt1zx9ZkRuLrrxIZ4OiZrq1DfPHNADtV6v+zM+rX:GgU1o59Stt1zxvkLZ4O7NADtV6v+zZRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786887015, "uuid": "eecbaab2-67da-4ad3-9d21-cf1be5b7fe3b", "value": 5756416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786887015, "uuid": "e27bea2a-b273-493a-b8f7-09dc04682394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786887015, "uuid": "8d1d7ba0-d243-439d-a737-cdac144c5332", "value": "59E66485A38FBF72D800C129ED9D8DE2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e74cdce-99a3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786906156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906156, "uuid": "3a77abb1-0734-420b-9410-3687e08f30b4", "comment": "Malware payload (Vidar)", "value": "e03521a2b6c3977a0429646a2ec112c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906156, "uuid": "8f6e4f04-e522-460f-be32-74c5dbe2bd9a", "comment": "Malware payload (Vidar)", "value": "4e8803daad6cb667808d4236535524b9df7fa912ef6dfcd2993bfcb85848dab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906156, "uuid": "0b5bf091-80c6-4a80-a939-7ba6e7acf6da", "comment": "Malware payload (Vidar)", "value": "0eab50d8e421efab99c138ecaa4270d2f142c520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906156, "uuid": "ac5b52f7-14c3-4d71-a336-c6d2b0814730", "comment": "Malware payload (Vidar)", "value": "61ef04e5f0400757544afaa22500c223502a3239f2dbaad611392de3dec3ea8666925b44274b876a7876d4d4abae83c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906156, "uuid": "76c15aeb-c0f2-4c70-b508-f0203ba392a1", "value": "T14D269E077EA188B4C05A973248B682557B2C7C4B873673E72E62AE753F323D18D72B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906156, "uuid": "e5a7b796-d477-4030-a0e2-4eaee1d87f53", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906156, "uuid": "c172ad27-5c11-4ad9-a1f6-c3f7a9261a7c", "value": "49152:K7ABCka69t+5Xp/j3qZ6JNYRzwfg5kTDx16pTPZTMpnsevMzk7XuV37p3Zx2sWkW:KlT2+oDkiVVUvTfnAGX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786906156, "uuid": "3355b50e-3374-4945-95f0-6c63c18fc493", "value": 4453776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786906156, "uuid": "142d76b9-73ed-434f-9b26-4fb765013b6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906156, "uuid": "14267d26-b8a6-400a-916c-b30c055855af", "value": "4e8803daad6cb667808d4236535524b9df7fa912ef6dfcd2993bfcb85848dab5.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcfc64f-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901373, "uuid": "93987ba8-c94c-4e48-8c23-4490bfcc9523", "comment": "Malware payload (Mirai)", "value": "ea33631c421e50f44f6fe15b4b160073", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901373, "uuid": "28794e07-1f10-490a-a3ac-e1218fa92d54", "comment": "Malware payload (Mirai)", "value": "4e9c3c504524eb4b6b3a716f94b691b1b94e0b647bc297afceac8acfccff8728", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901373, "uuid": "b40e362d-2355-426c-9f18-f80c293cd0cd", "comment": "Malware payload (Mirai)", "value": "4ae39f8834cc76c50322e4a6f443d14d57ca0bd0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901373, "uuid": "7bc5deff-f028-4fc4-9127-cfbc827a2a4a", "comment": "Malware payload (Mirai)", "value": "c3543ac02d9015897f37aa7651bc7d6fc8608b923bc8e69089b6a697885037342d857ab94de417970ffd24d05a96aa57", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901373, "uuid": "6056a544-dbd7-4356-b6d8-e6520c7f86ec", "value": "T13BD30A17A9518F12D1C321B9FF9E425937137F78D3EE32029D24AFA0374A4EB0A7A516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901373, "uuid": "623b9979-231e-4163-be28-72ec32323912", "value": "3072:NiwlUrSaMPXfGC84zalgk76YWkQlIPs8Y1fr6:NfIGPX+C8WaLlWkQ2s8Ifr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901373, "uuid": "975a9664-8ad2-423f-ac27-15f9e617f543", "value": 140064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901373, "uuid": "f4ae42e4-6040-457e-af3f-4c1dda3759b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901373, "uuid": "35bb170b-d5ab-49b6-814d-16d3dbe5b7be", "value": "eclipse.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4bd074-997b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786889112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889112, "uuid": "c4fd1358-7afa-4b57-b2bc-055153849ed8", "comment": "Malware payload", "value": "07b4b812edafc283e47f3188b5e3b5da", "object_relation": "md5", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889112, "uuid": "07f92f71-d49c-4868-bc5a-8ca6f9ff610e", "comment": "Malware payload", "value": "505d168a8346601bdcc6c211d217af80777d9d65185ea2204c3ea0320251085e", "object_relation": "sha256", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889112, "uuid": "7416bcb8-abb0-4a90-b1f9-b06aa9140873", "comment": "Malware payload", "value": "88b812e40740800094db30c40aa12d70e53b2ab0", "object_relation": "sha1", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889112, "uuid": "542e95bf-6732-4854-b3d5-cc5c957417bc", "comment": "Malware payload", "value": "9903a9711f6b908fe43c00fa4ffa0263c569c226e7fbcf31f766eccbac73c1b1e5d727d9d8d9290175a3e3f22e3bbf10", "object_relation": "sha3-384", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889112, "uuid": "4c72ec91-0b50-49b6-8fe4-e62de4bafb64", "value": "T138721D667A2795FE3C98822458BA5130391719AF3E14345F74AF660C3F283FD51B2F29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889112, "uuid": "08ef123b-4b70-4832-b5ee-ed038f54c272", "value": "192:2875J40L74CmWKAtFbmBtie4egU81GZ2HRit438n5P303xBDGLgKGGd:T5shKLwCinn5PkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786889112, "uuid": "86d4d8ff-2bed-4397-bd7c-d5657892fc13", "value": 16241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786889112, "uuid": "76b419f5-9c2e-4589-8c67-b49e7b2d1f3c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889112, "uuid": "c0c92608-d5f7-446a-b956-0c5a8ba51b3a", "value": "505d168a8346601bdcc6c211d217af80777d9d65185ea2204c3ea0320251085e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b43696-9923-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786851414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786851414, "uuid": "fa44baf8-45b8-43b7-9ff9-86f30f8999ca", "comment": "Malware payload", "value": "e5eb670c2dacf8ef67bbf931d6585b9e", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786851414, "uuid": "dc9405cd-ccc3-4bde-a957-18f331670d9a", "comment": "Malware payload", "value": "520501b124e2b8d3935693f556e3446ee8be319ba420a7a6c78e5a0d80ea7dbc", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786851414, "uuid": "490b6289-81c9-4dbf-94d0-8844a936fc93", "comment": "Malware payload", "value": "0d61e7df75a419a1006aed36a9c166297af705b4", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786851414, "uuid": "a7faf424-6ebc-4760-bebb-21f3236dd691", "comment": "Malware payload", "value": "056409c25a5cd2fb0ae1eda5601b86dd6662c2e0f4b282011fa60734a36095fc969a7413e048ed166a38f9eae4503608", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786851414, "uuid": "f1da07fe-90d5-4ce4-b16a-df7519fc1def", "value": "T1D9664917FC5915E5C1AED13489A29653BF717C881B2123D72BA0F6243F76BE0AEB9340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786851414, "uuid": "291dfb34-b458-4ad1-a880-4709673c1274", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786851414, "uuid": "18279c1b-5f9d-4cfa-adb8-bc7175b835e5", "value": "49152:5Q/pq2VLzqHGyVf05EKUzYO9+JI/414sCbhtI7p6lpuo5I5uOVVv49Uy50KQK1KY:5QhtVBTyIN4QxTa7WNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786851414, "uuid": "69243a46-1223-47bf-beb7-7c5ac1fd3c1d", "value": 6887936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786851414, "uuid": "41cb0f50-148d-4d79-9dd8-c0778d076ae3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786851414, "uuid": "b13fb4ce-a1b7-4d63-aa05-d5f35bd4dd64", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315352fc-99a8-11f1-bd95-42010a9c0009", "comment": "Malware payload (njrat)", "timestamp": 1786908308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786908308, "uuid": "cacef160-3eb8-46dd-adce-ee7d63ed8793", "comment": "Malware payload (njrat)", "value": "0af61a3613cb79aec77d9d2a6e2756e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786908308, "uuid": "733c5745-ff4a-44e4-8de0-359586a11e29", "comment": "Malware payload (njrat)", "value": "520afe474c0d141f0efb5ab826e581fb4d0e87a30cf6e34fd509af71d3829f26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786908308, "uuid": "0df8a190-c6b4-4e2f-8370-66ee9268a97c", "comment": "Malware payload (njrat)", "value": "8b33bf886db31c1065034cbbfbda71d17561290e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786908308, "uuid": "faaf71d5-9b25-4c6f-8d6c-ddaa66e4dd6f", "comment": "Malware payload (njrat)", "value": "912537de3f8fdbf7fd1e4da6484a32929658fb244a38d3f2d694fe8e130cdfe7cf4ccedeb3ea76b7e961570526e59bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786908308, "uuid": "c2b490f0-5eea-4af1-bb3f-08ced3797f9f", "value": "T10D432844BFEA4A01E2BD8F3469F555150634BA63E532EB1F48D668EB13327C58C40FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786908308, "uuid": "b86743df-d56c-4ede-84a1-e6db8e92b56b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786908308, "uuid": "8194b380-422d-4797-956c-929148db881b", "value": "1536:dwws4DnAN7jytFADRwsNMDMXExI3pm4m:iT4DnA2PADRwsNMDMXExI3pm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786908308, "uuid": "09273347-cf7b-431c-8be2-c79f2f622dab", "value": 56320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786908308, "uuid": "25e67c84-b3b8-4db6-b8ea-a87e9f13b067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786908308, "uuid": "bffb004a-2a35-467a-9cff-f1066571bf4c", "value": "0af61a3613cb79aec77d9d2a6e2756e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73927b2e-9982-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786892098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786892098, "uuid": "ad180399-de99-41cf-919d-7638d2b6f2fa", "comment": "Malware payload", "value": "6154bf615d2a517c5dc83f6784dc05fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "toitoin", "colour": "#5A8EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786892098, "uuid": "4be6e0db-19f4-46aa-ba5f-582ee21d8df8", "comment": "Malware payload", "value": "52cc7a5997a687831d234b231e4b77517fff0eda700592c4a4a7f8f70286a94a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "toitoin", "colour": "#5A8EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786892098, "uuid": "c6735605-430c-45be-bbfb-024332aff617", "comment": "Malware payload", "value": "276e0896cffa3c1789ffa457733a5b2a9566e6c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "toitoin", "colour": "#5A8EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786892098, "uuid": "3796961a-6dd3-4d04-9544-8189cd600f12", "comment": "Malware payload", "value": "e152347a144aa51289db83c72e18e8ee735ad0ce14fe01d4d9d68d36ed02622b5241f12219ebb4696d53d42a7426fca7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "toitoin", "colour": "#5A8EFB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786892098, "uuid": "3cf349d8-e61c-48da-8fca-d5e4a3862b4f", "value": "T1FEA35A5B67E500BBE1B7867988670E45D7B6F82107619FEF03A0425A1F237E18D3AF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786892098, "uuid": "14ff935e-afe8-4da7-847a-ab2649bc8d0a", "value": "9348bc8d33bdf52aeb412930764f570f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786892098, "uuid": "a54bb4ec-bf61-48d8-88e7-8aa6b4644cb7", "value": "3072:DsFIN3pr6BUxA9qf5mz0vMt9l0jm+GNGouehS1h:2i3pu4Yqf5IN/Ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786892098, "uuid": "63a7fe5f-e21c-429f-aa1b-115a13628af1", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786892098, "uuid": "7ce318f8-4f8c-438c-9843-b4c9579bb7a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786892098, "uuid": "62a5e87a-88e4-4f71-96ef-ba1ec069eb1b", "value": "FndOS.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1daf207a-9929-11f1-bd95-42010a9c0009", "comment": "Malware payload (WannaCry)", "timestamp": 1786853729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786853729, "uuid": "93de31c8-a424-4cc8-97dc-746508b3cd4b", "comment": "Malware payload (WannaCry)", "value": "d0fc194addd715fe4571f6c2ee892405", "object_relation": "md5", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786853729, "uuid": "b5550a51-25ca-4b44-8d02-1a24deeb8ec6", "comment": "Malware payload (WannaCry)", "value": "53beca1b6d8413eee6aec1daf1f9cf60a01ebb6d3e69aa0513a5f08b41c8f175", "object_relation": "sha256", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786853729, "uuid": "70f5905f-208c-46b0-9ed2-701f84033dee", "comment": "Malware payload (WannaCry)", "value": "3410acc3bef1fea0282426dcc3e25f1e8aeb2d3a", "object_relation": "sha1", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786853729, "uuid": "0f8d0896-ba98-46fe-baea-30a0c0c38b96", "comment": "Malware payload (WannaCry)", "value": "79b702bbb0a04d6c01e27194fbbcda020a0cbd0894adcae859e11f5693bfe25cafe119fff9ca5bfdb6c76a10d8179b44", "object_relation": "sha3-384", "Tag": [ { "name": "dionaea", "colour": "#153604", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WannaCry", "colour": "#7BC495", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786853729, "uuid": "57b80596-422f-49d6-bb03-0d44dd7b6130", "value": "T150251259326C80BCC1176278A4B34E26E7B37C5A227D930F8B9487661E13790BF78B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786853729, "uuid": "7619334a-d30a-4014-a56e-f1b571dcbe04", "value": "0cdadfa1098d845dd3b4cf92625b5f04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786853729, "uuid": "448e0192-035e-4d69-a84b-f2dfe213daa9", "value": "24576:jbLgWbLgddQhfdmMSirYbcMNgef0QeQjGE:jnXnAQqMSPbcBVQejE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786853729, "uuid": "e57fced7-4608-40d4-97dc-c9786d72ba13", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786853729, "uuid": "8685610a-6c47-4a04-aea8-83cedf98b297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786853729, "uuid": "0954286b-6712-4215-af81-ffb6b14f28fd", "value": "53beca1b6d8413eee6aec1daf1f9cf60a01ebb6d3e69aa0513a5f08b41c8f175", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e6c863-9915-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786845348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845348, "uuid": "90993d10-a00a-4eac-956b-1dd50375834b", "comment": "Malware payload", "value": "792660f2aecd1bd5ae62edfb19af7585", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845348, "uuid": "05c62f25-4a84-4230-9fc1-8e167714d562", "comment": "Malware payload", "value": "5436b9aec5ecd808c2b634586bab65c07e4de5a0e01fd7f952b1beb46335767c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845348, "uuid": "7fe13566-ce33-4de9-a231-2d070a8e4ec4", "comment": "Malware payload", "value": "fba0e5d848435c1f669b638f4556a87c7ea118f4", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845348, "uuid": "6c349af6-f7d7-4b72-93f5-c4cff6bba0d2", "comment": "Malware payload", "value": "a3c998e01ac708b20e18da1c9716f8337d216a96ef1d8531e34518599fa4cf57c028a8c2d5e3005a9654e1b2b274ad91", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845348, "uuid": "f42e4cc9-209a-433b-9b74-b9078f4df701", "value": "T178C28D956A867C44BEC98A3E4CBE2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845348, "uuid": "c50171f7-f17f-4fa4-b2e4-f817ca6639ae", "value": "768:n28vCB+25j6es8RW9FYpMSUpi+20qUpi+20YQX:28l25JAd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786845348, "uuid": "fdfdc874-4f99-47f2-93d4-7d11242fce24", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786845348, "uuid": "6af1ee62-b8f5-49b6-8e97-d75052765ea1", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845348, "uuid": "c269c074-ebc9-4fc9-aec3-0b78adf7f960", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "860d2fec-9936-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786859488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859488, "uuid": "889dfbc9-3798-4f0e-8022-d98d6c9637f0", "comment": "Malware payload (ConnectWise)", "value": "7985836734f2b20f13a8b247a92016fe", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859488, "uuid": "3e43f649-60fc-45d5-9dc5-5a1f4368b629", "comment": "Malware payload (ConnectWise)", "value": "544334a6b499e38555c572f513c7f0719ede3c5cfc2e60ef7a687b141baa775e", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859488, "uuid": "1bc0965f-adfc-4779-88ea-2fed02b74ba3", "comment": "Malware payload (ConnectWise)", "value": "9a5c7563d2b820e1a4472945ba1657ac816dc797", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859488, "uuid": "4bc93e41-d8bb-47d3-a857-508fa8412df6", "comment": "Malware payload (ConnectWise)", "value": "543945fbd47a8769bfa1b47536f3cb722c41f332f113372fc0218a3a468c422cab27b5d4de55f10a46e0b1885f25b92d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859488, "uuid": "60e7476a-2176-4b40-b875-9f98090458c1", "value": "T12B56F141B3D695B5C0BF0638D87A42A65634BC148712CBFF57E4BD296D32BC08E7236A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859488, "uuid": "39ba348f-a354-427e-8951-dc420f3a08d9", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859488, "uuid": "1ec97f61-a081-4115-8dac-b2fbff150189", "value": "49152:MfRBDtJkGYYpT0+TFiH7efP3nrGLq7FVsLBe+1GVxrKlsuwGenGwfZVkVjOi8if0:wqs6efP3rn/TYGVxz3GBwRVkGuyXOM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786859488, "uuid": "6044b977-9053-4e72-a54d-548f01e1d972", "value": 5898080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786859488, "uuid": "99b64cc4-8b40-44e2-bb5a-6219c41ae0c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859488, "uuid": "9cac87b3-8ee5-4710-9359-e076f3b8040a", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a67a8ec9-9994-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786899915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899915, "uuid": "4702f4d6-6bb4-4908-9722-bc2b946e83c7", "comment": "Malware payload (ValleyRAT)", "value": "12d5dc37a44a5ff5fff6141b6ce74886", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899915, "uuid": "788112ad-9948-4a90-a475-db8ca4282119", "comment": "Malware payload (ValleyRAT)", "value": "54901fc6fb3709bce5d42302c8a5cffc1b7bb53bf1bddd2b73828e6a2c98e01d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899915, "uuid": "d45be2a0-2f8e-4a49-a8b0-699ff9243055", "comment": "Malware payload (ValleyRAT)", "value": "4be98dd4d9dc34445f57b875a9a72b190c8cf95b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899915, "uuid": "22aed0b3-9266-47bb-b4b7-6adc2271e223", "comment": "Malware payload (ValleyRAT)", "value": "fda46add4c5cc7ba8e9ccdaab587a17ab10a9eaea52738c8120bc728fc88b9ca599cefa817e24382f92d80af9fe1674c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899915, "uuid": "1e7da34e-de6f-4746-97ce-c0cc70ae8cf7", "value": "T15656D0123C5C1066E41A0330DE69A2FCF6BE6C663B30D29711A0F6BDED71B425A546FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899915, "uuid": "be762d14-63ab-4d19-88d1-d51336a5a212", "value": "0db6ec0cc5db78e445f4d8b4f6886872", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899915, "uuid": "e3893a48-cdf4-4728-b4fa-2d161c7ee6a7", "value": "98304:dslOw/acVlIX6iTfjHCQCazaDkMAFXDxzSvZ4OiZrq1DfPHNADtV6v+zM+rwroD9:dss5UalCaza6JtOvZ4O7NADtV6v+zZRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786899915, "uuid": "0f8d01d2-6877-47d2-a924-e18c8f1c4b44", "value": 6030848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786899915, "uuid": "0ff75fb6-4a31-4ec5-98b2-49605612cd72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899915, "uuid": "f77afe0a-de56-4978-b33d-aeb769a7512a", "value": "12D5DC37A44A5FF5FFF6141B6CE74886.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb087f8-9999-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786902098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902098, "uuid": "cf0284fc-14ba-4bcf-b589-81653aaf4690", "comment": "Malware payload", "value": "89847b15a62151b751436953bc82c449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902098, "uuid": "49f5baa1-fe16-48fd-b1eb-b90a90516752", "comment": "Malware payload", "value": "54c4edaa13a84018032ee51b68a577a3782ec7dfa0096c045cd5bb8211967404", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902098, "uuid": "07e8248f-2c23-4872-97fb-6e0d04295968", "comment": "Malware payload", "value": "25bc173b6efece60e4e7fb7dcc727e31c0aaf0be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902098, "uuid": "f584c62e-a80e-439b-bbce-27a55a8f9125", "comment": "Malware payload", "value": "cacbb6ac28aabed906b3badb23a2c140c00cf78fcc0c996eedf88d206c7f758ff967cc1b235c1f9d7aa99c4561753b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902098, "uuid": "f678dff2-210d-4c50-9475-9b134b5094dc", "value": "T115F58C07AE8084B6F49AA73945B70265B730FC4D973673D32E61A6B47E723D25D3AB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902098, "uuid": "cac43171-6ffc-4970-b887-59b5e6bee9a5", "value": "42efe1abd8d48a3188e7e7b82e17c631", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902098, "uuid": "18c1b791-d407-4413-86dd-67682ee9954e", "value": "49152:isBxxccacB7ByBxjwkfb2rd6qbP5kX10pDqwxp:lKcRBPkfarvDyFgPxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786902098, "uuid": "19f386a7-ca73-4f9d-aab9-57bf32217c95", "value": 3623112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786902098, "uuid": "19d9bd79-415c-4cf2-b04f-9fcd1583b588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902098, "uuid": "9cd31aac-fef7-49ec-9f68-26738e5ef8ce", "value": "54c4edaa13a84018032ee51b68a577a3782ec7dfa0096c045cd5bb8211967404.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e282d63-99aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909350, "uuid": "c667329e-b3ab-494c-93e6-0106dea07b19", "comment": "Malware payload (Mirai)", "value": "bb354aea46add5d53ad2cc59850f43a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909350, "uuid": "fbc3432c-469e-43a7-965d-aaf52d64a2f6", "comment": "Malware payload (Mirai)", "value": "550476464bd207484bb6a7dee76f37345d7502e50ff4195ba09995330856541a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909350, "uuid": "9a1d7faf-c54a-4ea1-8d0d-70698bcce5fc", "comment": "Malware payload (Mirai)", "value": "224516d6cc5621196647601a5fb387f3cceba988", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909350, "uuid": "d2a5a982-059b-4219-b9b2-4e35b22663fa", "comment": "Malware payload (Mirai)", "value": "7b38c54975ac8f2a63c46052b23ae8f340e2464c5522b1d36c98fb75f8de28a51826a87c6bb0b2f98846f1f9d2b001d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909350, "uuid": "375d8e8a-4420-4e6a-831f-5f9567f44e49", "value": "T15F33F241C07E7B15F5BD3E33B40C0376AE9058E9D1EDF662A44A4104D98B6963EEAF84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909350, "uuid": "27b1522b-5c36-4517-8f96-f84bd432995f", "value": "1536:FDRmcR01aDeF0qDWGqZNcxYFbzSl1HSfh:FdlR1qFBpqz6YFKaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909350, "uuid": "d269bf09-0e8f-45e0-bba1-e88910eed26e", "value": 55056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909350, "uuid": "af187651-181f-4f40-a82d-9a24a48cb66b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909350, "uuid": "e9f8fd02-058d-4d62-b558-8f204716712b", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d72650e-99aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909349, "uuid": "4ba0ea05-87af-4270-94a2-ff2d8761f84f", "comment": "Malware payload (Mirai)", "value": "4d54338edec7279d984cff336bf19412", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909349, "uuid": "4d7f6534-0c8f-4d41-8edd-32808f8346ce", "comment": "Malware payload (Mirai)", "value": "55fedd434e6d87e5847308fb32ee261f7f36397a7867a29f0f8afa3b38fd0c2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909349, "uuid": "a14e43be-fc8e-4db5-872e-edca7d548936", "comment": "Malware payload (Mirai)", "value": "03323c48a2584855ce6bb9bb1f65a54f3b14378a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909349, "uuid": "74f5c06b-155a-4912-a642-a793ae0e6867", "comment": "Malware payload (Mirai)", "value": "74e0e5ad19bd8dcba1f1a12478a7922914386481dd46053adb8dbfe979a4889a4b8a692ea15b94f140a0d881de8786db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909349, "uuid": "3b44fac6-a29b-484f-afa4-f459eb8bc12d", "value": "T13843F2649E42E562D7CD0CF9F512E3016E044A79B5D3F7E054380B4ABFE724A363E868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909349, "uuid": "068938b3-c245-4398-96ae-0992ef1362b4", "value": "1536:orv5KMLJgSiZc+QYGBDlffgqSa1C3qbhVuSePNUFSzHfv:o75K2gS6c+EDlIa06tVKNU0n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909349, "uuid": "772e500b-29ea-4bae-843e-b98e63ba12dc", "value": 56272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909349, "uuid": "977341b9-6a31-42bb-8494-a53573ffb756", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909349, "uuid": "59cd711f-60c4-4dde-a26e-8335af0844b4", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ff4228-99ac-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909957, "uuid": "22466a47-2e6a-4ab2-90e6-9973f5f70392", "comment": "Malware payload (Mirai)", "value": "790bbafb82e81617fd8c65d9cf4135c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909957, "uuid": "02286641-75d1-4ff7-8908-a14482dfa8bf", "comment": "Malware payload (Mirai)", "value": "57331c88aeaca7d51e143440aaf6b0a4e6755189f85dc9b4e024cfea8cf03bc9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909957, "uuid": "1b0ffed0-d377-4626-9807-91d92bac382e", "comment": "Malware payload (Mirai)", "value": "b5a7ca539b0eb385b17c1eb992c52609414524f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909957, "uuid": "79756710-f77e-4a3e-827e-0c396b61229d", "comment": "Malware payload (Mirai)", "value": "e29ca1544a5c7f96ff8b04f1adaaa8db75c2f0e0eadde99820a9159e89c4db8088535a69c6a22426612477b9efcbdb3e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909957, "uuid": "aa675961-f9a9-4484-8460-2e64e9b8b51e", "value": "T19D044C49AE642BFBC06FCE300929935721DD545FA2F2B7396278CD4CB99F20859F3894", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909957, "uuid": "5537e21f-86a6-4cce-aa03-b0bf524e3f12", "value": "3072:ir0n7JvDRcfRaOkeXCJvWRSG7tv95Vn19whH2IVVuHU5o6KH6VT1DeCs:1n7JrRcfRaOkeXCpySG7tv95Vn19wh1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909957, "uuid": "fa87ab52-7fa2-42f8-9ff6-e35e01abdd67", "value": 181208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909957, "uuid": "022e7ddf-536e-4af6-8656-3f2d6af5a046", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909957, "uuid": "b2228e06-0c43-4213-ac46-78ade87c3007", "value": "putita.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4b4dc88-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920205, "uuid": "b161d6c7-ca18-4692-8a5a-74f4e0a22cbd", "comment": "Malware payload (Mirai)", "value": "804f06095cf82a560ba6da459dc20f5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920205, "uuid": "6fce0a56-ab4a-498a-be8c-ab6175b967b9", "comment": "Malware payload (Mirai)", "value": "5790bceae3195fb874d89b25f55d3c3c2dee9fbdc6f52480fe641174f3c6d4e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920205, "uuid": "7cebbeaa-aa77-4127-9509-fca3fb90e20e", "comment": "Malware payload (Mirai)", "value": "205126de3609b2ee3b7867e5cca0012a9fbeb5ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920205, "uuid": "713be5b9-b134-4c9a-84b2-7f1f101327ed", "comment": "Malware payload (Mirai)", "value": "9fe7b6fff89e8bedca9dde1e567fb50419d6e2fea93ca03e4d76750d0c58ac51eed9f7f11a81d47e6739a908a74230ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920205, "uuid": "d44b8414-38f7-437b-9319-4b3fed66f983", "value": "T163D3E1A8F5809F62C1D4267EFB8D128C73160778E7DA33059E108F2477EB96B0D3A952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920205, "uuid": "bb6dbb7e-90f8-4029-b0a5-d1eb877f8163", "value": "3072:rponhnSMawwXHwVhQMKaRcT98a7NzqJfvK2w9qbuZI2TWsBOn236:rUhSjw5yM329lhz4y1RWsBO236", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920205, "uuid": "53c70d56-342c-4182-a42b-1e9d5f7bd65a", "value": 141438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920205, "uuid": "c2fd3a75-5d6d-4d35-b4dc-7910c5918e13", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920205, "uuid": "5417615b-0bb7-4566-9f83-29216e54396d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe708ca-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786920218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920218, "uuid": "88cfe5e9-c8f5-4b41-b0c3-4c1781606466", "comment": "Malware payload", "value": "88b3bf76547ee5dd57a52eea5c36699c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920218, "uuid": "7c728c38-ff45-48d9-a122-b7cef2e85f61", "comment": "Malware payload", "value": "58b631cd3d6f1d0c0d3e9b6d84e2a2e47c0662ce01e5b86bb53b33cf7d5c6e78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920218, "uuid": "97e6d48d-833a-4fb6-9e5a-a7a05b69e872", "comment": "Malware payload", "value": "a386d4565c87051171cb57b96ae3f77c845f7213", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920218, "uuid": "058f8fbd-1c3f-4cea-8a88-5291b368c9f4", "comment": "Malware payload", "value": "d941a749e47f2c6769b5d3538930d67207f643514e79443442287a74869d4f9a7f7a29361292abc237355c78bae094e2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920218, "uuid": "19d8f741-5761-4be5-ad15-d7f6fedc1d08", "value": "T1A504018B77005F79C276867105B78B01BBFB26D613E29252E77CDC102F55798A82FE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920218, "uuid": "5cd7935e-7cd9-4560-be3f-213d5fbdba77", "value": "3072:kgfKVeEOH4lcgjehXexcGQ8x2Eb23xD6YPhr79AlA62JmeYfwLivguvNq/xDZw:kbNR11xv5b2BDDyK62slfD4ul+Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920218, "uuid": "f9ea11fd-9ed1-404e-a1c5-6d35dbf2edde", "value": 180660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920218, "uuid": "ad7ece75-d31b-4fcd-81ba-8f04efe21542", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920218, "uuid": "a8ef9035-8d20-4ee2-a5d0-c31274bb19f9", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30019da9-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901004, "uuid": "fca91fb9-dc2a-442b-9630-7c95ee72c323", "comment": "Malware payload (Mirai)", "value": "a8788f0db3bd84e37ae7d7b8b2f0cdf7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901004, "uuid": "fa306996-d2c8-4977-9338-7657024aac59", "comment": "Malware payload (Mirai)", "value": "5965c3d68cdd84cd1fc174f3d0e0764f6c9dc8687461198d4535684cb65886ed", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901004, "uuid": "227a9fd3-b103-45b1-ad12-162fe4eef41e", "comment": "Malware payload (Mirai)", "value": "589276afefdf10b3aed2f101528fdee4f7499059", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901004, "uuid": "f278e315-fd89-43f1-990d-27a12a1384c5", "comment": "Malware payload (Mirai)", "value": "e702b4a03a16d488212347917a0e9aba072f3f0110978e431e2f2dd4187d063cd104f3d4b5e2c2f74637d5da7dd10c30", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901004, "uuid": "0a5ef869-b617-45ce-a361-ffc7953084a0", "value": "T12903F143D578EE5ADCBF20BA4ADCF742454C4E38E78482AD5AC4352B912272C7E1E0D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901004, "uuid": "145b280d-385d-4e25-8630-b4cbe2f84e78", "value": "768:/ytMkD57uIgMtSRXuXazY8/a7Afr9cWEXDiKlmcpIEWEIuPnbcuyD7UHQRj2:atlSMtSRXuXazD/a76RFRKlmceEI4noG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901004, "uuid": "2e195fc4-e02a-464c-9c0a-3d16ca1e4bf5", "value": 39700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901004, "uuid": "bc32cc10-7300-484c-b723-505b2bd1239d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901004, "uuid": "d568acbf-862c-4ecf-b715-8c612d41d005", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc6f598-99bf-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786918367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918367, "uuid": "804da7bc-1cc1-4969-83f8-75c28932ef99", "comment": "Malware payload (Vidar)", "value": "ec3cc261d190fc96c1df3cbb9ef18560", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918367, "uuid": "3b1863e9-f495-4775-814a-8bc4e8821ce1", "comment": "Malware payload (Vidar)", "value": "5a2e8cee020ee0758306925647812f4de0318d1f9dda9e225cee4943743f73d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918367, "uuid": "e15db40d-c7e6-4f97-8c53-b04fc0fffc88", "comment": "Malware payload (Vidar)", "value": "39133bec700209222816d73a2924096ca3261f20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918367, "uuid": "b0f7a7b0-dd70-4a41-98cf-0e1a169421d6", "comment": "Malware payload (Vidar)", "value": "1011f653562d1b0748200360be9be84f0aad82787ce6380e2869d2073d9d677c5bd997df641fe81fc5725423f7adda90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918367, "uuid": "264d813e-e64e-4c8a-a10b-85d268b6c005", "value": "T1C9268C07BDA409F9C1AAE335886B42167B75BC4D4B3133D32EA0AA782F727D06E75744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918367, "uuid": "cd808abe-8eee-4a60-8504-b71f51035b0d", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918367, "uuid": "e7fd6884-a670-47b8-a240-854314aabffc", "value": "49152:dlc84qGIudWeZXRZDCYxW/zk0w2n3yDCPaZyT8MPwnmIOKbHxq30jQgfH2aTU0EO:dogs2A5MaZy9IrHxqlgJd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786918367, "uuid": "8432082e-6802-47f5-aa35-ea52fbb7b477", "value": 4750712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786918367, "uuid": "b1f6c926-5784-4a5a-bedc-1b0502bc4af7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918367, "uuid": "1540856b-592c-4b72-9deb-8cb978722b9c", "value": "5a2e8cee020ee0758306925647812f4de0318d1f9dda9e225cee4943743f73d1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec8835ce-9907-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786839473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786839473, "uuid": "c61d9de1-19d6-46cd-a023-1a180601c4f1", "comment": "Malware payload", "value": "4de4a42faf8cc55c8d155a112c4f1b7a", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786839473, "uuid": "65971ea1-5836-4412-986a-b8113d6db5bc", "comment": "Malware payload", "value": "5a41a16cd4756275ce194a9495382d3cf340a2cc362de6492ac0ba6879be1d08", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786839473, "uuid": "5ee25bc5-3549-49e0-a69b-43b9ebd76aff", "comment": "Malware payload", "value": "cb3925719fe8b848fa5beea7de6d2cf54bf406ff", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786839473, "uuid": "4ea61499-4e6d-4063-9f0b-132f6cd7d52b", "comment": "Malware payload", "value": "123e7d012c7e0a2948166c8e8e84caf01669ff80d963a049524ea09e823a3b882830baf7d9ef1e2f1f3854c73e479582", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786839473, "uuid": "655ac1e3-80e9-4b48-90b8-72852a076e2c", "value": "T142663A07EC6915E8C0AED5358AA39252BF317C495B2123D32BA0F6283F77BD06DB9750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786839473, "uuid": "a9e1460b-0386-4387-bd94-27b7329dbde3", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786839473, "uuid": "72b2b8d7-e071-481d-bcc1-4f9249196b0d", "value": "49152:og1b9sC9ngVbMBojaAY+HpqXq7XEH7zipS9N/t/6RmKOP2G5p2ITV+f9Uy5MKQKC:ogpPiC9/kltG2vrcwE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786839473, "uuid": "59c91fbe-0499-4858-9ca9-23c7e8770dab", "value": 6806016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786839473, "uuid": "642db54f-9bf0-4eac-bd17-67ce37e3f7bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786839473, "uuid": "89039e2a-7693-41ef-b350-d8c1afaf485f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b8697e-997b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786889149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889149, "uuid": "1f19b530-d820-4428-8823-558c726e2a81", "comment": "Malware payload (Mirai)", "value": "0da0d4be26a787b228a511940ccbdfc7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889149, "uuid": "5b857251-e8d8-48a1-a147-16a29dccee99", "comment": "Malware payload (Mirai)", "value": "5acad233558446e16ef5e18c53081c14a143a98beda50fdce0f14bf25b0bdd5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889149, "uuid": "add27187-e342-4b2c-a8fe-3acd90cba0c2", "comment": "Malware payload (Mirai)", "value": "b9573208b51835e43212b59ae72a207d0339ee49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889149, "uuid": "a1a9194c-c694-4cf2-8013-bed25fd146bf", "comment": "Malware payload (Mirai)", "value": "6c75c5c2a239ded25a26e88a60b6c7279819520e6246b2b612390b474be1e27cf248db065cdcbff2c4fe9f2d7aad9380", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889149, "uuid": "4c97fcd4-4351-49e2-aa98-c62637ebd5d7", "value": "T1A824A51E6E328F7DF2A8C73447F74B34976D22D622E1D694E1ACD1142E6034E641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889149, "uuid": "3f8b2cae-27d6-4e7a-bacf-0a0555d03bf2", "value": "3072:e8A1G3NfhALr4/2cNkfxvWITv3T2CBBLcr/GeiznyTbInQ+y1ArGVH7Nf:e8A1G3NfhALs+GkfJPQr/RiEbZn1Arch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786889149, "uuid": "a5c723ab-2f2e-493b-bdb0-a9590d969064", "value": 222800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786889149, "uuid": "4000df9f-faf0-49cf-85e1-676653bc9549", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889149, "uuid": "f0490354-e712-4709-b5e5-3fccce4dc94b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477fd5b1-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786901473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901473, "uuid": "da001033-844e-4804-a3ee-345cdf435973", "comment": "Malware payload (Vidar)", "value": "077a7bf7e815523047c41f933bbf78d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901473, "uuid": "372f65be-8766-4273-9c21-a499344787c7", "comment": "Malware payload (Vidar)", "value": "5b941985111a28fc59006d38ba7eb2ee7015241532fe26d43445f07a2afa8d22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901473, "uuid": "1bc2cab6-92d6-442c-aa28-031f734d4c1d", "comment": "Malware payload (Vidar)", "value": "eaf24c04341ba2fcbe297438ab1a128ecbfd0f90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901473, "uuid": "c5c26bd2-50de-4ec9-96a0-a552bcfae653", "comment": "Malware payload (Vidar)", "value": "1b05a9b05923791e8a7fa32aedea031b1215bd979b3ee3b1c949b653fbaa981aad9068343825fb77e140a126642b873d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901473, "uuid": "e6af8631-59e3-4568-9dc8-0f8b5a387326", "value": "T169367D03BC92687AC4A5E73189BA4217BA68784CCB3533D71EB1BE797F21BC25935350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901473, "uuid": "704c3324-0322-441b-b46e-98c9211a6ddd", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901473, "uuid": "910b4d7c-8693-4d1d-b53b-315f851d1d20", "value": "98304:UMIer3O6CmjNM/YK6ATjdGfrMr9iwY3RvGnsPWHObXsudCIySa1Ay1SEfRs4Xwu7:U4toCRW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901473, "uuid": "9bd3454f-0a8c-4776-b891-ee654e3e79df", "value": 5246624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901473, "uuid": "4a7cd901-4d4b-4750-8bef-d4eb35a22a8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901473, "uuid": "b8b63fad-d089-45ce-bbba-7bf72c4d3acf", "value": "5b941985111a28fc59006d38ba7eb2ee7015241532fe26d43445f07a2afa8d22.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ef30a6-9956-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786873369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873369, "uuid": "d097d25d-3a42-4d52-b101-ab285258f927", "comment": "Malware payload (ConnectWise)", "value": "4ba06cf877e8573fef6636fc2f17e063", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873369, "uuid": "ceeb64a0-2059-4c21-a18c-8c979c4f8765", "comment": "Malware payload (ConnectWise)", "value": "5bc030de7422a97f388593040b49a6015421a45b1d1ef4577f2fa4722f9f6dfd", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873369, "uuid": "54f73077-95da-48b6-b7e7-2280f5a28c3b", "comment": "Malware payload (ConnectWise)", "value": "2c7e3b443fe07b86892390bed99e7e0ec7d80568", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873369, "uuid": "8267410d-07f5-4595-988f-5bfaa20fc9e6", "comment": "Malware payload (ConnectWise)", "value": "5b4499c767534d2984e0bf0b1bae9acbae9bf5ab6ad0100cfd6d79d27563b9d4327036154c40b149deef22855fcc108d", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873369, "uuid": "63039201-d306-466b-bda4-9fc09f42f3cd", "value": "T1D846E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873369, "uuid": "e1c445fb-665f-4e99-9363-022150a4bbc0", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873369, "uuid": "c3549880-19f9-44e1-927d-f53d35f9e597", "value": "98304:IzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:IhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786873369, "uuid": "824322d6-bd44-4036-8db1-dc56b3794b5a", "value": 5643008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786873369, "uuid": "2322cb21-835c-4dec-aca3-fb8cfd49f7a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873369, "uuid": "93c4d06a-3379-4970-a180-97a4613716c0", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1e37df-99af-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786911276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911276, "uuid": "b009c2c8-7c67-46d0-b772-075ae9dac968", "comment": "Malware payload (Mirai)", "value": "2b1a88b6df324e1ed013b23bd3853c54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911276, "uuid": "8371a458-63f5-4a63-820e-8dc8abedeef3", "comment": "Malware payload (Mirai)", "value": "5c3ddd2c43938befb57d753bb5ecde4133a9bda56fe165df45717aae012bc915", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911276, "uuid": "21a2883c-deb6-4389-86a5-1c4d1cbc058a", "comment": "Malware payload (Mirai)", "value": "c15161bf687f6cccb43328e856a3ff406fca241e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911276, "uuid": "e6b8ed80-9fa3-4f7b-91c2-f177bf8aaf51", "comment": "Malware payload (Mirai)", "value": "b00d37bdcb2fb04b943ef0ef69c1e27e69435a028e2309fb139ea15523dbf0df91a8fb695eb48f016f510cdf5a9118ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911276, "uuid": "cd9f813d-669d-4d1c-8481-7a877d4dacf9", "value": "T1F16302A516AD8891ED07D17B041283E6A6F46B33A421E00F76F5C89AE7331FB9853DD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911276, "uuid": "c34c6904-9a2d-4743-8a41-8403a90bc8e5", "value": "1536:T7gcMBM7BJOEb+xCH2E0RdylK48Dr2l2eRc2bwn4oVb1pUBiV1cfB8:Ts7e6c2E04K48Dr2oeRFbm4oV/V1UG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911276, "uuid": "36b558e2-4ce2-4b7d-bf79-9cf694b238db", "value": 72452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911276, "uuid": "675f4cc6-7294-443f-9f87-7ac885b1b85a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911276, "uuid": "f34141e0-a117-46ca-8632-5282427d1d7e", "value": "putita.mipsrouter", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a0ac1d-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786870063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870063, "uuid": "2c8523fb-c718-4d6f-b391-98dd5563098b", "comment": "Malware payload", "value": "e60e03c81ad661fadd6ded1d196e69a3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870063, "uuid": "8a1472b6-8584-46bf-90de-9b55db30e53d", "comment": "Malware payload", "value": "5c422b515d8bc651f0a71281623fb6129f7956886b261725bd83d0574418d7a7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870063, "uuid": "1e22200d-9206-455d-a600-39d508697e14", "comment": "Malware payload", "value": "7f86b12778739666e1b0495e0c0178b8ace507c5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870063, "uuid": "2ed35ab7-b59a-4bb7-91c0-8f0ee0658841", "comment": "Malware payload", "value": "8f9b8084b24b33949cf257dd998fcaaba7ae48e20a54f5789cc25721a1b22fc687df372a7373192ce5d86e91e765cb60", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870063, "uuid": "bcabbf5a-4e99-49b4-b5db-1106e62047b6", "value": "T187A68C03EC5529E9C1ED967089B39112BB71BC491B3123D32B90F6397EB7BD0AA79350", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870063, "uuid": "3ee2fe66-bb9c-4f70-a3b1-a32ef0eba761", "value": "98304:q1CYVqMIW0te7omSsXX9ERPUCowIQhlLMmYK3/Gykbc6IFcR7Mj:qYqqW0P4XuRUQhSmp/G9bc/sm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870063, "uuid": "45af3036-85be-4b00-93c5-9b5d5f1bd868", "value": 9551069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870063, "uuid": "de9ddf96-e312-4e8c-97d3-746517212b0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870063, "uuid": "0462bf9f-9424-4717-972a-f750111545e4", "value": "crypter_server_linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9d79c74-9984-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786893102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893102, "uuid": "4782e46c-9711-45f9-a9cd-da6126377004", "comment": "Malware payload (Mirai)", "value": "682822bb531c87ee4a0196299cce921c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893102, "uuid": "b34796e6-840e-44fe-aa0e-a959d1a012e4", "comment": "Malware payload (Mirai)", "value": "5d439f6c673ed3649e594d133654b73f9b7ec11a66254a409fb5f47fdceecc55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893102, "uuid": "2e7eb1a8-eb10-4924-8065-b4ae7c08eff9", "comment": "Malware payload (Mirai)", "value": "48f17004a6ff785f72462fbe876ab64af4a4325c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893102, "uuid": "e3fe599b-e234-49ff-9dee-a63ac81d8fc2", "comment": "Malware payload (Mirai)", "value": "13b3c3d413317b0418c547e73fe6c66c9a0a72be8572e33482825d9238bd62651290db69642b9204c066d21c41b9361a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893102, "uuid": "63666258-58ac-4ff7-bd95-75c2d19d04ed", "value": "T1DA63F1A2F32EB2BEC63D99B5599C8018ED75FA3204075F9F04CAF999C466050B72334B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893102, "uuid": "ef3a6623-1acd-4e23-b277-ca33f3b63d7f", "value": "1536:Tz35X/sc+d5ZTaNHVccCJkrjbHXLpx4r/YPZVc:dkciaBVccCJMH7f4rwxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786893102, "uuid": "3f41d199-feaf-4d15-8314-ef7d8163bc34", "value": 68284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786893102, "uuid": "aee22870-a612-43b8-91ab-96223bb4417a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893102, "uuid": "38e7e64e-f2a2-4026-ac0f-5f9269c3601a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70959d8c-9947-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786866753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786866753, "uuid": "6eaa7028-c3b8-41f1-b36d-70e37a259690", "comment": "Malware payload (Efimer)", "value": "d0dad3ca0e26691fc3ff057bb342539a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786866753, "uuid": "d75a4441-132b-42f2-8051-e7c8d239b767", "comment": "Malware payload (Efimer)", "value": "5dae582d8434a65df04c4899d1ad4b377123ca11e44905c36dcac5a7d802ae50", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786866753, "uuid": "3e1ea5a0-587e-43c9-a786-6e04e86fea91", "comment": "Malware payload (Efimer)", "value": "92db2091a27cbad295a61c652e9a9a57849536ab", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786866753, "uuid": "3e77f79b-0d8f-473e-b141-4153b72e56c4", "comment": "Malware payload (Efimer)", "value": "f717d0707208663be7b26daecc8eb7b09fdc442e25cdab9d887982bf56eeb6c37273039b37f408a6051a163742ae921b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786866753, "uuid": "af551cd5-2c68-4e57-bfa8-1ee6965276e8", "value": "T1FEE63348AAD011EAE6F3813CFE9606E6E874B5751332C5DF93AC93636E532E00D36752", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786866753, "uuid": "f63071ef-9b9b-4f77-af39-213588524ad5", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786866753, "uuid": "8150b023-44b5-4953-a1b5-503b5448a59d", "value": "393216:Z9owvPS60TLHUW6J20YX/XMCHWUj/cuI3/PGTAI:Z9oWP3G0W6E0YX/XMb8UH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786866753, "uuid": "12946d6c-814c-402c-aedc-02db680e62a8", "value": 14074782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786866753, "uuid": "bf368f43-288c-4e43-98d0-c5c1949d433e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786866753, "uuid": "d072d31a-4710-428a-9df5-2f043d3c79b7", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4cf245d-9979-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786888423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888423, "uuid": "e781c72d-3865-48d9-ab3e-e50c758ac357", "comment": "Malware payload (Mirai)", "value": "263135573b5bb2ac26b90e1a5a785816", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888423, "uuid": "836eb350-1a0c-4eb9-8e18-17cdc08266dc", "comment": "Malware payload (Mirai)", "value": "5ddf0bd2132dcb0d26ad1752f35460a930821b408c4dbba58dae587bf5bd74f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888423, "uuid": "0934b45b-dbf9-4c6d-8d52-a3c0f3b9a718", "comment": "Malware payload (Mirai)", "value": "3c4c2d1b69cb2664d24f360d7467b24b10fde097", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888423, "uuid": "506a76f3-4a53-458a-b93b-ff969c413cee", "comment": "Malware payload (Mirai)", "value": "983250a51f812c954cfedd4da0391fb1364074007312b8f63600c1c1b0e0819d2bd3c41fe41976dbe1704e76397443d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888423, "uuid": "2c4cc1f9-d980-48c0-8682-829d3e55cbf0", "value": "T1BC530104E2D45A00D6BCF3B514988A65CBD1DADFB13DD1B72EE06132C8277A9C927397", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888423, "uuid": "cbd19c04-6ca6-4383-a7e6-8a0857340f3f", "value": "1536:3/A9r4L/A38f82NdqU4tL0GjbN6DX2t/5ZaQF5+nouy8Lzkk9:3/ESgA8mIL0GjBmCZ/F5eoutUk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786888423, "uuid": "d1fd38c5-208d-48bb-9bd9-7c036b8a4001", "value": 60680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786888423, "uuid": "72c62728-cf33-44d3-9e0c-760b5e9042e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888423, "uuid": "b5fe47c7-48ce-4736-b197-c8daf9b4e2f2", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fcb96e8-99ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786910480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910480, "uuid": "2cb616c4-4310-45dd-aead-e2f786896f2e", "comment": "Malware payload (Mirai)", "value": "12bf84ffc941d9092a953636f1363602", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910480, "uuid": "4f7f78e7-498d-407c-91ff-b1dd1f95ded1", "comment": "Malware payload (Mirai)", "value": "5e13142866240eac5e1ca987bf7557c2ce67f999ac5e60c61abd51ea28b9bf57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910480, "uuid": "06e5c2e2-1cb0-425f-b170-00ca36ecfd5d", "comment": "Malware payload (Mirai)", "value": "e9c388240eed17dfeca10ed53bbf24e5bcffccfd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910480, "uuid": "7a3cc210-f635-4233-ac5d-2fe8a53b66e4", "comment": "Malware payload (Mirai)", "value": "d6efbe7f9eae25cb6cf5b9ef25829773b157a283e3ae1af20cd1dde79d7edc15a0542e0f0cfa219b518cccb82cb70525", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910480, "uuid": "0abe15a8-24ca-44d9-91e6-37bf72f2e4ee", "value": "T1CF4302E2D1356FD4E07661B9ED52800283EF406C80ABF377E5A4A30453C29975BFA72E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910480, "uuid": "68f67bb5-afe9-4382-b933-e2ea3ace3dec", "value": "1536:vkxgyInKM8Kw70gO7/BytpcRUz7HPGtyfv:v3KM8XO7/B0cRSHPayH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910480, "uuid": "541a30a0-0ee4-4846-89b8-83a5de818a13", "value": 56276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910480, "uuid": "885a9b97-a32d-4957-aa27-b9badb8fc6d3", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910480, "uuid": "efaeb10e-482b-4dee-9cb8-0c33fd75a1f3", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050a5531-990f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786842521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842521, "uuid": "72cbdad8-aff4-4acb-93f6-9d5a5d66a0d9", "comment": "Malware payload", "value": "a94c32a3fa4263e38fc8b9c290dc037e", "object_relation": "md5", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842521, "uuid": "0e427ab7-f3d4-4ef4-a21b-5daf46dd1a0c", "comment": "Malware payload", "value": "5e38d605b7cadd90534ad48097fb0f40f03d962ae2f21f702d1609ae65a42a20", "object_relation": "sha256", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842521, "uuid": "2e436da1-486d-4bed-9420-5b0dcec601c4", "comment": "Malware payload", "value": "412dc61e6dcc2220d6b46043123d25bee2b2a769", "object_relation": "sha1", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842521, "uuid": "2727772b-a65c-4d60-8534-0212a602b2dc", "comment": "Malware payload", "value": "180f5f6712f84e4f7dfb1b49092f921d03f3712b1b7e5527f8ea9452f71a4fc0a73f06bd02bf05f9d2ab610cb6a96ba4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842521, "uuid": "5fecc778-231a-4ea1-8949-7893e66dc0c0", "value": "T15A061205EBA430B9FCB79234CEB387E2DE257806076095E727D4A55B1EBB1D1CA2B311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842521, "uuid": "4e1e9834-d503-4496-9085-a27169236481", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842521, "uuid": "4edfc698-99a0-48fc-8e85-e839ac27513a", "value": "98304:rKAy+MotzzazKrocjZhzC4/kIiTLmXl89kbniJLpMod:rKuZuwNhz6IILX96Cld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786842521, "uuid": "342d88fa-2e6e-4f1b-821f-df0220c07b4b", "value": 3886238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786842521, "uuid": "1c7d9836-f237-4c57-8d0c-2abeb485f141", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842521, "uuid": "32a838c1-cfb0-4b91-8230-13ac5f9fa711", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1e52f2-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786870291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870291, "uuid": "fa03db92-b785-478d-911d-213eed4307d9", "comment": "Malware payload", "value": "fb35df2a81319c5c456369df967f3c33", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870291, "uuid": "950251c5-6d24-4f27-96fa-697db76eb8b5", "comment": "Malware payload", "value": "5e874d06ccc6bfc03061676c751f18f155a8953d8acdb5788e6c7bab1d22f10b", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870291, "uuid": "96424607-86fc-4634-8441-6f210dba007d", "comment": "Malware payload", "value": "330ae9a8bcb3b070b14bbaa5de42a3f021ba11ea", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870291, "uuid": "238ecf5a-9557-4259-9174-f62371bcef0c", "comment": "Malware payload", "value": "5cf74b17681a7ca3849d4606d71283aa98971e8f0ca201a5a47159b615d7e8bfabf9eba63d9a814243b71db8d3bbf09d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870291, "uuid": "200a0eb9-9a5d-4490-9e6a-90269e82cd24", "value": "T178B2D60E776748EDC949D43881FB9636AA72BC0849B02B3E4324EB711E95B643D3DB54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870291, "uuid": "b45f5a3d-ea23-4547-9237-ed3476886dae", "value": "5bcfd99140b04a4b24c742176fff15d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870291, "uuid": "668baa73-b1fb-4598-8f63-18077e48fa1f", "value": "384:kpUZGj9idaq1eln4n/TOdRHBx4yEyPhsfcnWnCVUh:kpLjm1el47Q5jEDC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870291, "uuid": "ac5ffa13-f180-4539-bd8e-a36917411721", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870291, "uuid": "a8b04a38-1cf6-488c-80d3-4b589e40d2d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870291, "uuid": "28c3b0f6-e56f-45af-8bad-d61eb5395337", "value": "18cb73a84c0c2684.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb275dc5-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786920216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920216, "uuid": "b9928989-37e4-4917-b986-30634f80a9a0", "comment": "Malware payload", "value": "1dcceaabfe0a54ee7afb085b22561c5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920216, "uuid": "ca395770-f3fb-474d-a5b0-7ca7e8c75d32", "comment": "Malware payload", "value": "5eb9794f1e58c92b4fca39debcae70f92a10745d78b84937dc4abd304b1463dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920216, "uuid": "6c1acf35-a8e0-4c08-9bfd-8e2d055a65f1", "comment": "Malware payload", "value": "e807fdb2c5fc7e19c1ed5c5cbd3a30ee06667b89", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920216, "uuid": "d73d319a-e288-4bbc-aa01-b0e288b09b1a", "comment": "Malware payload", "value": "27575366b894f8226b45d1eb91cd03a770d3b17c97557a6070889f1b70ddf3ccd6f82541fe677a73149426d4b8362672", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920216, "uuid": "d7722d42-08e1-4ba5-9078-966847b756d1", "value": "T13104F148FE924E97C06FDEB1464F434A19FE49EE92E2533B10BC8D5CB26869486D3D18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920216, "uuid": "7eaa409a-cec7-4288-90f3-994b1f08dd90", "value": "3072:oDTIzc663gmw4sSj2gvawexyQeXAeDgrRwFLm0EXhpie0E8NQ+torkjD0nS:rzR63rw4sStCwexuQekdwRmgdQ/rgDWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920216, "uuid": "2072b2f3-faa6-4e81-b69d-cbb2faaf0abd", "value": 180176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920216, "uuid": "d955894f-06c1-4265-b030-e0206f20bbfb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920216, "uuid": "2a270af8-ab7d-4750-a9ea-ac9e25b8bcd0", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b5a6cdb-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901372, "uuid": "029c9c89-069d-4463-8505-04eccc8542a1", "comment": "Malware payload (Mirai)", "value": "d30510ab4e42006f0a2a31c9fc889eb3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901372, "uuid": "1990eb53-076e-4dee-8b3d-58ef29c97b90", "comment": "Malware payload (Mirai)", "value": "5ec10eb88eeaeccd18a54eaa95a2e09ea15edb0b85d85c608dcbf1476f467695", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901372, "uuid": "25b35e48-ac5a-4497-b609-a7003af0da8a", "comment": "Malware payload (Mirai)", "value": "535876c61644e1bedc7eae7afb1dd93d43f97c62", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901372, "uuid": "840fae25-0c75-4bdd-9c63-f9cc0070371e", "comment": "Malware payload (Mirai)", "value": "1e6640bd5e941e70a5f392bb967097e2db95dd2572c097fa0a8159e95491cb5b137db18780227b2bffb8f394655b7b2a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901372, "uuid": "e2df3943-5a00-40a1-b4b5-3bf33b8801d4", "value": "T131C3D846FD418F13C5C321F7FBDE42987A166B6DD6FA3102A925BFA0374B4DA093A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901372, "uuid": "b2e717f5-0ec5-4dae-ba3e-89002ed09689", "value": "1536:t0twfaDFhA2TUKp4VSSjoTo6lbu9BlA/Bj+XlvrwywjBGXH0prPJ9RO1DNVvbEe6:t02sFh9pp4JUk6lAGJ15obV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901372, "uuid": "4f664dc1-9b1b-4a6e-9c45-4f7af5d09249", "value": 126652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901372, "uuid": "8aeb21e0-b359-4d88-ad4c-38a635a06b39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901372, "uuid": "651b297b-ada1-4284-9c20-dfa98b0f8e7f", "value": "eclipse.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348c7003-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901442, "uuid": "b79f932d-5d7d-4981-a0a2-5e3ee2484995", "comment": "Malware payload (Mirai)", "value": "416ba5eed54d9f26c904c91150317b33", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901442, "uuid": "239c9691-1a91-450e-84cb-791bc42b1771", "comment": "Malware payload (Mirai)", "value": "5eee1f6a29b6c1c13130ae1c2e7020dd83fc755d6b995c04e4db457e5c5a92af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901442, "uuid": "465ce627-f004-4d25-8241-df7d1135c805", "comment": "Malware payload (Mirai)", "value": "1c339c4b9433a1e5eccd62f971ba612b1e589360", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901442, "uuid": "7bdaaa9a-a353-4523-8999-4f132d8f3309", "comment": "Malware payload (Mirai)", "value": "b69bfe82b7da1c5c4303f4ebf126d6c15410af4d1e88dd66ca5c276aaf660e32c7551c9db050df633018be39679d4b72", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901442, "uuid": "81ed8ed7-4ccf-4912-8be0-a03a77891ae1", "value": "T131E34A55B8828A22C9D513BEF92E018E331367A8E2DF7213DD205F2477C796B0D77A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901442, "uuid": "57b171cd-c1ec-4e15-96e6-738563ef78a0", "value": "3072:CotWnBLigk1Tc3bCC0DvZe1k6aU6zL6EiueCo2k/:VWnligqTcrCCqeS6axIueck/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901442, "uuid": "22cbee89-c3c3-4066-8282-3bd7150f2c5a", "value": 146256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901442, "uuid": "2354895e-0fbb-4dc2-80e5-717b2a861de3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901442, "uuid": "2889898f-56b4-4258-8ab9-8b94aa05a46b", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7f7fdc-999c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786903362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903362, "uuid": "5e2b4229-4918-4fa4-af7e-b27f842b9762", "comment": "Malware payload (Vidar)", "value": "b665042995e017e86e124eb20b89744a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903362, "uuid": "5c09e44f-4c1c-4610-be90-c4fd0dd52d8d", "comment": "Malware payload (Vidar)", "value": "6021ca282713c489958b154582606c1893ce06f3af983a1ad475beff1eab98ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903362, "uuid": "6522a964-b4c1-4dc0-8944-e9a037dea8a7", "comment": "Malware payload (Vidar)", "value": "43102058300e9befe48845bb84c868ada40f92d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903362, "uuid": "97a61fcb-4de5-48ac-bb09-4a793e4eb78b", "comment": "Malware payload (Vidar)", "value": "4ea9964d3c85eef912243ffd9195b4c418a517e712adac044c9f09f6ab15129532e01c5f7c6fc07b8979906ff01d17a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903362, "uuid": "e4b93f02-60d5-4d3e-8057-893b549f0ad6", "value": "T141168D07EC9148B6C0A9A3328CB74252BB3DBC4A5B3263D32E51B77A2E727D05D35758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903362, "uuid": "a46975c0-c3ee-4c7c-aa8c-110b4e2ffd75", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903362, "uuid": "8435a7c6-f5b7-424c-ad09-4fc9313fefa8", "value": "49152:owhDFmPtRi1QP8346A2HgDbv0FaIXTeb2dB7XSzel4IGxg1pQVOdSs:oS2PW80wIXj6Dxxg1iYSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786903362, "uuid": "cebe6ea5-cb6a-4f1d-865d-54cdc3a8573b", "value": 4087136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786903362, "uuid": "12c9f410-e0bc-418f-8e14-769f9d81db34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903362, "uuid": "f2b29a71-1bd6-4ea2-ba77-235bfa7dca96", "value": "6021ca282713c489958b154582606c1893ce06f3af983a1ad475beff1eab98ce.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8f0675-994b-11f1-bd95-42010a9c0009", "comment": "Malware payload (RedLineStealer)", "timestamp": 1786868704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786868704, "uuid": "54b2dd5c-2dd7-4043-8bee-ce16e3df0a25", "comment": "Malware payload (RedLineStealer)", "value": "e989fab5128da2ce5cbbccea75b8b5e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786868704, "uuid": "b83988dc-5061-4dec-bf4c-0fa7554d6b99", "comment": "Malware payload (RedLineStealer)", "value": "612150ea6972715f8b79d20aa153e2173bf06ca8d5d99e1d706332de1ae081c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786868704, "uuid": "d96078a6-800e-43b7-b302-0f49a057c590", "comment": "Malware payload (RedLineStealer)", "value": "f1d72ea6c4d2ddcc5704bab16cbc5e3dd20ec755", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786868704, "uuid": "c4af5098-8433-4b87-9d17-2d9b1c9f7199", "comment": "Malware payload (RedLineStealer)", "value": "172cfc03abb163d86c609b0fb4e692347cbafaf8bb615a56818855dd52c73a6447c098f9094c89466de29a6f55db31e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786868704, "uuid": "bd9eb2f7-7dba-4054-9e41-f2f5b7827f68", "value": "T1C6A35D3067AC9F19EAFD1B74B4B2012043F0E48A9091FB4B4DC154E61FA7B865957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786868704, "uuid": "ce0bd9ed-d85b-4d6b-b891-4cf0b4c78e9f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786868704, "uuid": "f8b0aa2e-ea46-447f-bd40-b40de5eaba6a", "value": "1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2v3tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786868704, "uuid": "0a7b5606-ca21-497a-8a43-6a28719a74d6", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786868704, "uuid": "63fa4fe9-77c3-47b7-a06c-c7362be396b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786868704, "uuid": "84ed8e52-2575-4c27-94fc-a9e2a80c0b0f", "value": "E989FAB5128DA2CE5CBBCCEA75B8B5E1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4964efcd-992e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786855950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786855950, "uuid": "8b84d307-c3f9-4b46-a393-9216b911c453", "comment": "Malware payload (Efimer)", "value": "cc2ec7c7af5b86192311053a3cfd50dd", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786855950, "uuid": "4d9e9802-ef21-4f2a-ba1c-8bbfa3bebb6f", "comment": "Malware payload (Efimer)", "value": "627ae3be7421e6a19e5bdf028103912e8e6a47f8074705e82202672016e8957b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786855950, "uuid": "47fa30a5-e229-4601-891b-a3a48fa53b81", "comment": "Malware payload (Efimer)", "value": "770d6deede2900aa8a515845baa9e3292f8af18f", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786855950, "uuid": "f638215e-1e66-4f4f-88d6-4398344b3fdd", "comment": "Malware payload (Efimer)", "value": "be9315d121141c1d9fbab20a815356146e10268725d9b9a80a1d504e7268b5b6369f39e605d0d13d4134f8763c00c8f4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786855950, "uuid": "92af81e0-e3a7-4cb5-bb22-b2ac7f131aa5", "value": "T165E63318B7C063E9E7B3507DFAF20666D6A5B8663B36CACB0B5816356E131D04C3D923", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786855950, "uuid": "69429421-2548-4b84-8bf3-486cf7fe113a", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786855950, "uuid": "17d894f0-1e4e-4be5-b18c-3386e0f71fe1", "value": "393216:9+Qm+XbiHr08pnsCL0TeXMCHWUjfcuI3/PGTAI:kFWyr08Sc0TeXMb80H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786855950, "uuid": "95ccd201-eae7-4144-bacc-19adb14b5cfe", "value": 14082499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786855950, "uuid": "304d6d74-96be-40e7-ae20-5cc89e05683a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786855950, "uuid": "b537167d-60cd-4c5d-822b-3ac44d8ab76c", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643e3403-999c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786903240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903240, "uuid": "f80bb85f-8e6a-47f7-9e1d-7ee92cf23351", "comment": "Malware payload", "value": "e672df73c4637a226aa17af0cda2157c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903240, "uuid": "9c926a8b-1134-4aa0-90da-920210e1eea1", "comment": "Malware payload", "value": "64d5e1a8c75834211dd8bcfbaab00b87b5a85cf8db3108922bd25f84d5ee229f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903240, "uuid": "0d92d28b-a8fc-4a93-9265-3e41d5e82a15", "comment": "Malware payload", "value": "7258e79ade67f5a61452625f292a9eea54008922", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903240, "uuid": "5826bd4e-0863-4786-ad15-eada8df9d4f9", "comment": "Malware payload", "value": "f8141b6abd9257fcf28ebcc4f181660743bef6c547a6cdc21421a3c8e07bd15d888a8c014cf049cc65aa50733c4a253f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903240, "uuid": "40ae95ea-ed5e-408b-a14f-ba846ab6aeaa", "value": "T1B1F63396620814D7C9A301B6D2D7C034DB22BE669BB0E2DF4BE066131DAB7E41D37F16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903240, "uuid": "4a3f4a23-6371-49c5-ba8e-9a629974bc94", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903240, "uuid": "a4fc37b4-c875-4338-9416-69d0ad59d58f", "value": "393216:E85vzvLoWdQ2l6+9JgLaeFpWpTfuADKc/wuRz:n5vzvLoWdQm9JRe6nDSS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786903240, "uuid": "980a63e0-674a-4302-a8f3-ccc5a3cd6191", "value": 15836539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786903240, "uuid": "edc72fe3-2599-4531-aab3-565cdd1f6abe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903240, "uuid": "1017c9e7-4842-4202-b6c9-383c290a56f7", "value": "svc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe04ea2-9973-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786885831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786885831, "uuid": "0b1ae768-ea7e-450a-8933-a517d59e2524", "comment": "Malware payload", "value": "b9430aaa08ac926afdc14b6712df98c4", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786885831, "uuid": "188ee561-9d5d-4171-bc25-cb76ca84f82d", "comment": "Malware payload", "value": "655463f1d430d92a8f1d3491f4933da355b9f28efa368bf21258ed25e0f86195", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786885831, "uuid": "e5094831-4d9d-4bdb-876c-dd63ee302667", "comment": "Malware payload", "value": "8e27b7c1459714501637301dea3d723ff7c583cd", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786885831, "uuid": "5e4d97c4-7d74-4ed2-b450-059580b59fa7", "comment": "Malware payload", "value": "2f41736e725ea16b20338f109d234bfc2f594e1ffe2b996351baab95f046d012575f5b6c6c3e0f648c2dca57bc172a18", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786885831, "uuid": "6e4b57e0-ac7b-4429-b87f-95a9d0666431", "value": "T19E062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786885831, "uuid": "8ce1a25e-05f0-4d72-bf95-6e92b7d8c39c", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786885831, "uuid": "fe22ac7e-a66d-47d1-bf1e-26afa4539a0e", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnGL:+MIKhlPGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786885831, "uuid": "c639e636-2613-4c4c-b4d6-14ab82122810", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786885831, "uuid": "330113de-c19c-4aa2-b460-ea0e9d256f7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786885831, "uuid": "2c281781-2af3-429e-a7a8-643f070c74c2", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a5f6fe0-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901156, "uuid": "4f26aee1-87e9-4d14-a079-1212fea6357e", "comment": "Malware payload (Mirai)", "value": "cda180753bbd540ca1710238ae74337b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901156, "uuid": "85acd2e4-57fd-444f-84b9-c1d4a540e785", "comment": "Malware payload (Mirai)", "value": "66344e6f5309472d61a45e136907a774f1f81dc71d27f15bb3b249974d8d4e14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901156, "uuid": "51162465-626e-47f1-85cb-9f74153e930f", "comment": "Malware payload (Mirai)", "value": "102c7dee3991ad2c7f3831d4ac7088020e972d2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901156, "uuid": "9792b6a5-7e18-4778-bc15-afff3d2c1fb0", "comment": "Malware payload (Mirai)", "value": "cf573b4d26da718d0da8b3ce98fa03f88beb1fb32993a2b147158a94a4f34d08f836392f58b2f87bedd046e5716b95fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901156, "uuid": "d1fd4421-77f1-40dc-ad7f-675a3970fb4b", "value": "T1A4832947B981D0FEC459D03887BF7637C923B47E1239B29A67D4AE262D09EE01F19742", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901156, "uuid": "0cf00e0f-046a-47cb-a8ce-306c96e4176a", "value": "1536:MTHF5amJjfczdA6I+QMbtLkCkj6Rv3U8GbdGrAyvTzol:MTHJFczdA6OMhkCdRvAbdGrXTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901156, "uuid": "aed17da4-2c72-423d-95a7-9772ff5e06ff", "value": 85904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901156, "uuid": "ca9c6eb6-9628-488e-a8dd-62051d681151", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901156, "uuid": "ce7c35dd-f4d4-473f-8719-4b2b5ea7f82a", "value": "nz.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e217206d-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920201, "uuid": "20031d0e-22c4-4e09-a0df-984cc21c710c", "comment": "Malware payload (Mirai)", "value": "ca7b9e772ffbea9275f48cf37e9bca87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920201, "uuid": "0671bac4-803b-4314-810c-3641d691879b", "comment": "Malware payload (Mirai)", "value": "66a101aa8bcc7766a7524486594e3f0c4181ca920bee3c489384b4f9f0df88b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920201, "uuid": "a32391c0-5dcd-48e8-84b6-ceccb14a5658", "comment": "Malware payload (Mirai)", "value": "54e26acb8f98fdc9069e1ed7453dc514b5c7973f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920201, "uuid": "9dbb002f-e030-4192-81bc-e1d7a950c200", "comment": "Malware payload (Mirai)", "value": "1325b15270e9eddba40f41c8f427a2374b77e1a86a3f8e4b5bdc660ba1fd81e5589a879dbfc80d8e0df7047c7e6aa763", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920201, "uuid": "a7b15f59-7028-480d-88c8-42182ab051cb", "value": "T11FD3E0B9F040DF23DAC6667EFB5E668837131778E2E137028D144E6037D68A70E26A57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920201, "uuid": "892af630-2c80-45c2-bd35-ac6e67ddcfec", "value": "3072:foTTImvmBwonLVf7xHyZ7m8vpelYTCVAu1MrxXfVicwuwyv:fgIwWwonL97YrB22VicXwyv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920201, "uuid": "f5960167-40d2-47fe-85c9-0637414b92b8", "value": 142184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920201, "uuid": "80bcbe70-21e4-42d9-bb3a-de2cdf30cf6f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920201, "uuid": "4d01c6e8-525c-4ca6-a49c-a7486dfdd27f", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1324da0-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786920226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920226, "uuid": "db7453b8-66af-4d1a-b467-410691c7713e", "comment": "Malware payload", "value": "1e7a2eee486edb15bcfd533b0c869b12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920226, "uuid": "a3e4a57c-1dc5-4d10-98c4-3134ed984879", "comment": "Malware payload", "value": "66c9b3f56b6bcf21d6142b96f710b88ba402bcc3fc31cdf314ad8476f05d90c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920226, "uuid": "119887d5-812d-4137-b499-21966dd4e5ae", "comment": "Malware payload", "value": "28fb9c7174e7f5d340f2bc75fdf37a69cef78166", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920226, "uuid": "fc8aef9b-07ca-4a32-82a0-2d8781522e19", "comment": "Malware payload", "value": "a5c84dbfafc23cbfc0ca1b0898d146c30ac46b924d16e0c31c1bb980efe16fab148be25dc485297b51c1c77611f7b978", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920226, "uuid": "370eeea9-cc7e-4bce-b194-8d26144c6040", "value": "T13EC30246FEC290F0C05349B74493E396E7359F364424CA9BE7C93F26B8A9BB6460F116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920226, "uuid": "c89b2137-8139-41d6-afcd-8ef0337eef71", "value": "3072:rOlNTZa+Ef6jVfqiSHSl5678EpCaE1BVn5Rr+0vyeOXprSLbV:aPGfcV2c2LE1jf3yvZr8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920226, "uuid": "3e185690-c247-4a9a-b235-1ac9b7d42664", "value": 126957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920226, "uuid": "33334f79-84e1-4b33-bd9e-8c005c8a1eca", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920226, "uuid": "aa5fd7c5-6a92-4755-b0ef-f804af260916", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c05d41-995e-11f1-bd95-42010a9c0009", "comment": "Malware payload (DCRat)", "timestamp": 1786876808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786876808, "uuid": "cd6b7487-3f62-49b8-bf66-735898d6aabb", "comment": "Malware payload (DCRat)", "value": "204936dc11b78d2a83682f88f69608a9", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786876808, "uuid": "34fc977a-43a4-4aa5-a3f0-3921835ad9aa", "comment": "Malware payload (DCRat)", "value": "676791821fa7a173d3cfdf11087f9bc4078dc784b837158e89739728d419f745", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786876808, "uuid": "486a3b8e-1206-4957-9865-2b5f137ef29b", "comment": "Malware payload (DCRat)", "value": "8c6320f8b1b19c260e8ff5f2d1c4637c11c3efe5", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786876808, "uuid": "683a1802-e004-4713-9f3b-255bbe9230f9", "comment": "Malware payload (DCRat)", "value": "ad45ac511655535d82fcc278076187cf4359449735541ee0b1d8399be9d81b3888611d333192924dff47fa33590efdf4", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786876808, "uuid": "b005abe6-15a2-48a4-acd9-055dd8aae2fd", "value": "T1F795AE02BE44CE12F0191633C2EF491487B4AC116BA6E71B7EBA376E55123977C1DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786876808, "uuid": "e576521d-17e2-4928-9131-e156b7dcc140", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786876808, "uuid": "34247d96-3de6-475e-b028-72a1052f17aa", "value": "24576:U2G/nvxW3Ww0tMMIcb25txW+3OnnfY1At/fXcUQ73keWJj07ywAU2kopx5k1eWFZ:UbA305DIxUfNk7gjdkoLYJnUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786876808, "uuid": "ff51fe1d-5c29-49dc-b1c6-f1bec4878d9b", "value": 1898110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786876808, "uuid": "2f80d144-888d-4a3c-9c79-ac1cfe0ecf03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786876808, "uuid": "635b9439-0c92-4e9c-9a82-e8765f333c07", "value": "204936dc11b78d2a83682f88f69608a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b6d100-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920204, "uuid": "5df46555-54ea-4693-8778-28c4415431d8", "comment": "Malware payload (Mirai)", "value": "7953281ed0d741a6adf75e335115b7f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920204, "uuid": "de794d7d-b29c-49f2-b902-29b5fcf9879c", "comment": "Malware payload (Mirai)", "value": "68e3aa7b88fad3573778720be2f771d24b82bb5f67e92bc33be81e3811108357", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920204, "uuid": "aad0e66e-fd7c-4d85-9e0f-e2ad69bf7c73", "comment": "Malware payload (Mirai)", "value": "823edbde6c4e33ea9aa74a3e2480d25b56401575", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920204, "uuid": "6cc8901f-b4d5-4283-8230-6f96141e10d0", "comment": "Malware payload (Mirai)", "value": "d0d4d35b4c2223de2af752b5b2726b31871b878e35a4fa02585f3d335cf7c6278b5f94d50f1ee883564f48e07c7e439b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920204, "uuid": "927fc44a-a387-49fb-be7a-dd604c0c70c7", "value": "T174C30186FA9285F1F483543200DB9B5BEB76BD261004C66BF3487B69ADB43B5405F278", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920204, "uuid": "08de5b18-6c67-444c-9d9d-7f10c1a22990", "value": "3072:qa3z5a9yc6DKAjez6jyHquZOQg9Izqceo1Y1qR7RvdZsA:qqm101eORGOQGIHFYS1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920204, "uuid": "fb09868d-cd28-4dbc-9a53-9310d41ec5d9", "value": 127027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920204, "uuid": "66878f6e-4422-40ae-a9eb-df06bea903e4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920204, "uuid": "8e5ef99f-f6e9-4050-9433-c847626a65f3", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ef624d2-99c7-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786921699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786921699, "uuid": "57c7c851-f216-402b-b12b-ab2b9900b599", "comment": "Malware payload", "value": "e207956c1a3893e0bbae620d9271ade7", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786921699, "uuid": "123ddf0d-6afb-4653-9e4f-164b86d8a506", "comment": "Malware payload", "value": "6a052827fff8a85555c61ab47bbb2a03d14ab0415769aa985e56a9c78d94f5d0", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786921699, "uuid": "baeb3ea7-b0c9-4e6d-b78a-c82333d4e23f", "comment": "Malware payload", "value": "9802a5b91be7f30c2af8af478248e0c102394ad1", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786921699, "uuid": "7ae63e41-cdc2-446f-a105-112f61068d45", "comment": "Malware payload", "value": "6effac69867c058961b2ed445f12d4a03d51fea38ca0193eb9731c92a719d8dbb6520b1c89956a9a862aacb741397975", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786921699, "uuid": "5001a605-c76e-45b2-85bb-031d214c82dd", "value": "T16F062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786921699, "uuid": "4cd8c918-813c-4211-9d0f-7e1df37008d8", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786921699, "uuid": "ec4920f9-6f65-4d43-86d3-01cafec510ed", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnGC:+MIKhlPGC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786921699, "uuid": "19ddd84c-d859-483a-a488-61e1a2cd2a89", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786921699, "uuid": "864cae4e-868f-4d14-adfb-1d0ba5183d6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786921699, "uuid": "a49b2e21-ddf7-4e08-91a0-14223dd15cc6", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40865f22-99ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786910481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910481, "uuid": "7b88a98a-c658-46d1-b678-dae97e494b98", "comment": "Malware payload (Mirai)", "value": "31e0ad48c06bcd91fb6def6d246abb9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910481, "uuid": "45b4dd00-d50a-46b0-91f8-c24e876eda49", "comment": "Malware payload (Mirai)", "value": "6a30af3de496a4669809c306a40c31978202edd1d41314c35caef8dbf7659c6c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910481, "uuid": "d322cbe0-2320-4c41-9d06-7cc14c288dc6", "comment": "Malware payload (Mirai)", "value": "fb404f171fff9b2b585525807288e813806df889", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910481, "uuid": "2b22865a-64a2-4bd9-aa70-c630d4fee6fc", "comment": "Malware payload (Mirai)", "value": "4da6e8aab33cf4bf7b8f05e583d8c6b2139f15888a333ab4d92b1e71e74ac544195687e935932e98f85bcf63292cd799", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910481, "uuid": "dc3bfb53-31f4-4362-a9f2-1a284a6dee52", "value": "T13453012E59E1DCFDDE116D391EBC6AD6E9C33C5052033D0A0FA022ABC87B90D6952A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910481, "uuid": "29e059ef-6149-4f24-a587-174e50cbeb66", "value": "768:mejznwbTU3Oq/HjDYww1+fNFsg9Tdx8J8GUtMK/C/DJpi59IYfIlD4yXt6cyS9dB:mqnwb43x/oncd9d4rUtvADJpNGyXwUIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910481, "uuid": "8118795a-afb7-4b37-98ea-294fb3ceaaf3", "value": 60732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910481, "uuid": "163ee65c-180e-4755-aa98-844b08f69777", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910481, "uuid": "32f212d0-85f2-4927-bd96-9bb9388b5396", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0df552f-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786870297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870297, "uuid": "417d2e2a-fa24-451a-8e63-5420476bfdef", "comment": "Malware payload", "value": "a2ec00d9bdd010fb2427cda2c5675321", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870297, "uuid": "ca6c6e34-8b13-4b67-bf3b-638b2cfc16e1", "comment": "Malware payload", "value": "6a42b05979fb36651ee8cbd7e7ecd1733fc7fa6438123601118d547621d1f622", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870297, "uuid": "81675c69-8d0f-441c-a0c8-7415f216cd5b", "comment": "Malware payload", "value": "6c77428929d731518f6c3693582f7f31a9639a79", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870297, "uuid": "ac7502c1-3437-4bfc-be8e-547ac58be983", "comment": "Malware payload", "value": "bb3534752b2eababce8e940bae2cc94f2e453f7ef7de181ce660448c8321616180e9bb3af5d62f745a3b9c822ddc317a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870297, "uuid": "39b6d90a-cdd6-45b4-8329-a96f5ac2fb66", "value": "T1DAB2F80F736744ECC549D47881FB9635AA72BC0848B12B3E4324EF701EA5B656D3DB84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870297, "uuid": "81f35a3e-926f-4962-8f5d-1e364c83a8d7", "value": "5bcfd99140b04a4b24c742176fff15d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870297, "uuid": "fc8ea46c-e6ab-4a97-a35b-8557ce3a4fbb", "value": "384:aI6G09TJaaUnuQATh6lddRHBx4yktPMsMDrn6aMY2VUh:aIH0kuQL95jkVaMH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870297, "uuid": "08cd1833-89c0-4452-8990-228db7ca9878", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870297, "uuid": "aca8b179-995c-4fae-b1ff-e06f6869bc84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870297, "uuid": "e22433fd-c10b-4af9-b449-e5c26392a814", "value": "18cb7182b6e8e7b6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bb3a13-99c2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786919608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786919608, "uuid": "3491e54d-0a09-49b3-b2ce-9cdfb1592a1e", "comment": "Malware payload", "value": "7066848c97e3505b260abeb65f5c0122", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786919608, "uuid": "57bf7215-3ef5-4060-b995-3092c136ed00", "comment": "Malware payload", "value": "6b58d360729582335d241c0f35676459dd5634b85a7a4a8a634269bf2e37a7b6", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786919608, "uuid": "93347eb4-6111-418f-a20b-32fc3d764645", "comment": "Malware payload", "value": "74d0507f261c2be68cb5173f9e39f261a700dbc7", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786919608, "uuid": "5fd58fc9-ded9-4527-9b9a-9795c3a335dd", "comment": "Malware payload", "value": "a8bcfcf3583c69cdc2df712fe2733c3b8e0be86bb6e8d6c606608c3469cebd7b76488facd51a73299ec49d246259027a", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786919608, "uuid": "ebae44a8-730f-4ee4-98c8-9029bb3a9506", "value": "T17D072337F28AA53EE06E5A355AB3E21455376AA06D138D0AD6F4045CCF391603E3FB87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786919608, "uuid": "e41888d4-016e-4045-b0bd-5f16edcb1da7", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786919608, "uuid": "caeabf49-22aa-4c3e-b4cf-66fef7782322", "value": "196608:nq3IYDjEbP+HpPr7aEaIBDnqSpLiJMlLG+4ux4OkK:nq3Pc7+Hdp5WMLG+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786919608, "uuid": "c6772ea8-a4cb-489b-935b-0e90a667d758", "value": 17493232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786919608, "uuid": "a39495af-1828-4729-88b5-80a9a0aaee5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786919608, "uuid": "5aaa58f3-d430-4329-a47f-a10eb5221b70", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7daa3d-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901453, "uuid": "7223ccc3-6420-4454-ba1a-3f02a85d313c", "comment": "Malware payload (Mirai)", "value": "fb87a80f1b32c2204e93a66fdf0c4be5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901453, "uuid": "447077f2-3f22-401a-8570-5b95ba965b4a", "comment": "Malware payload (Mirai)", "value": "6c326405d6be80549c0ccb6f57a318f1c553fea01ac24bfca03fe66dd5e545dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901453, "uuid": "6721214b-cba9-4b93-867d-25119c5065d7", "comment": "Malware payload (Mirai)", "value": "d236c1dd79a7c31305cbbb19f1bef8ab4f659253", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901453, "uuid": "d6badbf8-f8cd-4fbe-8ba5-f87355e5112f", "comment": "Malware payload (Mirai)", "value": "63184ddd65ba4a5cadc63a35c64b8c7d3d8d090624f506b9fa1049d9f9e3c7efa544a76237b04a20b62e05722dee795d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901453, "uuid": "714fe3a9-95cc-4c9b-ab5d-859cc778ffc1", "value": "T143C33906F58180FCC58AC2341B6FB63AA936F1DD1238F2E76BD0AF123E4AE615D1D954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901453, "uuid": "0d3b4b11-fcb4-4598-b6c9-dfa62d2bc489", "value": "3072:j586guLRkHQo8SsGTHb4p1oB4n2pvi5zlLVPmoGHzNzQSRN6Fpjyg/jc:jrguLRkHQo8SsGT74p1oB4n2pvalkBzu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901453, "uuid": "cc976259-a556-4528-a0ef-3e654073ed90", "value": 126272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901453, "uuid": "dcfa76b2-4809-4b07-b0eb-1e8023384d02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901453, "uuid": "eea92921-0aca-408c-b61f-14b9cac40818", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40137c8-997b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786889254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889254, "uuid": "8a525b4f-1beb-4643-b56c-35706d7f7b33", "comment": "Malware payload", "value": "9233a89db4e2849be346477879db9449", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889254, "uuid": "ad949916-c481-4ae4-9eee-9c9a37e6e3cc", "comment": "Malware payload", "value": "6c3b4d7c73d4452dfe33a364cb89ff3b768589012dae26c38a28101ff83c91a2", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889254, "uuid": "84515b87-3af7-4a3d-ad88-adffe4ba3dfb", "comment": "Malware payload", "value": "fe8905f6a144e2954ba10a42c5382637317ea764", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889254, "uuid": "a0c11e57-9d70-417f-b21a-c3c5e0325329", "comment": "Malware payload", "value": "f4853e1c2af43acb9711e387e6e4da2649346d83bee8541ab99dd4b6352dce147752d9111a7f4587e72bda5c0ea35798", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889254, "uuid": "9e4d7cff-31f7-4651-a2c4-6f207355e4a3", "value": "T121062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889254, "uuid": "d45528fb-2dc5-4053-8ce6-fe29e877fe85", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889254, "uuid": "a6ad21a3-0ab3-4163-80ad-68f5c81327fd", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnG9:+MIKhlPG9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786889254, "uuid": "f80131d6-1fda-4f71-8f7a-bdd6914f7fcc", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786889254, "uuid": "113c47af-78a0-4951-aaad-5b0a143aa6f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889254, "uuid": "89e06066-a107-418b-9937-47b3294be5e0", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036d5a0d-9915-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786845095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845095, "uuid": "5b107c5a-97ae-4ceb-9997-081a01c461d0", "comment": "Malware payload", "value": "30a550f2c64f1acd6bb9621f194d3c41", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845095, "uuid": "2543b037-01d6-4d06-b40e-deca0cefa404", "comment": "Malware payload", "value": "6cad154538301583429bf7ebe03f812afa33e4d2207ce54b2e488f3cc74e4eba", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845095, "uuid": "e7673486-685f-44a7-a8d2-30e2d7b40240", "comment": "Malware payload", "value": "c5091cb20ee556f50323906f6d7fbd74a7a5f6f8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845095, "uuid": "90482c12-9019-4580-856d-4a9fef75c86d", "comment": "Malware payload", "value": "e3b6812b3a40d6499b8943261c3ccb2971ab3d0650314a969933f47f51a3f0de01e9a5828f4bccc145a01e33cd37cff3", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845095, "uuid": "70c17699-71fa-4d24-a03d-72e8752bf617", "value": "T1A7E2954F9F099665ED3E267951BA8DC2F378B1644331C8EB2D80981E0D42BCAD735EC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845095, "uuid": "92126f87-d52e-4923-9688-c2a678539aa5", "value": "92e90547a3ea267801c34c46f4b94d46", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845095, "uuid": "2c933862-03d1-4df4-8b1d-8bb4f53b2c1c", "value": "768:xvL791ok9PCiqhimnZzBeWUjuESb90sngUg/ijhATBvOt7qQUe:byk9PCbhiH+7we", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786845095, "uuid": "38e63e00-1e90-4a33-969c-8fc1f1ec27ba", "value": 31744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786845095, "uuid": "c4e159c2-2c91-4a48-b39e-27ca9c5644ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845095, "uuid": "f14f4463-ec4c-4560-b612-af84a006b4bd", "value": "WindowsCodecs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87e13920-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901152, "uuid": "dd38e7af-0b5e-40ca-8b3b-4c9a7eeef089", "comment": "Malware payload (Mirai)", "value": "de16a8647d7d7fabb995ba5f66a181cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901152, "uuid": "908e28fb-a356-4282-83c7-8d5f4a51af8c", "comment": "Malware payload (Mirai)", "value": "6dc75c31aa519a3ef822167ca00df1f35f700a504db260b4a1b8bd9d4655f92d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901152, "uuid": "c6ea119c-2a35-498d-b5c9-96763ff64749", "comment": "Malware payload (Mirai)", "value": "7b80948888226d89b065206e76c785e0c59d6357", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901152, "uuid": "487ec218-c377-4d1d-8c2e-c7cfc5772ffe", "comment": "Malware payload (Mirai)", "value": "69fbfe3cd584fb0670d90e25ffdd2f932d720d3249389cffc2df1c4a865b3171dd1474781f05fd71d160013259945fc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901152, "uuid": "13644dad-3bc1-4bbd-9b6e-53536f060cf2", "value": "T183045C46EB818A13C0D21779B69F524633239BA4D3DB33069D18AFB43F867DE0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901152, "uuid": "31b2ab90-c2ad-48cd-88ec-7e67f68e8419", "value": "3072:mUUdRu/DLaD5dPRdnJBoJuUYCyK/Ul3my3d0fM/9HGCvmM:mUFrLaD5dPRdJBACCT/c3my3dEM/9UM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901152, "uuid": "3dd78e88-b3f5-4763-a364-97ea9b9c0860", "value": 176499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901152, "uuid": "1c37044c-0a9d-4396-b533-79a7eabee023", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901152, "uuid": "cdba300b-ed56-4f18-a03c-b454b81aa2e1", "value": "nz.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e753fa0-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901136, "uuid": "99be249b-c680-4df9-9df8-766c15859fc5", "comment": "Malware payload (Mirai)", "value": "55f8cc5f7fd61c43dd1d39abc16e1524", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901136, "uuid": "4c40afdf-79fb-4fd9-b160-a574e90d4311", "comment": "Malware payload (Mirai)", "value": "6dd816fbb12ee236c1e9ad5489b3d2a5133cf38d357ef3a16e98c8fb9e89465c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901136, "uuid": "e49958fd-48f6-4159-839e-0f476f7f28f1", "comment": "Malware payload (Mirai)", "value": "42414b9f0a8d31b26406d3c8b2271de4468ddaab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901136, "uuid": "8b23ec14-1bb8-4365-acd4-0c40ca5fbe14", "comment": "Malware payload (Mirai)", "value": "9eac51bef6781a236f0267fe2efae817a5d2cbdf97aa3f4c7f2802a23456d78b4fd3292427ad6bb764b428c17a1cfed8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901136, "uuid": "3345c72b-8755-4acb-b28b-60b586be7bc0", "value": "T10A833A02B3580D43D1671EF02A3F37E5C3EFD59121E4FA89650E9A4A81B6EF2154AFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901136, "uuid": "1511c994-bb6c-45a8-8bd4-0050834117c2", "value": "1536:1ctFRPSu9eXQN5ApMOqFC+QmquYq3907yO:1cxYQ4eF4m34yO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901136, "uuid": "a50700ed-9bf3-487e-98d2-e4d2a18ef772", "value": 87728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901136, "uuid": "dbb158f7-ce01-4e98-bf6f-da20f5ad9915", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901136, "uuid": "d87340ad-f9b0-4894-ae4e-33022345c138", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45cec9b-991f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786849767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786849767, "uuid": "1a47383b-d485-4509-85a1-b5b460302619", "comment": "Malware payload", "value": "75f98ce6c078819f5f59ae462e6ec646", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786849767, "uuid": "baa71991-ed21-4ae7-a204-9a73731a8f28", "comment": "Malware payload", "value": "6e469deaa2612c6724b1796d7782ae897108593841d3630e1c64b4f8a57dd051", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786849767, "uuid": "6c283a2c-9a69-406e-b0a2-f5b29bcfa407", "comment": "Malware payload", "value": "9cbda05a8ccc4c3280588b516df34386d97c677c", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786849767, "uuid": "fb871fcb-3e84-4cab-af6f-bfbf1faa0952", "comment": "Malware payload", "value": "c665a1872c733dd7448ac933c057685c716e6708ccde4edd3fd335fdc32391d1d095e4a12b67166e8234f800b6df6795", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786849767, "uuid": "111f66c1-bc9c-4e28-9d26-58d5ae26551b", "value": "T175062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786849767, "uuid": "8b185f7e-aa8b-4fc1-b0fc-43bfad506d95", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786849767, "uuid": "cfa961f4-42f5-489a-b9f1-080e8f31e490", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnGH:+MIKhlPGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786849767, "uuid": "07da50f2-b707-47e0-ba41-16ac932033df", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786849767, "uuid": "521d2a26-114e-41fd-8b09-413d881db4ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786849767, "uuid": "bb5caba3-eb48-4cbc-a007-ebc3dc68ffd1", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f178c5c-99ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786910479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910479, "uuid": "d1428c52-3b6f-4cc2-a1cc-97c959bbc49c", "comment": "Malware payload (Mirai)", "value": "6bb3d97ea5d37884bed5e3d94915eae1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910479, "uuid": "e4eeee36-fdb2-4fbf-baef-37a645347d92", "comment": "Malware payload (Mirai)", "value": "6f5f2dc04fddbebf5d580d770212b0c555204df4991e58a856afcf8dfeb0f4fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910479, "uuid": "1d1f625d-db8e-4c1b-8b48-7c8cf13d4b6a", "comment": "Malware payload (Mirai)", "value": "bbf3d92c1228dd3752f1222262b237f2a6cf230a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910479, "uuid": "4ed546d5-8c39-4f77-ab1a-52851615e841", "comment": "Malware payload (Mirai)", "value": "071a86476c0650e65149740387eb377e800d7b75eacc34b8574277be479747b232477c8790c35c12cd9c12f4c7b7adb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910479, "uuid": "b7c425fc-86cb-464e-9e9a-c5e967db911b", "value": "T1B1C36CC5724C7EAED1833E7CC20A13176E1C9E50DC93851150B9FA47EAA72E71E26AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910479, "uuid": "967b49f0-89ce-4d6e-b417-960aba4c84f7", "value": "3072:XXBfGmTSOmFTZPviyqp7kXa1/P26SypvOrFK8QLLjyoxf:XXpiThvpw51/PxtvOrw8QXvF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910479, "uuid": "409237e5-b6b3-4cea-b63e-925a764f25cb", "value": 125332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910479, "uuid": "ab12b3d1-1475-4e17-9b47-4fad9b8b9582", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910479, "uuid": "7ae66450-6836-4dca-aee8-1bb14523d074", "value": "putita.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9517cbd5-9960-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786877552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786877552, "uuid": "f292e634-ac1b-44c5-95f9-639dd790308e", "comment": "Malware payload (Efimer)", "value": "849cdd8d1aff00a96171e09042b88259", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786877552, "uuid": "baec5c01-79e8-4598-98c8-ede5e773286b", "comment": "Malware payload (Efimer)", "value": "6f9c2afe42a6728c17658a85bca31581113a50c3207c8a6279fbf561eb1a8d06", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786877552, "uuid": "2b5942f9-c720-4ce5-af28-0b18451fbb25", "comment": "Malware payload (Efimer)", "value": "a9c6add8397698ae207f768b042da14305b27905", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786877552, "uuid": "b62ee59d-b005-4d41-863b-10e036526c3e", "comment": "Malware payload (Efimer)", "value": "b7f70c71f1fe8f64a28364d375824c54b9e9df14a69ccd91d81548fd6be7969f3c4042381d2036ef039b41dadf5ed83d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786877552, "uuid": "f0d04cdf-f4e9-433d-912a-69dfb4fd194c", "value": "T1DAE6338863D004AAE773007CDED1499AE57970B86F75CDDF47A48BE29E231C1983DA1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786877552, "uuid": "bad61d5b-66e8-4d3e-9024-d814e99a3ce1", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786877552, "uuid": "a82f42b4-d1b2-4dc9-a780-65087077dcc5", "value": "393216:mxUbDeg8Jeu3q/Yke07EXMCHWUjbcuI3/PGTAI:mxUbDWeu3q1e07EXMb8YH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786877552, "uuid": "8dfd9503-03b4-4105-8083-99ae15408265", "value": 14107832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786877552, "uuid": "ba8e15c8-107a-4443-9192-d6c951ca9190", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786877552, "uuid": "82d6f8ff-2ec6-4cc3-b484-53f168123160", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8153adfe-99b0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786911878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911878, "uuid": "1819df6b-6450-4500-b342-555c71c88aa3", "comment": "Malware payload (Mirai)", "value": "36f19915ff499a70594bfc7fdf035293", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911878, "uuid": "3c153bb1-1f94-4b9b-8488-5f35dfff763e", "comment": "Malware payload (Mirai)", "value": "70261cf6a35fa5920f3451cdaf9a0e0442ada2d8ff2b47cd8bc0d9bebc1478ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911878, "uuid": "2a8f9616-dc00-4a19-ba3c-82f57eb817a3", "comment": "Malware payload (Mirai)", "value": "06c9c6a665340c0546d1b808d577851a74392707", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911878, "uuid": "2f574dbb-15ab-4a3a-b57e-89ceeb0cf2c8", "comment": "Malware payload (Mirai)", "value": "8fed5920746f47a76d33f5e7432ea302ff02ea72247bf6888ae9696d1e5b57a479b6c8f3da58f734a17ca814defa673e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911878, "uuid": "46c97d5c-3667-4fda-b50e-107cfbd13774", "value": "T1E3148000FB081913C5935DB45B3B0776E3799D8318B9F109290EBB564733AFA9AC7B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911878, "uuid": "98e08ed5-0b59-4081-8060-4b039b2fb4a4", "value": "6144:wH0hZ8UhHY0KCU6jAlzAIminJQdU+hJomd:MTUbU49iSDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911878, "uuid": "9ac7c21b-f009-4a55-a3a0-f5fc3d45858d", "value": 198040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911878, "uuid": "fa9854ac-8ed1-4b47-90f7-8d91d4abbfea", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911878, "uuid": "49fd0d5b-a319-4498-9c84-b2d298c33a2d", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1e58640-993e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786863078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786863078, "uuid": "17c23c06-f209-4e02-b795-2f8708286746", "comment": "Malware payload", "value": "f5042b8500fbd9f8749376956facad91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786863078, "uuid": "96a82334-c4b9-491e-a642-88783dd42e0f", "comment": "Malware payload", "value": "719bac8459f8bee69f160d8545663372ed19cc8ae7376b722b0e1ec38c100641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786863078, "uuid": "c48ad5df-9532-4a35-bf1a-50e842b641fc", "comment": "Malware payload", "value": "4c926325e75910186f5090aaf84c228b5565335c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786863078, "uuid": "d4b7d92d-a34f-409c-9061-ea02c87f6045", "comment": "Malware payload", "value": "68a01f5e6e06421e9d3cd7ac683748f147fc558c3b17c9d69e1ef8fbc0f57bf64f001a8dee017b9efadd3de73dfc04d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786863078, "uuid": "94c3bfe0-7860-44a0-8575-b792d3cf763e", "value": "T1F0B2E50FB72744EDC949D47881FB9635AA72BC0849B12B3E0324EB711EA5B643D3DB48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786863078, "uuid": "dd125db2-e907-4d9e-86a5-9a534975ecc2", "value": "5bcfd99140b04a4b24c742176fff15d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786863078, "uuid": "09029b8e-5a1d-4ac6-a491-eab9cc261068", "value": "384:QpUdGj9idaq1eln4nRxjlcNRHBx4ykdPh86cnxliVUh:Qprjm1el4Lg5jkwE2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786863078, "uuid": "1f8832fc-de8a-4ade-b686-5aa8088893ad", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786863078, "uuid": "0c016557-8359-4406-a370-8a4964d05923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786863078, "uuid": "0bbdbc40-7ece-40a2-8bd5-f455fa9a4caa", "value": "extracted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ec0930-996b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786882442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786882442, "uuid": "c5ed0753-0b81-4504-8754-1acc717ae786", "comment": "Malware payload", "value": "bb0146bcdf1172cf428fcc9d5e639f74", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786882442, "uuid": "f93e1daa-cd97-4036-9f7a-4974161a3924", "comment": "Malware payload", "value": "71a2c3c354ef4d75db40f96af2d026f8be782349af68a4a2fdb7a9d57fd5455c", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786882442, "uuid": "c37f6e5c-c2fd-4905-9932-47da64001d2a", "comment": "Malware payload", "value": "0009f16a8d9f9d5f6bdddbb4691ad3df287e941f", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786882442, "uuid": "29048c07-139a-49a4-b7d8-1294a52141a8", "comment": "Malware payload", "value": "8196f7b89a558ddd6230ff766b030c162388e7b56de24ce96572dba5b84b0c26f34ccadd98f5054c45ffe6b801fd3db2", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786882442, "uuid": "052d3e1b-115e-471d-9f78-1520f0729410", "value": "T10F664907ECA915E5C0ADD13589629253BF31BC884B3127D72B90F6293F76BE0ADB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786882442, "uuid": "0a1ab355-95a2-4258-9b09-6a81bd66e689", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786882442, "uuid": "936df572-eafc-45a6-affa-bd7d6b10dd70", "value": "49152:Im536sqapyvjm39rjnC2+WKNchrp4foj5yfLXzVLrM5rjXzVJf9Uy5kKQK1K600t:ImpXBr7jefLjNrOjfT0jE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786882442, "uuid": "220f0942-2cb0-4daa-aa25-8c410d0f60e5", "value": 6804480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786882442, "uuid": "e8b92cbe-4fe0-4a81-bf0e-2f14fe4983ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786882442, "uuid": "69c5bdd7-946f-457a-aeae-7a3f276a80b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044cc3c9-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786915105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915105, "uuid": "71160e6f-b5d5-4cea-ad36-0367aa6fabe9", "comment": "Malware payload (Mirai)", "value": "9c44e29e4682345f966d54f739fc6ca8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915105, "uuid": "f5ec0780-def6-40fb-8c00-ed79e1c9cb70", "comment": "Malware payload (Mirai)", "value": "7269dd279c45b76a2954ade27ded8bd782cd40ca1e9229f531e7d011c143be6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915105, "uuid": "2eb24d7c-3c05-49f3-8746-3af3d62aed3d", "comment": "Malware payload (Mirai)", "value": "6e4cbe473eb844894caaa152fc3b94bf3a1ddee9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915105, "uuid": "b7dd2f84-78b9-4f83-93db-617fbb1e1f40", "comment": "Malware payload (Mirai)", "value": "d9c0b77dcfd59b68b21ada115ee64b20e1d9a15414f0b1f33c72b5f500865f496ea5c41ad305f4c4c6756a7c4bdbe594", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915105, "uuid": "930f578f-6950-4157-8aae-f6b20c290b9f", "value": "T1DAC33B957DE29226C7D2523FFB4F42583321629793CEB112FC2D1B603F8A16A4B77990", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915105, "uuid": "c2a33c40-cbd9-4328-b982-062c6d3199cb", "value": "3072:KzsERV8EOHrqoGuK/hBysEiOLD16m1u5ZJadPVuQlssMab/BlGH+Iys61X5hWol:msERV8EOHuoGuKZBHEiOLBG5udPhlssr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915105, "uuid": "98c87273-d62d-4b65-b403-7712a2de2ddc", "value": 129580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915105, "uuid": "692aaaa8-57ad-49e4-94ac-22dcc8ee8841", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915105, "uuid": "46aafbe3-62c5-4259-a9be-199ac6cdeeca", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1dfbdcc-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900847, "uuid": "cd8944e3-1cea-4caf-b48f-75a278fd9c88", "comment": "Malware payload (Mirai)", "value": "6d7be0c196da69eba5443d71d3820f99", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900847, "uuid": "59b76176-5378-4967-bf3a-2a70653291a9", "comment": "Malware payload (Mirai)", "value": "7349831d0b29757a9a3ffb1b11e6a2cecc8427c6e68ee7bc93fa1c0542d31d67", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900847, "uuid": "5c20ec1e-3a23-4901-be60-3a4ea81b2864", "comment": "Malware payload (Mirai)", "value": "9ac2ade3cb37db1842bf97f90d6617b86e04d0a2", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900847, "uuid": "77ebdfad-8e33-46ad-83d0-de344bd97b57", "comment": "Malware payload (Mirai)", "value": "735b16fe7e24dea904043d9eda164b4942bbe1a2cd1e4064a2f7b652cc3fb060087558f52af612aa22162dfbef7b4e08", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900847, "uuid": "ac6345ac-bd8c-40e8-8c23-0a1741706147", "value": "T10633F23267AABC91DBB0C839DE4844D703E189E955F663D07889DF99ECE5343A0BC706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900847, "uuid": "2c236f67-3e91-470f-8755-8d086959a16e", "value": "768:PyHudu2s3vpRHfccGNGQG8qW1zE97qCeuhTjo/vqXhXOyv9JNfx5CODs3UozpQ:gNvfcXNGPKUBhTwCXpvDdduzpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900847, "uuid": "7d09c13d-a95a-4693-a95c-7a7e0ebc7c21", "value": 50496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900847, "uuid": "0aed4648-a1d0-4928-8b30-9a873737b7ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900847, "uuid": "dbbcc19a-2877-4182-8150-7714bbbd91c7", "value": "miron.armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcbe5e54-9977-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1786887604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786887604, "uuid": "81b11545-9622-4653-b843-15963ac0b7dc", "comment": "Malware payload (RustyStealer)", "value": "eec176c797a642834c4c5471f6ed19e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786887604, "uuid": "deb08771-ee66-4542-a0cb-1ee736ee6dbb", "comment": "Malware payload (RustyStealer)", "value": "73b3a8a8df3bc11ebfd7195028e2946a06f276a59e85c1e00ec1e28eec219f47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786887604, "uuid": "90b30b10-14b2-4790-b6dc-5967be1680a1", "comment": "Malware payload (RustyStealer)", "value": "03dff37f5d8fe0144ff7ff8b581966fce5f16550", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786887604, "uuid": "fca422fc-5c2b-41a2-8f1f-87ef78aa2f33", "comment": "Malware payload (RustyStealer)", "value": "d0318e5fc549c91cf10e88e020b63004fb42464c3674e53aaba026ac2fe89b7b82206ec9debd66d53616b8e106d9de2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786887604, "uuid": "cc562ca6-ae0c-4053-b9f6-1c0fc668e8e5", "value": "T10B74AF25FB9064FDE167C038C2514A66E7327C890B229AFF336442392F26AE15F3DB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786887604, "uuid": "ab9ba4e9-a998-4e31-99a4-907043feb2c5", "value": "ab93e559ca3b11a2503c624216437bba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786887604, "uuid": "8b3afb8d-4608-4740-9856-3f2ee5c2259c", "value": "6144:VWbLT1Dg5NSQthy7b9FVdgCxS8mi7X54+W3qZoshdUZf:CPpgzSQtqFVdgCw8tZmqZoCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786887604, "uuid": "90d8b067-7260-4180-aaf8-235b0c67d210", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786887604, "uuid": "12de17ac-0381-49e9-a3cc-e61bf9c7f0f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786887604, "uuid": "7117b189-078e-4a95-8aa7-7c668ab1501b", "value": "73b3a8a8df3bc11ebfd7195028e2946a06f276a59e85c1e00ec1e28eec219f47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358c661e-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901014, "uuid": "6991e777-9b9a-4f04-b600-307d3efc2215", "comment": "Malware payload (Mirai)", "value": "990ce867e771b4d7d60079fcc1b0fa77", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901014, "uuid": "d26b6ff0-0f25-4087-9b8a-c84ca11016c0", "comment": "Malware payload (Mirai)", "value": "74456a082d851e2c92d2173f2a116af8cebda7911ebdcaa63c4709692fd037bc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901014, "uuid": "63aa1168-680d-4b09-ac6c-6f5390804ab9", "comment": "Malware payload (Mirai)", "value": "6dfa7f481b33d77f1b81d805fc30c47207f37ead", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901014, "uuid": "686bdfa3-8741-4743-9365-c93966cbc5d4", "comment": "Malware payload (Mirai)", "value": "1ed9595866d5781aa0bd3ad879996d582eb9bc47e6130aebad2b63194293d6a74c84044a76e16fe0ecf94d8f31e824af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901014, "uuid": "6722c28f-2c3e-4ca1-9d07-3d40d3b6cbc7", "value": "T1DF9328C6B401DC7EF40FDABB4463290EB631E26116931B27675BBD93AC321E05917F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901014, "uuid": "b4c386eb-6b75-4db8-bd59-6cde067845e3", "value": "1536:vQ1JsIO7ywe3iypZjPoRwQmEC/CxFlYO9FWeLU4xPP8bcjqL0n5nvt00z/TPVoPT:v8ZTormEC/a/weLU4JrGQnF0qwWy534e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901014, "uuid": "330c9584-815e-4f78-ac59-b00b53620bd6", "value": 96724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901014, "uuid": "15666dd1-82e7-4db4-91ba-647f5176762b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901014, "uuid": "2045b5ae-7b1c-4b26-be1f-7d52acfc2b03", "value": "nz.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a335772-9941-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786864004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786864004, "uuid": "b705209b-9928-4abe-8c5c-82ece7b9d3f7", "comment": "Malware payload", "value": "ae18c1d4c904367e7e159272dc6c5dd8", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786864004, "uuid": "578377f4-787e-43ca-8e20-1187da0601df", "comment": "Malware payload", "value": "74713749688da72db5b6a39502dfca2568e0805552943ab1f2c59cbd205f0a3c", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786864004, "uuid": "0ef3e277-d29e-454e-9a6e-f11f2f03547f", "comment": "Malware payload", "value": "853d11fc90b4ffbb17331e6458aefc658f338012", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786864004, "uuid": "0a9694ac-69a7-477c-a2e8-a1e5c682a54d", "comment": "Malware payload", "value": "ecd0cb2d34790e772eba6faba03bbdde36b08f533491b89786781cfb10395501b150c1d2e03376af9561a2c57440c315", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786864004, "uuid": "e45602de-c99a-46a0-a1d4-53781666e4fd", "value": "T170062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786864004, "uuid": "69abb321-b6be-4e39-945f-5d95d0a717c5", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786864004, "uuid": "ff9eefb3-7eff-40d0-9c2f-f09b7df46892", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnGu:+MIKhlPGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786864004, "uuid": "0f3188af-cbbf-463f-a283-bd109d25b431", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786864004, "uuid": "e7ff2d37-361f-4605-8399-5999f18e9bab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786864004, "uuid": "766ab9fa-02ef-4d12-8b78-ec65742999d0", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c013ea2-997d-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786890019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890019, "uuid": "7c96a630-cc20-44fc-a87b-9c745bb21ae0", "comment": "Malware payload (ValleyRAT)", "value": "66b27e9d6b49cec6bc53e37ac4529960", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890019, "uuid": "1fde53aa-b3ca-4f6a-97e5-4933786937db", "comment": "Malware payload (ValleyRAT)", "value": "754c52330d3a560cad89314d7ec652dfb239f2ba1610734261195f3cd64c298b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890019, "uuid": "6c871389-ea16-49e1-9c5b-1ead98c6a89c", "comment": "Malware payload (ValleyRAT)", "value": "3f69f6f8169f2f5c1350236e44a43a8c576bb499", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890019, "uuid": "860e1ebf-2cb3-4274-aee6-4ba797cdcc4c", "comment": "Malware payload (ValleyRAT)", "value": "2ab5cef3feaaa455bfddbc3368aa9264bec22b44fdcf054c4a2aec9049f2c90ef0ce7f6dc7e20f17b37a9f2f8537e01a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890019, "uuid": "ea8d13b9-4a11-478e-89d3-47f4a4158a6e", "value": "T1B346CF173D5C00AAE05A1233CE59B2ECF1AEBDE83B76019715A4B71EFD32741CA2456B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890019, "uuid": "dcef22f2-32e5-4592-b766-3b2dda55913c", "value": "cd05b47cee90842fffa772636d8cfc8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890019, "uuid": "8fd8e23e-9b52-41f6-b1d2-9310f7ee91fa", "value": "98304:GgWh7V40Yl94AvfqeapSkMdStt1qx9ZkRuLrrxIZ4OiZrq1DfPHNADtV6v+zM+rX:GgU1o59Stt1qxvkLZ4O7NADtV6v+zZRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786890019, "uuid": "f7f29e01-c43d-4f1f-9d0b-cd5be8884c72", "value": 5756416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786890019, "uuid": "55390ac1-3974-4f31-bffc-2b869da60dc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890019, "uuid": "916c0151-2a83-44b9-b177-359ddc18c4ff", "value": "66B27E9D6B49CEC6BC53E37AC4529960.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c1c549a-997f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786890824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890824, "uuid": "f0c8640b-0f8a-44e6-8b13-a582d910a2a8", "comment": "Malware payload (Mirai)", "value": "588ff9dab9c440f3e58e15287718316a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890824, "uuid": "b0107221-39c2-4af4-8014-af97cabc5f54", "comment": "Malware payload (Mirai)", "value": "7652604258ae44a74dff9735038aa3d2300d629082e923aad213bdecceca90af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890824, "uuid": "4bbf10bc-6f1a-46d0-94c6-251b446bec23", "comment": "Malware payload (Mirai)", "value": "dd2bc264867449283981545d4dfd35d72f766ed9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890824, "uuid": "cfefb181-5377-463e-8e7f-594c087b6f53", "comment": "Malware payload (Mirai)", "value": "243d8ada6eaa030cf45cb693369a4a3e316977ed34d61d9f5bccc01a87852181df852149d58abf2c00a0782f5faf8a89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890824, "uuid": "a64de17c-1390-466e-9acd-15af01dab5cb", "value": "T1DE73029DE4ECB8D7E78D47F5A18A55B15323A650B29B27CE4BE988C4F3060CFB21215C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890824, "uuid": "954087d5-a913-473c-b55a-42fc69e799df", "value": "1536:HCCHeTwL9fZlEMJDJdAi2NF9a1cFyUyTWEAxSAeucSsxM5MoS9iU/Da32O0Ud:iCHeam+JdAi2N2q5/eEsxYMb9iUgiUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786890824, "uuid": "4da9600e-a955-4848-b035-f171878f14b8", "value": 73560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786890824, "uuid": "90529a59-9487-4fc4-9e5a-2e9f72a40731", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890824, "uuid": "3e1df1ce-4e30-48e1-a849-65a90101ac5d", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b35332-99aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909247, "uuid": "90e8e222-74ca-42ca-8f20-32f8cd630dd9", "comment": "Malware payload (Mirai)", "value": "f9138b00062fce6eb4ef59b2971e8373", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909247, "uuid": "04f4787f-fb06-425f-9f9b-93eda6ebfe4b", "comment": "Malware payload (Mirai)", "value": "76a78cbda24cca38ee344c08179477a2aff3dc9120714d041a73d4a3a0c5ce9b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909247, "uuid": "b39850e4-27de-4c78-97a3-9b141045133d", "comment": "Malware payload (Mirai)", "value": "c0d909ba2572cc3695b219542c8b6c49c712439d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909247, "uuid": "5642a267-7202-4d3f-8666-bcd77c71074a", "comment": "Malware payload (Mirai)", "value": "9b318f1549394d04d3b3b57c7a989adcc745986b5fa2dff08d11caa2c0948844843ffeb03bffc1d51dbc1b2d5acdde7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909247, "uuid": "74952192-fdc7-4d0c-839b-6f63531254ef", "value": "T1F8F34A02B30D0943E2632EF43A3B27E193DFD9A124F4F644794FAA899271D325586DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909247, "uuid": "afe09ed0-9172-494b-ad45-5622a4b12540", "value": "1536:EYMu7PGfo4ow0kGnyxzzqlzW/sN6d7Ep8Ocus3FXHjySSQT0K0ZZgqLvAjtZcD0G:BMuagsxlSQgShTqZ2jEvWHqB1Xa7q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909247, "uuid": "2903085d-2d19-4e7d-b4fd-9330dd5bfb9e", "value": 170780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909247, "uuid": "49ca48ec-6193-4799-baac-f52f7ec08cb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909247, "uuid": "64eeb1d4-a31e-424a-a2cb-16fa1150937d", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cda1e5f-99ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909777, "uuid": "5462a786-bdcb-4345-a4fd-41ace56b16ce", "comment": "Malware payload (Mirai)", "value": "e8be5105f282dd6b19a1251dd51aac54", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909777, "uuid": "0394f5bd-dd2b-410b-bfcc-40b8a97e63f2", "comment": "Malware payload (Mirai)", "value": "76bbc4ad7e9fe86cc9543029e90ba78c8228a5615f2df52e3a86ce452e8eeabf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909777, "uuid": "27ca00de-726c-40b0-afbe-70e0c78692e7", "comment": "Malware payload (Mirai)", "value": "cbd62f970cbe577f2068af9e161cf16899858861", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909777, "uuid": "db203347-1d6d-4e74-84e6-85e9e962ffcf", "comment": "Malware payload (Mirai)", "value": "11407b2af2320b62a0c94d55f36f275d27cffb0bbb3176bef399aa635fb075836032715f9c1c6c61633a0b08bc0792ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909777, "uuid": "f5ee11bf-9cf1-4f15-9cc6-51d2df4f9b9b", "value": "T11904AFA7B30B2054C96206F817CB4BAD3A6311418FEBD5E7AC2E763A2A775DB1C053D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909777, "uuid": "81767213-8619-454c-9930-cf8b22f33117", "value": "3072:KYqT3XUyrL3j59+kY09t2K1ZHJ40WXLggCxSvrFCKHDVq:KYqTnUyPe0mKLeTXRCxSvTVq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909777, "uuid": "2c3a95f4-31d0-4359-a71c-6e5f783fc936", "value": 173592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909777, "uuid": "e6f3d98e-48b8-49c4-93bd-02a526b60a87", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909777, "uuid": "4b705fe6-93cb-457a-9fd9-76747600e66e", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ee2027-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900845, "uuid": "2773c544-1615-43c7-ba70-3710ab9eb7e8", "comment": "Malware payload (Mirai)", "value": "896e6673780f27d084643e71fb5ead9f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900845, "uuid": "5198d3c6-b4c5-4720-9d32-ba755041d105", "comment": "Malware payload (Mirai)", "value": "76bd0622efad1a26e1779a7983513c103537b96c42cda04f79573c179defded4", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900845, "uuid": "15849bbb-c9f5-4eb6-a90c-4f3fe6f987eb", "comment": "Malware payload (Mirai)", "value": "06822dbededdc9fe0e6f53608baf5ea3852b5504", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900845, "uuid": "a90f29dc-7130-4de6-913b-8110630a5e06", "comment": "Malware payload (Mirai)", "value": "fb0fdd98c4c0472fb5538313e7a38089e7bf8aa81ab6428b76001e30a66fcfa7891e29c02752394b9623eb906c2b902d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900845, "uuid": "c64cfc41-30d3-4db8-a3ad-6e8742afda42", "value": "T1483301A4F71BC910CDF08D747A19CDD9F4992B3DD8BFB53B010C9274A5A7006A39A4CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900845, "uuid": "2f1170b3-7fcd-4007-b802-35c69892b502", "value": "1536:lqA+OxIMJr4pcoexFX1uA1vbAmlGxP4OLU:lqaTl9X1Lv3lk5LU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900845, "uuid": "f4a1b3ae-e700-49d5-8394-c01a8dc0b171", "value": 54728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900845, "uuid": "115956ca-224e-47e8-9208-3acdc79ba455", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900845, "uuid": "7cbeb197-34b9-469d-ac07-86adab9edbe8", "value": "miron.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37131bf2-9936-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786859355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859355, "uuid": "cd251fea-5c24-4d8f-bc92-6df1d57f20d5", "comment": "Malware payload (ConnectWise)", "value": "853127445eba58f0a6a19a2b7590b91f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859355, "uuid": "279cfd4e-dee1-4d95-9afd-121e7ceeaae5", "comment": "Malware payload (ConnectWise)", "value": "7759ef88fc4e3eac81bac5e3e7768f8b2d2f3749a3379343c4f444975b2e0063", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859355, "uuid": "cbb7561e-ba47-4331-92ee-0041eb709fbe", "comment": "Malware payload (ConnectWise)", "value": "2d1a86072878d37552d55b6009f72ed25f442302", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859355, "uuid": "68fbcc7b-432c-4d8b-9d7f-7041cf6d6332", "comment": "Malware payload (ConnectWise)", "value": "0ff10084b3ad0be51d1b02b77ea1b999fd8b6f802cf29a2940a551e5a4c4ef927cd9751efdcbb33e1dc862b88f39daa6", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859355, "uuid": "9fd05411-ed72-4ae7-aebc-843a5589dfb3", "value": "T11A646C11B9C48432C673383107B4E2B28DBDB8302D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859355, "uuid": "ae38cc53-f2a2-4990-a145-16fce6c5d2d3", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859355, "uuid": "da92df81-5edf-49f8-9d1b-cf8c17e45a94", "value": "6144:9mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFti9ET:41iw7gryNkSV1hy1Z1u2JLI9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786859355, "uuid": "b48fb8a2-2bab-46ad-a48d-323cb8d82f2e", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786859355, "uuid": "2e9692e5-77b5-47eb-84de-7ac0ffd5a4ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859355, "uuid": "071ef39b-97c4-409b-9017-b4db5b88e48f", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c48ecc-9919-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786847085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847085, "uuid": "328f985a-54cd-434f-8fd5-54e19e6fe1e9", "comment": "Malware payload", "value": "04933ea6ce91169b03d5a1dc28ac9959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847085, "uuid": "547f1439-ccf6-4d96-b68d-a0ee157fd884", "comment": "Malware payload", "value": "77981cb7370daaa409e8bf4cd370177515bd0960243c3bfd8ef2b4fb2b190bd1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847085, "uuid": "12fd1ca8-ce41-4764-9906-41f24d3f717b", "comment": "Malware payload", "value": "e7be100d8b31f8b0c42a06c44abf8b595d0b123b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847085, "uuid": "eddfe969-43b6-42ee-a06a-a90b504dc5dd", "comment": "Malware payload", "value": "a9f07e3ce4c40f136d18905ea76463eee880949f4a026022306a41a19c386f7aa64454ea976cb1967c902bd904227564", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786847085, "uuid": "0cf6db1e-3d81-4454-8c72-5f17cc5208d0", "value": "T1D0D5238935BE29BAD437C3729FC5E46EB0193BC0C7754E9B3A8C79109D126906C3A379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786847085, "uuid": "24536fa2-a572-4715-8de2-8226aa797050", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786847085, "uuid": "b307bf7a-9e20-4cc8-babd-e3ccd48db42a", "value": "49152:e+ZFWoOWdKpuOFY3E80rIcAvH6b6Egq4MV9D8TispzRnno62PedI3BPn1swkq337:eIFWo9iE0rIcAf6GEL4W+PpVo6M/FBSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786847085, "uuid": "081d4b55-515e-4ac2-a2f5-f74d90863065", "value": 2958848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786847085, "uuid": "367cddc3-e9c5-4275-b47c-ba5a9abb2f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786847085, "uuid": "ecc79d76-ac37-4053-bb2a-64ca376a7abd", "value": "77981cb7370daaa409e8bf4cd370177515bd0960243c3bfd8ef2b4fb2b190bd1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2609e719-9994-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786899699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899699, "uuid": "285286e7-cd1f-4769-876e-69f46b220aa2", "comment": "Malware payload", "value": "53cd44fda7f19d0ba1ecae167192a277", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899699, "uuid": "f1459e02-e50a-45a4-a196-7d456e5adaf3", "comment": "Malware payload", "value": "788c34e54ad582eed5b3a3e3b5f307d1b30c2e8942ef5993f749204515a05679", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899699, "uuid": "027e3f09-7973-4404-980b-48c6d6753f8e", "comment": "Malware payload", "value": "e96e985deb045261bd32305c6367eff3518671ba", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899699, "uuid": "7e8ce1c5-989c-4a16-ad63-b4ab36b465a7", "comment": "Malware payload", "value": "e75f32ba6d767ca74a767ed844984ee6813c24a2c090f753309654b24839ebd6eba740f91a156698046383aa33d879d2", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899699, "uuid": "4698d858-573f-49a3-95b1-802bb35f690d", "value": "T19C2833AF4346C856E70EDFF71E95B7A493DA4AC4830DCD0A4CBF243AC5259A148C3B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899699, "uuid": "6f7dbcb1-31df-4d8e-bb50-87b086952595", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899699, "uuid": "d858ac95-bce3-4907-bf2f-2138fb0aea88", "value": "1572864:3g4g26eBgBwhh6C5LzZQMLiOeuoba+tWwxh1yebsYipy+t+oKg4L:3g4IygBwhr53ZQ5VZ1xh1Vxoy+tHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786899699, "uuid": "8f3cde09-776c-4761-90e3-bd6ffab293a4", "value": 96538301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786899699, "uuid": "a705e347-dd61-42af-8a31-c33b871b59f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899699, "uuid": "077cd317-55fe-4b7c-9c91-7e3444574f4e", "value": "WatchVexSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a3f2a6-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786915113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915113, "uuid": "27478675-c37a-4deb-a127-7d2719670ba7", "comment": "Malware payload (Mirai)", "value": "e94907a2737e0aa38efd08337b4ceb39", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915113, "uuid": "e3620bf9-7650-46e2-854c-2015b8a7d9bc", "comment": "Malware payload (Mirai)", "value": "7a4ec49e15f8a707fbad1497b4481f9cf4ad8ddf1efcd8bfee52b953467e3ded", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915113, "uuid": "77d22a0c-8c20-4fc9-8b69-c2feee1f14b8", "comment": "Malware payload (Mirai)", "value": "96d4704e441e8510fa004d70d37a5952045fee2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915113, "uuid": "9023321e-d9b2-45d7-a841-ac80d468cf75", "comment": "Malware payload (Mirai)", "value": "272ab79e1c12751534f43a739a1dd2c31ca0ce65581afae084b5ce281155711f722e68658d1ff2b672eb45c5c594a1b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915113, "uuid": "7424a246-2169-4176-a1e7-fd279f745cd7", "value": "T1C354D80AAFB20EFBD86BCD3706E51606258C641722983F35763CD518FB4B54B4AE3D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915113, "uuid": "8253ffe6-7e78-4792-a097-4d931d4fcd03", "value": "6144:iv5tHndHiDrKU2rybKaNYrkt7VOlssM7khWotu:iZHiLeaNAlssM7khWotu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915113, "uuid": "39475d36-3a15-4e3c-bdd0-a82bb6b15f2b", "value": 296800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915113, "uuid": "d4abbbc6-15f8-479e-8ab4-63c05db1647d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915113, "uuid": "7ccbd28e-71c6-4901-8b04-5ff5bdcc56b5", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b6467a-993e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786862834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786862834, "uuid": "a41906af-08c9-47d3-9ce7-76a3b5e26629", "comment": "Malware payload", "value": "9428d170875f6b96e77f43510649b116", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786862834, "uuid": "6b5a2aa2-2c0e-4bde-ba3f-dc5e3a8f7769", "comment": "Malware payload", "value": "7a9f8afbe39560ea52daada8700749371f189345aa7ec213dbdb537387c01d79", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786862834, "uuid": "26a76c55-e264-4d0a-bd4a-9c3d783b9515", "comment": "Malware payload", "value": "4f87706ea1e555eb9dde5de78d803c619eea8f4f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786862834, "uuid": "30876988-7ee0-40a7-b606-da9662813155", "comment": "Malware payload", "value": "1c24e6f5dac74e99e95923692db90199836fcc06eeebea24d230f6e5c3177fe8103e65b20e81de6ae03aec89533cc760", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786862834, "uuid": "28de9b20-d518-456d-acb8-3c84146162c5", "value": "T1EFF062631394C89881E46820A339B4E2C47B789A300D8D40F6E5DE09D634F59B28C1DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786862834, "uuid": "057f54bc-389b-4206-b309-2ab4bce42e36", "value": "12:eR9Q3X0oOZzjrA7rE5c9D9OzbkVnsEL3cFhsMeVM1TPUXSbCMhe:Y9Q0fjr8rEK9hpceVxX+Bhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786862834, "uuid": "4145cce7-6bf4-4956-8194-10f355b82a83", "value": 645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786862834, "uuid": "11606c39-ecd3-496d-a6fc-1ca3ac1ea358", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786862834, "uuid": "1111f512-4cbb-494e-96c4-ef041f40dc0c", "value": "s.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c524aa4-9994-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786899898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899898, "uuid": "b0c13565-152f-4cc3-b080-a3c2d7a28d10", "comment": "Malware payload", "value": "a352453dbebec7217e46ebd8e96711fe", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899898, "uuid": "47fc6ef8-aa5a-4900-a9f8-0638f2de732a", "comment": "Malware payload", "value": "7ac38b9717f9ba42d91c532138facce0e1a6d54d7d9c41224d851c7ca23bdd5c", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899898, "uuid": "57fbd453-3453-405e-8428-52c7f86c7d48", "comment": "Malware payload", "value": "deb59d791991ab3d49de23cfef64722160e563dc", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899898, "uuid": "5b77b3bd-30d2-4a09-806a-f79a3600255d", "comment": "Malware payload", "value": "0e55698c0783b3e2740ba74e6356082c838bd19951735a7eb271be38665587c5b75149dde1a89d5a51c89cff48805bd2", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899898, "uuid": "d0d3e0fc-1ede-4b53-8ffa-1f18eb3a4d39", "value": "T120D733477E05152DEE944A7EB89C04340F9EAF9224C8D29936977FEEC237065E0EC672", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899898, "uuid": "bd1d2d3c-9857-4b0a-9dc3-b39e540bdc0e", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899898, "uuid": "b246e6bb-198f-4abf-967e-281702e95fb0", "value": "1572864:iZHV1JDcBQdhA4gZJ/fJoWsOeUxTecValmIs0:ilV1JYBQzf0J/mj+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786899898, "uuid": "a4c25198-c2d8-47c0-9b38-8b4027033af5", "value": 60611928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786899898, "uuid": "a3c50e9d-6814-4b12-a2c9-0294745ed70b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899898, "uuid": "6d2239df-fa1d-47d8-8cfa-257cfac895e1", "value": "KippoApp-1.22.333-setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496a5e16-9916-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786845642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845642, "uuid": "5c374f81-f737-49e7-8613-299c0b28bfb6", "comment": "Malware payload", "value": "f47eeffe18cd8408a4e9d29657153103", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845642, "uuid": "e574b82a-4a53-43e7-93eb-311e14e4e64b", "comment": "Malware payload", "value": "7c6fb4950a6e538393af32d3bbe443b102d37b483e5ed04e9c2cf036cd001d90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845642, "uuid": "149ffc87-51b2-45e5-bfd5-14a7219cc773", "comment": "Malware payload", "value": "d849d84051388a39852b87a24426448890988abd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845642, "uuid": "8e8aa700-4f47-4638-be84-238a7ff2d6c2", "comment": "Malware payload", "value": "365e9934f9de9de63cdece15dfdacacce13d2839bce594175d9344f7633fc13ee04e9d14bb3182494dcfc0cc15a173a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "SnappyClient", "colour": "#CED2FE", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false }, { "name": "YodaTeam", "colour": "#165E22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845642, "uuid": "97376c22-8de1-4d0f-b148-0f46b0411a9d", "value": "T1B29633237B8058F5EE688A308F0EDB888677DB685573890EDFB96C1A2C5345192C73D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845642, "uuid": "37cd913f-22d8-490c-9ad3-1075e05ead56", "value": "b5a014d7eeb4c2042897567e1288a095", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845642, "uuid": "b974b2e3-723a-4349-9e18-421d466e7297", "value": "196608:+pS/Z9zS4/dUzD2xT5QJ3LBkSJN/IODnw:+pC9z91boLB9/IOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786845642, "uuid": "09f97273-6090-4eb4-b843-19153a2e3227", "value": 9296117, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786845642, "uuid": "08842333-bafb-4b23-ac4f-55b03967858c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845642, "uuid": "dfcf7303-1bf4-4d18-b276-c007dc961a63", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1153ce-9910-11f1-bd95-42010a9c0009", "comment": "Malware payload (LummaStealer)", "timestamp": 1786843100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843100, "uuid": "9e1b1bf9-120e-4c4f-a533-e66ba0e860aa", "comment": "Malware payload (LummaStealer)", "value": "385f52df34c0e3f7f8f3602afedd70e3", "object_relation": "md5", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dist-binarypilot-cc", "colour": "#299FFE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843100, "uuid": "17267eb9-e209-459c-b381-40cd1b7945f8", "comment": "Malware payload (LummaStealer)", "value": "7f11d92a1fc25ba81f808b62a075ccdfe06d441fcaa5adad483afc7508ee5000", "object_relation": "sha256", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dist-binarypilot-cc", "colour": "#299FFE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843100, "uuid": "1053a6eb-28c5-4146-8d24-9f63eb1b8cc2", "comment": "Malware payload (LummaStealer)", "value": "c96212fa882a2dc432e99b88fe62b7358d777b27", "object_relation": "sha1", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dist-binarypilot-cc", "colour": "#299FFE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843100, "uuid": "6ae72ef1-1e55-4297-afd8-074981de50df", "comment": "Malware payload (LummaStealer)", "value": "6aaf7105e93fc4687f69980cefa41ae7460dd42f8845702c995fe1ad32e0d8d4faf394d62a1cb0d83e8a02c750e9bbf0", "object_relation": "sha3-384", "Tag": [ { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "dist-binarypilot-cc", "colour": "#299FFE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "not-LummaStealer", "colour": "#F68586", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843100, "uuid": "9e14c715-dc1a-443a-9c5c-46ad318564b6", "value": "T1E8F55B01FED784F6DC032A3154A7626F6335AD090F39DB97EE543A79EA73291086370A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843100, "uuid": "c7deb143-4731-4013-8d83-9f3a7f211009", "value": "1aae8bf580c846f39c71c05898e57e88", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843100, "uuid": "0fa5db1d-dc5c-4d47-83ab-d1b7d30caa6d", "value": "49152:5YKVdU5e113JH8ujxmEuHckO6xC9RbQxrXh:6iUE7WuVm3Hc19exLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786843100, "uuid": "22289554-ba83-4449-a48c-6373e1869857", "value": 3464040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786843100, "uuid": "80de70c8-069b-41f1-bc46-a4057faf0c39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843100, "uuid": "8fa2636c-c58c-4ce5-a329-0b2634d84a6d", "value": "dollar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e10cfd9f-9906-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786839024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786839024, "uuid": "6b1d72fb-bdf0-451c-82d3-72e0c4a11c3f", "comment": "Malware payload", "value": "57c68d6b3d958c4abe14743b663fb675", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786839024, "uuid": "620a08cd-56bb-4f3f-a2a0-ab9d727c96c8", "comment": "Malware payload", "value": "7f75bfb1eeecded58b0aca85a25efc6fb95dcf7e0105a2de22d59aacfab9df1b", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786839024, "uuid": "58a96f12-f709-45bd-b13c-23953d1aee46", "comment": "Malware payload", "value": "19eebb85e98b6c76fc9c7a34a23261f9bcf0deb3", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786839024, "uuid": "741d536a-b9ef-4459-82c3-1a17ff1f75b0", "comment": "Malware payload", "value": "131368d1c75032574d37f55bb10015d6d7a13c9ee44673df302bf86dab78e6fad0bbac2e92b433dec3eb26155287e633", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786839024, "uuid": "a33f9866-590c-413c-9e2d-acbbe7278817", "value": "T1CD062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786839024, "uuid": "395b127f-8009-40d6-9c3e-adab9707c27f", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786839024, "uuid": "89e4e607-a4bb-4094-b201-8a9699373ad3", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnGw:+MIKhlPGw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786839024, "uuid": "967e9c18-31f8-4dbc-8fd9-1c316751418c", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786839024, "uuid": "9e8cb5d1-a288-435d-a328-fe34ea4e3f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786839024, "uuid": "fce0a969-a4ff-480c-87c1-dd0b1b8c24e5", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab637a44-9936-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786859550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859550, "uuid": "1117e761-72fa-41f9-b3b6-999b36a6c353", "comment": "Malware payload (Efimer)", "value": "fe01f9fc9b2cd5221d9eeea8c72145f6", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859550, "uuid": "2c18278d-33be-4b69-a4be-e1558be4d73d", "comment": "Malware payload (Efimer)", "value": "80392ff7d3c3983f2ea170a9d5e362f1a91cfcdacb8553cb0fadb7b389681e18", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859550, "uuid": "bea916d1-4803-4bcc-8ef2-52ba73341e1f", "comment": "Malware payload (Efimer)", "value": "1c652f9f414ba865c74b34ce81ba15869eddee01", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859550, "uuid": "8c3605b3-7ce6-4a2b-977f-fccf1f31481e", "comment": "Malware payload (Efimer)", "value": "1c499a1862efd8fab17f7b76aa3e939b964e4e2f6ed3f7846948fdfbd6e0da1833de29a2c70a836add3aacb7d4fb1e3a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859550, "uuid": "ea1f4513-63df-423e-80ca-69201a713c47", "value": "T1D9E633585BE112F9EA13803DEBE31096E2687875173ACBDBD768C750AD632E05C3D21B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859550, "uuid": "f6d0f60e-b1ed-44e6-a245-0fa46b2c968b", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859550, "uuid": "4ffe41e0-13e8-462f-9e87-bf0262352ebe", "value": "393216:SbAZEWci/bIwhWF6gq0wXMCHWUjNJcuI3/PGTAI:S8ZEWcGDWZq0wXMb8N+H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786859550, "uuid": "ebcf9a96-83c2-4fa9-a17a-639c88ed73ff", "value": 14109658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786859550, "uuid": "f2a5d8c0-cd35-4dc1-9206-8d5ce24075aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859550, "uuid": "3bb9d948-1ab4-43dd-b847-cbad177e9f25", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10cd4719-99b0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786911690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911690, "uuid": "486dfa2b-a7f7-46b6-8aec-7f60c1e2e175", "comment": "Malware payload (Mirai)", "value": "30c33913829acae30ac97f79336b3fc2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911690, "uuid": "40480975-b060-4d97-a3c0-e5bc4d718311", "comment": "Malware payload (Mirai)", "value": "80cb8aa7d2c6959c3e974aa72b460882cdb2cd01a0819ae143975ca0f9057b47", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911690, "uuid": "cb6d2635-586c-4b97-bc08-92c1e26aaac5", "comment": "Malware payload (Mirai)", "value": "91c0dd363d04bee8a42b73561821b30393303c7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911690, "uuid": "ca704a60-c13d-418f-8fd2-ea34c0608fff", "comment": "Malware payload (Mirai)", "value": "5f8b3fb40a8c3b37deb8d08fe6aace6e9039fcde82769ecd9d289f8a9431a5768e749104ad5d531a65e84ac57f39a3e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911690, "uuid": "08eb40f0-c11c-430e-8fc2-908da01b1546", "value": "T13A831214C3FCDB1AED6746F866722E1E3F3293397CEC05C3A52949061CB84A604AC6B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911690, "uuid": "457ba50d-0d43-478e-aa89-f1acdc960c19", "value": "1536:23jVCCIWDcb7QGXHNQepUaSQYf6jW0FqHRKjGOxQ6LrqieQWyv:23jVbIWoAAtQKxWUGZ6LZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911690, "uuid": "af87829b-0080-444a-88c1-d0da28bd2658", "value": 83772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911690, "uuid": "d0d73feb-2d85-4076-9bb1-070cec3d65b7", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911690, "uuid": "fcb89ea8-0bc2-42e5-a5a5-d6fcafd0b05e", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6481765-997c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786889714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889714, "uuid": "b41c11dc-9bc0-42db-8404-74e917602e5e", "comment": "Malware payload", "value": "a5699450e579636ee47269dc6869c154", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889714, "uuid": "b60f0457-2aaf-4441-b0b2-776e2fc500f4", "comment": "Malware payload", "value": "812818df73d2577cc61c84552931376b8bdbeaa506a33329a5ff98506b676b09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889714, "uuid": "fc2617bc-7698-4e35-89a3-7f3aa2a386e1", "comment": "Malware payload", "value": "b1e5879061c38af551b6651660d00f5f708e1558", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889714, "uuid": "b931192c-a9a6-44cd-bb86-cd9fc409ef63", "comment": "Malware payload", "value": "a7b184a550c0fca54d9c38a957c51ec65ca600b9c4bc09b921fc0fb66a4bfc33f82cf202587277d339dee7fe07b35c21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889714, "uuid": "b0ae3f2f-8243-468a-9e34-72a226cb46bb", "value": "T1B214F755F880CB2186D935B6FA4E42AC730307A9D3EA7106CE154F3177EB96B4B3A706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889714, "uuid": "281ad148-6a4a-4256-8f9e-e1bae6232aed", "value": "3072:wnE9BBcKNu2b4/f4nFCw4JlvVf4Mto29/qLpcJmbhoe7ITQGSTBxFbKNR9haF:2E9BBcL28noUlu2pAcJYXG2BxBKDfaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786889714, "uuid": "0d53d3ae-462a-481f-8a53-c57a7b209154", "value": 192584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786889714, "uuid": "eab7eec0-b25f-4526-9840-afa8a3a59a5f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889714, "uuid": "4f770697-b7ed-4bcc-8de4-6049b725b15e", "value": "812818df73d2577cc61c84552931376b8bdbeaa506a33329a5ff98506b676b09.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74638709-99ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909709, "uuid": "5a1b5a35-c919-4a31-ae40-f45b6b26661e", "comment": "Malware payload (Mirai)", "value": "9cca6ea2975cfd96ca6e4e1a2940aff5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909709, "uuid": "3b38cb87-663c-4a34-8715-c66306d2e85f", "comment": "Malware payload (Mirai)", "value": "8131e87819d8f29dc005eaad69b6c28a02a732b9bd6d5729cb44e03131bf3ef6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909709, "uuid": "f342ea55-0913-44e2-873d-98cf12fe2c96", "comment": "Malware payload (Mirai)", "value": "cfef6c20f222b3b72dbf43eacdd99a097c38717f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909709, "uuid": "26c31483-0769-4e4f-b295-807884261a83", "comment": "Malware payload (Mirai)", "value": "1ad8fc54c7da05ec9024a59a05d4d369fcc235368f75ae226082150b0f5b996181e0ae3b28b003bfb33964b231f2436b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909709, "uuid": "c2f65595-7f0d-486b-a202-088766f97275", "value": "T10FC34B0675A148FCC156C034C77F9937EA31785D53343ABE6B84BA71AE22E365F0AB42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909709, "uuid": "5720fd47-e0aa-4a9b-a5b9-e752dd19e127", "value": "3072:zVroYE04n3quGACAQAxNYVe4ExnEdG4tP:zVuauGANYU40EdrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909709, "uuid": "fc7d765f-a6f5-4f90-9c07-6fed2d94bcbd", "value": 124808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909709, "uuid": "df976805-3ce9-4e81-bbc0-ba16a14511de", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909709, "uuid": "e5df5aa6-4b42-4b64-b5f5-b39267ef7ae6", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f5d26a-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920228, "uuid": "9d8e02d8-504c-4109-9011-7dd04bbc8978", "comment": "Malware payload (Mirai)", "value": "dcd9f83e7544b4a0254352509e113483", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920228, "uuid": "b63f72b2-6a62-4629-a1d3-0223a4353158", "comment": "Malware payload (Mirai)", "value": "8137e134ee390e055d0f0f9f964544c147e7449036555aaeeb9330d8a8a1cb06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920228, "uuid": "d1580694-a36f-402b-9e55-c46fd490e6e5", "comment": "Malware payload (Mirai)", "value": "39c6b3b953b9c6fd9e01074e5882e2e492e0410b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920228, "uuid": "8b453bfd-da47-47f8-86e7-17c83792fea0", "comment": "Malware payload (Mirai)", "value": "bd9019615d1047b8f4ac191465ff39d940be9102aedcfe3ef0a600e0c2bf46043d6d824722e3c98d3198a628e214d3ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920228, "uuid": "830f27b5-b1cf-45af-bb39-78521bcbe45e", "value": "T13E040150EF496463D8E34EF92E3B4736D33C6C4108BBD6185B25BA2B66739360387788", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920228, "uuid": "52f6758e-8af0-4c6e-b267-1a132fd279d3", "value": "3072:ozdurayQy5HEcMf3oH7xaVx+DZb8g3NRPIE9VjTyIMjzVnaTeojg9VY5Pm1eY6Wx:ozdurafekcMwHU0tb88lIEXyIgwTeCg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920228, "uuid": "3c48197c-3579-4b4e-8e77-86618430b726", "value": 186119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920228, "uuid": "ac7d8d36-453e-4228-9296-7a54110b98bf", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920228, "uuid": "4920cb9d-3299-4474-997b-55eb42ba81aa", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25af20f7-9915-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786845153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845153, "uuid": "7d557241-69a6-4152-a15e-1459faaf1bde", "comment": "Malware payload (Efimer)", "value": "1244f89ba4a6b12e3b885b58b66103a9", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845153, "uuid": "dc4d0a10-3573-4aab-ac00-afa83740934d", "comment": "Malware payload (Efimer)", "value": "81905d33a611d1230db493f85f1da36c6c10e0be29148b8cfb72060ade4dd027", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845153, "uuid": "07faf371-b90b-4fdc-b216-c47f59243495", "comment": "Malware payload (Efimer)", "value": "a6af7c78098bd4c8f22215a6bacdc74145a5692c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845153, "uuid": "b7e1a667-cc00-4917-91ed-792c8cab445b", "comment": "Malware payload (Efimer)", "value": "e37ca9edfa0cf6eefa2d1536482633e04b33fc99cd0ee683aaf62e872f32089a35e2017e7a9e93a28423c58fd5e4beeb", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845153, "uuid": "4832ef11-9881-48d5-9c72-06770a354cf0", "value": "T10BE633889AD021EDE5B3403CEBE16661EA79B8715771C6DB53EC42A47E132F0983D723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845153, "uuid": "1333bce4-4ffe-4539-9187-d36e1e871171", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845153, "uuid": "43fb6074-f744-49c9-9836-f56cfaca8cfb", "value": "393216:0XhUgxTyWMb4hjpc0+oaOu0P8ASXMCHWUjLcuI3/PGTAI:01IWR93y0P8DXMb8oH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786845153, "uuid": "8142e992-f6e1-4285-8d45-ce9bacf5d8f8", "value": 14087662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786845153, "uuid": "4a278cfe-abcf-4306-aff1-f644c480c363", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845153, "uuid": "6ea00e30-03ee-4712-9146-5e85e9484bcf", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "358d3f97-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "8207dbb7-170c-4bb5-841c-8818231ff912", "comment": "Malware payload (Mirai)", "value": "a5ee1a7ab00e6a82793f84fd885fb555", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "784da3e3-12dd-465c-bcf2-5c6509e4e171", "comment": "Malware payload (Mirai)", "value": "8220c8b6785864f587a492d44176ed986fb30ef10c459c3068b183e7d20033a2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "15a73c69-b1c2-40ef-83d7-6c84a6602c7a", "comment": "Malware payload (Mirai)", "value": "3137e4368d6dea283350e436b8aad942e723aa17", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "2c9ed640-4208-4995-bbd1-b14f1a1c6e35", "comment": "Malware payload (Mirai)", "value": "2d2b04568495e778390e30eda871beeff6be4123f1f2eee3f987f34d5262182efd1d0394dbbb3aa85d7b1742e4559b76", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901443, "uuid": "fd779ff0-4413-4a39-ae52-62aeeb6257de", "value": "T178D35B0673180E17C5E349B02A3F17E483FEE5D121F4BA89691F9B6A4672E771482FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901443, "uuid": "21c1710a-8617-4a5a-8102-fd1d430e8671", "value": "3072:oWGIf1/UwfhJdU80r6tbYUaDGMsMA9TKst:oWxN/UUDG+bYUaiMsMApKst", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901443, "uuid": "f915727d-e264-429e-882e-5f7d1fc7d23b", "value": 134840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901443, "uuid": "cb0db8bb-009a-4740-95d7-126569411a47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901443, "uuid": "294b2352-d5d7-4a51-b066-4080f71db80d", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7d229e-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "11a92e4f-4600-473b-b2cf-eaafdd83685f", "comment": "Malware payload (Mirai)", "value": "8b46c583f35835d0baf9a2a4b9f54258", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "2a78d263-467b-48b7-9c22-efdf73fd039c", "comment": "Malware payload (Mirai)", "value": "83f4d888ccb9c2baacb254a22d29ea10c6a2b4ba9d6ad91f4fe7a51943be0f00", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "eafa4e70-1616-42bd-a4e7-d02337cdf1ef", "comment": "Malware payload (Mirai)", "value": "87174b2c98dd4a570b78a4af930da2da70cab3f2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "7639de68-40b4-444b-bc27-65cad8756775", "comment": "Malware payload (Mirai)", "value": "e1c3a143ef54ae7cdd706acd0a1dac85bce35d4523e63a663a8e5e3719aa0136427715d5cf4cc466b409b0617e01d603", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901376, "uuid": "eb2e39c3-339e-4f7b-86b0-d78fa79cd54f", "value": "T17F04641A3E12DFBBF56D827047F78930579836963AE19584F1ACD71C1E2028E641FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901376, "uuid": "88518538-ea70-4dd0-b346-ab5fcede3dda", "value": "1536:wxY3Xht6l6u9vSPD7N/pVxReD99WAC1W8umWvTvxFKFY+xeao5D4z:J4D9vkD7NBVxPAC1WZNFaYkot4z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901376, "uuid": "be46796c-4afd-424e-b68f-0a8348f93c39", "value": 189336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901376, "uuid": "224b4750-e1e2-441f-8f50-0e9f6ce542c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901376, "uuid": "3ce644d7-5c57-49cc-9338-7d46e3fd3384", "value": "eclipse.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a695b724-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900774, "uuid": "84a33c5b-8972-432d-a14e-2e1ae87d5540", "comment": "Malware payload (Mirai)", "value": "7fd775f8303fcd66797d8bf5ce1bd111", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900774, "uuid": "385059d0-a51a-408d-bfb8-42d324d661f6", "comment": "Malware payload (Mirai)", "value": "8569b6b143b6c245e6947828cf8672cacd0df95c9bb3a75c77b0e0bc4b0d74b3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900774, "uuid": "e12a3779-49cd-4a2e-a04b-203686179e9d", "comment": "Malware payload (Mirai)", "value": "4599fcac268fe05a6fc9df156d0b3d412fbdb6b4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900774, "uuid": "811fade0-078a-4a60-b66d-929461cc8956", "comment": "Malware payload (Mirai)", "value": "c6a6e4419a28ff320bcfb7889b5cf990962a1d3befa78e2bc122461ca87318cbb3a4e8718ad6cbce97301f72ed8c9666", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900774, "uuid": "7a9937a1-4749-4739-b5d8-e4bac09d8f2c", "value": "T1DA14D80AAF510FFBD86FDE3702E90A0539CC655722A43B7A7674C528F54A90F49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900774, "uuid": "584e47db-be06-461f-9f6e-a5a16de81e5a", "value": "3072:W/U4NUKyyvSLvEB1FybUpOy0teV/A0iY2IS:W1SLvE7wo0y0YApI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900774, "uuid": "ec72433f-be9d-4e0f-8fe8-310ff6c189a6", "value": 207480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900774, "uuid": "ce7a04a4-f58d-4fa2-812f-b3036ccbf3fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900774, "uuid": "cba75b91-9724-4ef2-9e1e-46d43ab0ced4", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afcf7135-99b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786914104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786914104, "uuid": "7d8e2036-96e1-4390-9b37-dffe26b9f9d1", "comment": "Malware payload (AsyncRAT)", "value": "833ccdfb580089d067baad896c99c0ba", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786914104, "uuid": "07d2fe2d-e4bb-4645-afc5-adaa244a5a1b", "comment": "Malware payload (AsyncRAT)", "value": "85cd6c3229f9ab547cc54f2cbdcf6ef2937987c0181e5ffa3c4205105df8e8fe", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786914104, "uuid": "9ef9f806-93a5-4e33-a195-584dc0bc8507", "comment": "Malware payload (AsyncRAT)", "value": "f1ba4918d53951a50db649248e28db908618ae81", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786914104, "uuid": "354cf0cc-e4d0-4d92-91a6-2e79ddf98070", "comment": "Malware payload (AsyncRAT)", "value": "2a65395c7bae0814fb01587d1f3dc43bcda6e04d23cb9668546da3106d892b74409ac99fd900746f432cad8b97f1a93b", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786914104, "uuid": "6796af7d-3edf-4233-be0e-03cb21c9fa1c", "value": "T1B7236D4037D88136F2BD4BB4ADF2E6418679D2676903CA5D6CC814EA2F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786914104, "uuid": "38a7f8e7-3d2f-47d3-b8bf-6a43d7561e14", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786914104, "uuid": "5ad11601-c5da-4e9f-ac8f-89d49722744a", "value": "768:nazFyrIL6i22+riVtelDSN+iV08YbygeWCHOcfKzvEgK/JbZVc6KN:naZgaVtKDs4zb1GOznkJbZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786914104, "uuid": "14186161-e727-4cf7-b849-9410261069a7", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786914104, "uuid": "05901d3e-7544-4e98-84a8-94cae6d13cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786914104, "uuid": "db605e1f-097d-4a8e-a863-e4bdab7fc0b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08dc7911-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786915112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915112, "uuid": "fe6ece2f-62d9-40fb-bd17-6d52a8549c66", "comment": "Malware payload (Mirai)", "value": "3bd0b3a222264b0f67fe04b845533b58", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915112, "uuid": "098bffcc-c2cb-4201-91bd-42d6f17d28dc", "comment": "Malware payload (Mirai)", "value": "85e16142a665233dae9a27a601566a17cff106e412537bb86bb5f0c163c4cb67", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915112, "uuid": "8d29e595-2b54-48fe-a6c3-0e498e49a833", "comment": "Malware payload (Mirai)", "value": "1597813bb2b9d067f450c3d60b6d7f2428222339", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915112, "uuid": "5720adeb-5ad7-4ec2-a39e-9eb6f7b5af10", "comment": "Malware payload (Mirai)", "value": "b3565f3d1360a07548cefe38d8df9aa8d520fdf23d5318bf2399caa1fe7d653c00ab9f5a14cab07bd34836ba7e35f27a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915112, "uuid": "9e4db6f4-a108-4401-994f-615cf686d31a", "value": "T1D354D71A2E629F3DF2698B3447F74D34975822D723E5D680F19CD1105F2428EA86FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915112, "uuid": "3b41937f-e21a-4099-af30-e7ac1de84704", "value": "6144:+xj+ocrscpGJFCoSuLa1GPOlssM7khWol26T:a/n2PlssM7khWolJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915112, "uuid": "ae653c2f-a4d0-4b8e-8a44-58b57fc22c13", "value": 292768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915112, "uuid": "67ea7c62-c1a6-4a37-9cab-f0a7ac5814e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915112, "uuid": "476bfd62-ee3f-4740-bd1f-4b80591ccb26", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96a95b2-99ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786909798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909798, "uuid": "4120687c-761b-4b9a-9bd2-fe44dedd30af", "comment": "Malware payload (Vidar)", "value": "cd5f2338e2c7cdd3e6bf37987a183953", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909798, "uuid": "f299fc36-e775-409c-8a43-a9f45cf27d5c", "comment": "Malware payload (Vidar)", "value": "85f0f05903b3e3efa56490cb46d09b46ecf286da6c80398aa272aaf08899b11b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909798, "uuid": "370d6aef-38c2-481e-ade5-e2fdeeef7ad5", "comment": "Malware payload (Vidar)", "value": "e71bef0808db44c42224149c009ffe345dad5d88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909798, "uuid": "8700fe62-67b8-421b-8598-9108a0dbc037", "comment": "Malware payload (Vidar)", "value": "00fea05018e77bea5b8d7416d122cab502aeb7de87966d36dd6965afb547aeaa1020d0bac5e5c38de2a8ef1157433158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909798, "uuid": "ef6acc63-f693-4543-8b0f-623492adf318", "value": "T1D4E59C07BCD249FAC199A33189B651927774BC091F3267C32E50BB782E72BD06D7A718", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909798, "uuid": "a233e010-c6b3-4c44-849e-c60996c2748e", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909798, "uuid": "c194fe07-ec3c-4a6b-b283-bda93a33797e", "value": "49152:AqM7IKvMuk+yvPT0s4taQDgeA3yT5xruXZ/pp3Inip60Tinowt:AqOoxT4taQw3q5hYny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909798, "uuid": "48047bfd-e551-464e-a132-e8cc3f089deb", "value": 3308400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909798, "uuid": "66abc63c-f24a-4df7-af69-f372a51178f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909798, "uuid": "757a280e-e210-43b1-aba1-7115aec094fd", "value": "85f0f05903b3e3efa56490cb46d09b46ecf286da6c80398aa272aaf08899b11b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d069e8e5-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786870350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870350, "uuid": "1ef94339-b888-4048-81cd-cd33cd6e609d", "comment": "Malware payload (Efimer)", "value": "684ed2249d26eba96bfb119752ba01a7", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870350, "uuid": "13b828e0-ef25-4d1e-9a08-acaed1ec58ac", "comment": "Malware payload (Efimer)", "value": "866f0c98d370c8fca1acc8156456372955c7e5e1ea0bafe9d335dbc30c5b81df", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870350, "uuid": "f02489f5-69d0-40c4-a1f7-eb434436ca98", "comment": "Malware payload (Efimer)", "value": "a2adfbf3fc008c831cb39bf015a67a4168931133", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870350, "uuid": "baf058a3-cbf0-490d-85dd-f4967410d45d", "comment": "Malware payload (Efimer)", "value": "d224e59fe8b95454f480358716b29548b19911526114bf3488417110f4c5d057796625f8ee520e2b720dc5e464d1979f", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870350, "uuid": "8cc53551-fa2a-4050-92bc-7f803551e52b", "value": "T1B7E63389DBC413DEE2A3813DDEC25165F97878B60771CDDB63E48BA55E171C08E38A22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870350, "uuid": "5e03b3cf-86c3-4769-92b7-044c684d00cc", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870350, "uuid": "9b2a9daf-75a5-4463-a7af-388f34a5a359", "value": "393216:XJqdCK3q0PAXN+2f50OWFXMCHWUj1cuI3/PGTAI:5cPAXN+g50tFXMb8CH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870350, "uuid": "904bce07-980c-4be1-ac5e-9a06314653b0", "value": 14109681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870350, "uuid": "1ec48c9a-10ac-4b50-bc84-929a5594993e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870350, "uuid": "a5e366fe-a470-409e-b347-03cb223b8b68", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ff5064-99ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909814, "uuid": "822fe704-de0f-40ac-b702-99eeb75a7433", "comment": "Malware payload (Mirai)", "value": "935bb0ebe002d8abde29474608ba48ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909814, "uuid": "22a73758-aa3e-4155-9424-1a98a8538165", "comment": "Malware payload (Mirai)", "value": "86ba0046b4997b2dcc2e8d4db070202cfe06d91f09b1fcea9550f7ff2bbdcf64", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909814, "uuid": "35adb7eb-c217-4da1-a2d4-741f59d4c862", "comment": "Malware payload (Mirai)", "value": "8ee7e32e1f7ecd406e0675222ea40bfeccb863f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909814, "uuid": "962f57bd-69fb-436d-b003-e0e1982e976c", "comment": "Malware payload (Mirai)", "value": "4573f3b169dbaf30d5f2bca8aa3277d94041c4d035d96e05d5e842bf845ac925e6c164199d408e61fa090bc427936dc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909814, "uuid": "d013bda6-2b3e-40fa-8389-e3c253bd3167", "value": "T1AB635C23D5BDAC06CAE0A97602E743A3C5DB5B444398CA0FFC941EA9DF173901D6B69C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909814, "uuid": "32593512-a2e8-45cc-b85d-eedcd78480b9", "value": "1536:Nvhr9n4nQWJ3r9n4na942k2CxzPo3Adm8MVAfOBwR15cW0TKYT3A:Bhr94Qc3r94Nx2Cxj2WMVWLI3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909814, "uuid": "15b698c8-28b2-416c-a208-32c61d9f8d1b", "value": 69512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909814, "uuid": "a40c866f-fbbc-4152-9f73-8b069cfedae9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909814, "uuid": "77af2be2-7043-4b29-a841-e9516351a0a3", "value": "86ba0046b4997b2dcc2e8d4db070202cfe06d91f09b1fcea9550f7ff2bbdcf64.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0271d25-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900844, "uuid": "c57108fc-c8a3-4551-b6a7-96b4cdda8d41", "comment": "Malware payload (Mirai)", "value": "d48917ae59ac4bd82a7ba70c58977566", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900844, "uuid": "8e411e7b-b939-4114-a3e0-a60eb73c2dd9", "comment": "Malware payload (Mirai)", "value": "8709150d32a7aaf0191d532b612b9b38e45b2398287a57cf1127b034608aa0b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900844, "uuid": "9f055a29-99e2-4bb1-ab9a-4c1427267c0f", "comment": "Malware payload (Mirai)", "value": "cff92041a302e1f439dfc33e1d14a2dd72d705ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900844, "uuid": "fbbac6e9-0f4a-4113-971a-25cf327b6f00", "comment": "Malware payload (Mirai)", "value": "f544248a3bf494fe428407ad41dac854663ced4fea02579396cd8d6a57c0dd6c92a34ca627fded16a9803cf3e8a54787", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900844, "uuid": "c7e68122-2451-4151-a7c0-d8c2e354dc0a", "value": "T199C36BB3CC29AE6CD129E974B0748BBD5BA39915910B5FBE2827C2718043DCCF5467B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900844, "uuid": "0cdab6c1-3e66-45cb-810b-4292377c4ce2", "value": "1536:kGYiSlKCJyJar6bUeJ5CAKSEMcw8Yxfh3yWOeuloebDelAC/:kGYiSKCJyJJUeTOSaYxdyWOnOeber", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900844, "uuid": "cbb7d88e-c6a2-4e3d-a1e6-5dd90f49ea78", "value": 125860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900844, "uuid": "bd6c8e81-d5a2-4d36-b99a-66e50ee0cae2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900844, "uuid": "11d47087-585d-4b62-b754-deb97c55a29c", "value": "miron.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99817a91-99ae-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786911060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911060, "uuid": "69e9b729-586b-4257-971d-89ae6842b0bb", "comment": "Malware payload (Mirai)", "value": "e50aad22ea0c28adb8d823723835f9d2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911060, "uuid": "1f310dab-93fe-4e16-a3d2-2104a1a2fc78", "comment": "Malware payload (Mirai)", "value": "87e6c40947d3efef89374cf5156181b6ceb0f00694396dc7e50dac95eda54c95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911060, "uuid": "c1b51dad-d643-4776-8270-f87ecc57fe47", "comment": "Malware payload (Mirai)", "value": "a3c4b5d1a369b44d792e410b7bc2d9f2a3b8ebdd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911060, "uuid": "c9ae5962-ab43-4222-b527-41faf87286f0", "comment": "Malware payload (Mirai)", "value": "f8452352938f67761d002b99af4111f387fee75717611c51af079e481d0342580b34e09b4381cf350a3b1861f229ed48", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911060, "uuid": "000a729f-4289-4069-b14f-37dc3e07105f", "value": "T10D040856F8819B11D5C255BAFF0E128E73131B78E3EE72139D246B74778A8BB0E3A105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911060, "uuid": "ac46b9d5-fab5-43a9-a0b2-b2bcbef4106c", "value": "3072:P5mI8jGrk9sIHWtGsVRQ8EqBhMtMkMqf7ktkaSb1E1BH78T02DUE01pseroHT:P5mI8yrosIHWtGMHEoCtNf7baC1E1VIf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911060, "uuid": "de705343-8fb3-42c9-861c-38d7bfda84aa", "value": 177196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911060, "uuid": "9c681aca-83eb-45f9-8ff4-cf0ff6ae56b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911060, "uuid": "4dbb7274-4910-4ecd-bc05-73971ae1e6bf", "value": "08626ff1610dacf45e4265722a82b2676834392112fdc2cb5100ba40dc70ff8c.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57b20da-99ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786910758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910758, "uuid": "a0386bbc-6ad5-4d78-8e6e-93ccce0b723a", "comment": "Malware payload (Mirai)", "value": "5074c3931bae97053d94d420bffd53ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910758, "uuid": "e6f57965-5bce-41af-9052-eaf37d2829b3", "comment": "Malware payload (Mirai)", "value": "8947b1b944866f539d618c4c2ffc4f6ffb2407235e2839b0f1d6df4760dd73ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910758, "uuid": "723fb082-15c7-4e82-8d82-40a5fdf1aa19", "comment": "Malware payload (Mirai)", "value": "df43c50b815780555863d866b680e76a9be861b0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910758, "uuid": "65908e63-d5ae-4a71-af77-c54e82b9bc31", "comment": "Malware payload (Mirai)", "value": "b1959a32122f6e0702f6a1489416cd422257714cd4e36914b9a2abeeb6f5048c4ffe50e6854dac77e93e7fdceadd315e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910758, "uuid": "56ae9d30-b210-4a2d-9fdd-250fc1f52972", "value": "T1A1F30745FD518B12CAD366BBFB4E428C77260768D3EE720389255F31379B96A0E3B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910758, "uuid": "69695c4d-b01a-4f06-9e4a-0fc066c1e631", "value": "3072:ziNxljDbqg3/ebMQHPEONgxd54Ng4ywGTfsjVVENA3X50AHr:ziNxljDbqg3/P4PEX7wg4ywofspVSAnd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910758, "uuid": "21cba1ed-a2c6-4232-a6bb-72c367933289", "value": 166552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910758, "uuid": "06b116a4-f017-47b7-847b-123cdc4cfb20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910758, "uuid": "87f0ee8e-4e3f-4e55-9b5f-764febc344dd", "value": "1612a1488d22a1efa9662dc5f44695c654c3f8967ef89640849cfb80a2e6b999.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b080713e-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786870296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870296, "uuid": "f8a76e2b-1e95-4b1f-a2e9-b524d352a78e", "comment": "Malware payload", "value": "caaddaaf32a33d534001fcc85aa14117", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870296, "uuid": "aa74fb71-139d-4efa-9ecb-6aa0e628e845", "comment": "Malware payload", "value": "895196914d72887b2c572e23b195b2486f9b062661a3fc8d6265bf3b630b873f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870296, "uuid": "58db26cc-3b01-4b4b-9562-7abc64777e85", "comment": "Malware payload", "value": "70fdd7945d505e64adb721345d65462db7a4d973", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870296, "uuid": "1554da56-624f-4e23-bf5e-b2510ddeeabc", "comment": "Malware payload", "value": "2ce54862ba659475f51ea459e0734eab50b0ec7ba11e2691f7a4e2bff5404ffed1c61afbfd7a40d83b958ad0a52c8825", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870296, "uuid": "cbc8d15b-59da-4277-bef2-c1c799bfec41", "value": "T153B2D70F776744ECC949E47881FB9635BA72BC0848B06B3E5324DB701E95B646D3DB48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870296, "uuid": "846bd4a3-17f8-48ec-8150-78810a741369", "value": "5bcfd99140b04a4b24c742176fff15d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870296, "uuid": "d0ca9b31-f08b-4318-9e1c-43442e5a850e", "value": "384:OIPGk9iiOgqwmnxZaQ1a361lHBh4yctPMsM+anWaGGVUh:OIuktSxZaX3kFjcDaZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870296, "uuid": "88447084-1f36-4e48-8742-0b3a918933be", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870296, "uuid": "e075edfe-ddee-46d5-b263-c3b9ad4a553d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870296, "uuid": "fc90282d-1f41-42ef-beb3-92924d2140e1", "value": "18cb7296bb21486f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7338f40e-997a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786888662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888662, "uuid": "8d786d98-3d43-4dab-b981-56edbe492644", "comment": "Malware payload", "value": "b0ea8ab6f07ed2b58510f8781cb16126", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888662, "uuid": "eeb6067b-eacf-4475-ba34-645da5ae48a7", "comment": "Malware payload", "value": "89a2f44e27849d8140e494339d6f9b3fb5e954907c3412d0c3a312850d12d7fe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888662, "uuid": "57ac346b-2938-496b-9bfd-7ef0e62f4edc", "comment": "Malware payload", "value": "bbec747e799e5850c6f0aac3d64a08fa9fc2faa9", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888662, "uuid": "3be698dd-72f5-4b0e-ab69-7a2cd6d50ef6", "comment": "Malware payload", "value": "90f5aa74c66c1daf06f94fd9385c149c90c0e774716487c614872c181420f93e88ff5b1a776fa70a7fa890ad35427993", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888662, "uuid": "180223c8-62df-4ef2-bb0d-46c616e2c8b1", "value": "T1F9236D651A857C14AA98C4371D7E2F0CBDAD43E6320492DE7FCA3CF28C5AA9DD10972D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888662, "uuid": "28778731-95f2-4e0b-acc0-aa7e55092df0", "value": "768:4XRWNGxV79GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:slxmcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786888662, "uuid": "0c735952-9735-448f-964d-a2f535abed70", "value": 50051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786888662, "uuid": "c710ef2a-7a54-4a2a-b0cc-a301e8028858", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888662, "uuid": "cd2395e5-89ed-4cd6-92e9-94235ab4a6b7", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3c9473-9926-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786852549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852549, "uuid": "7fac95ab-41fd-4f12-9e7e-585d3488f069", "comment": "Malware payload", "value": "0106ba608c2ae502322550f107491abb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852549, "uuid": "78fc744d-2b68-474f-b512-4f98165a83ed", "comment": "Malware payload", "value": "89a76ee1536416b632ddbfa183e001a875aea23fd30757fc21c3e4605431d942", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852549, "uuid": "a88b639d-6e2e-440d-94b3-b750fe497ded", "comment": "Malware payload", "value": "182cae1fecae9d0596852f04a29932636b56b6e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852549, "uuid": "f4891ce8-9e08-447d-b6d5-07c7ede84542", "comment": "Malware payload", "value": "dd0e5a661c8bf4e75ed2b9ee7314d38164b3bab68786bf451cfaca53bc7b8ad82be00294301d610fe6fb1b19e4d356f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852549, "uuid": "96039e0e-f875-424f-96c8-a48b5c02a3a5", "value": "T131069D0778C448A5F8AA933A8AB642917B75F8084B3A73CB2E54F6793F367C05D34B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852549, "uuid": "0cb74de2-ae67-4261-915a-504285d94e0e", "value": "42efe1abd8d48a3188e7e7b82e17c631", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852549, "uuid": "367c3fa7-8af6-48df-af13-c171d2085dba", "value": "49152:eGFU7lYD5Rm44loc+Kw+foacN3ISCCEsIVxmAFp7peP:66Rshfr79s9kNeP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786852549, "uuid": "6765f648-ee9b-416c-b89a-f4dd8a5ebe67", "value": 3687896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786852549, "uuid": "7ad4be28-c4ff-4e1a-b777-70c9bee8a9bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852549, "uuid": "9554b290-31a7-4529-8066-de9e8e3465f4", "value": "89a76ee1536416b632ddbfa183e001a875aea23fd30757fc21c3e4605431d942.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc1ed66-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786915119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915119, "uuid": "89eb4328-8e87-4c79-a93d-32075609c486", "comment": "Malware payload (Mirai)", "value": "2465bceb42411021439f930036592fdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915119, "uuid": "24958064-a138-45a8-9d52-b1dc638c1728", "comment": "Malware payload (Mirai)", "value": "8bbb2c7674001099bdb3a8abef6b6461ae9c82115cdb908efd76830ccb1290dd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915119, "uuid": "48f773f3-a745-4354-92e5-0e2c0d37652d", "comment": "Malware payload (Mirai)", "value": "f8068f8507aec6d452a838b6944b80823c217571", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915119, "uuid": "a34b7e5f-caf4-4725-8db2-daeb3349ea63", "comment": "Malware payload (Mirai)", "value": "e10b046f344959f2939bb3333a175990c3ea3f5bc7872df37261d13ab3af47dfa8dd52495b2c39c722529af49b6fcb01", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915119, "uuid": "92e86dc1-1457-4c3d-87f4-42d487e57863", "value": "T1AF149EA2DCF66C54C326C434F6B29A3C6753A02342875FA4B86EC2B44F47C99F2557B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915119, "uuid": "3ccef578-13b6-4909-a3bc-b47f50c0ddfd", "value": "3072:V1vOKefrDNWYGVmiG2hrjVL9hmVkwFqs4kXWQibNR9Q+uQlssMab/BlGH+Iys61U:VF7KyfrhSkgtmQER9QOlssM7khWos", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915119, "uuid": "1be201b6-3498-40ef-a591-75b029a74228", "value": 202516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915119, "uuid": "9f50edd6-d521-4ef3-889f-ce796bab9eb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915119, "uuid": "0d27ac7c-c415-43d9-9b06-87380cc2e027", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "326f9627-9958-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786873950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873950, "uuid": "2c2425a9-7813-4933-b8d0-ee5d21245269", "comment": "Malware payload (Efimer)", "value": "b3588fe90191e8f88f63af9090c7cbcd", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873950, "uuid": "296d4388-e412-4d56-9491-b2f83fb9fff1", "comment": "Malware payload (Efimer)", "value": "8bbf13b6f3e2cde8a70f9a107a8814871f22ff7995554ba1db44fb985f3d16fa", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873950, "uuid": "503006ff-0c32-49e2-ba15-19b048cb7f64", "comment": "Malware payload (Efimer)", "value": "cebdb639425af2319db496a7f01584762e022727", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873950, "uuid": "a3a6a7a5-be56-4c3e-afc4-a9c5d064dbe6", "comment": "Malware payload (Efimer)", "value": "e0236a59117356f9ce818465dbf4bcfbe6d29031ebfc9a63e5519f8ed4627f657f6aa3a879eef35227af69068275256c", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873950, "uuid": "b9706062-d9ff-459f-bb5f-b0694094d2c0", "value": "T1F1E6330856D121FEDDA3143C6BD31195F978B836A772C9DBEBA887627D231D00936B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873950, "uuid": "e18baf41-9a15-46d0-adce-be22b1d95856", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873950, "uuid": "aff7cc8f-37e3-4ae9-8083-658fe61fa194", "value": "393216:WMYAUGuIR1xr6gLCv0QvXMCHWUjUcuI3/PGTAI:bYAUIJe0QvXMb8BH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786873950, "uuid": "fc581b1b-819c-4292-a018-c0abec273c66", "value": 14095524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786873950, "uuid": "793fc67e-4986-48ab-a4cc-b6e526ddff6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873950, "uuid": "aef9a1cb-0f02-4ddb-b4e8-832bb180a192", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eff30446-99a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786905192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905192, "uuid": "078f21b6-6ca9-4f31-ae1e-616aa4a12bf6", "comment": "Malware payload (Vidar)", "value": "90612bdf45d06a81672deaa8f2c6b460", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905192, "uuid": "26842c48-ee4e-431a-9ab2-dc71c0d6125a", "comment": "Malware payload (Vidar)", "value": "8c2e041ac3477795a6ab144d59e9f9abd88992bdb7707a1c7edaa65cc364b1d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905192, "uuid": "70cd7fed-abaa-43cb-a69b-d571a36a4e02", "comment": "Malware payload (Vidar)", "value": "28deaf781311a023d213634829ee4956f22dcb60", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905192, "uuid": "18c0f73f-fb31-4f3d-8eb9-01cdf968d9ea", "comment": "Malware payload (Vidar)", "value": "5aea02fdf5831abff0ac30bff42b9929a200af24b5ce371dc904f94e2f465f6e889326cd751767003cacd74b64a48aeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905192, "uuid": "6714cb02-8ed7-41d0-aacd-1f25aab7783a", "value": "T127E59D07BCE449E9C49A973689A752A67734FC090B3227DB2E50BB792FB27D08D35740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905192, "uuid": "acf0a9cb-5a51-4df5-820b-9d3e4558c3dd", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905192, "uuid": "cbbb34fd-ef3f-49a6-a4cc-19f6ea99650f", "value": "49152:3fsBEYNgVxOceEd2AlkrBZWNHfrqEv8z2DDUFqEttJDboEVx2nMnXh/DYQ9QAqsI:3fbcEqVG95qraq6dsCKWhZPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786905192, "uuid": "4627ec9c-398a-4830-8582-ef6ef237f629", "value": 3269464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786905192, "uuid": "ec005331-4292-4d73-a4b7-73713e7ee46c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905192, "uuid": "303a375b-c0b9-4e62-bb2e-8ed97760f4fb", "value": "8c2e041ac3477795a6ab144d59e9f9abd88992bdb7707a1c7edaa65cc364b1d7.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f96cca-99be-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786917924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786917924, "uuid": "91df9b7e-615a-4463-ae39-42e9a7d7e2fa", "comment": "Malware payload", "value": "f9bc2bee9efe3fbf3f16d750fe34600e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786917924, "uuid": "8a546c07-0d9f-43aa-8e23-011020e40e8f", "comment": "Malware payload", "value": "8cae0ba31a2261827a50bfeb0efd0bb88940aaebfc0ee5d086a033b6639a60dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786917924, "uuid": "da4fa44a-0886-4058-ad3a-28cdfc731ceb", "comment": "Malware payload", "value": "8be5bdd7476a7988af90bc9da3d33df5e96f04f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786917924, "uuid": "598ff44e-54fb-4f8c-8b32-12458fa299d2", "comment": "Malware payload", "value": "ae19691f8d23fd0eb74831d092a7d206bc639295041b8c5c340f658a13879b7e5bfb81db5cd29c40be2b0278a9ffa7ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786917924, "uuid": "61ae70a3-6329-475f-bd65-771129c45efe", "value": "T109D522EABAF21974C8B7C7B7AF92F42DB069774047708D57BBCC5A008E521990936372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786917924, "uuid": "0c2e3169-9374-4d6a-9c44-09e1870493aa", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786917924, "uuid": "3c5432a9-5348-46cb-a862-e05538cd3ca7", "value": "49152:50sed6ysnFBh79DkIspLg6Hf/qnU7OZnkT4o1Zasde7YC0Jto2KllTgp3ceNj:5udBKJZspMs//7OZRo1lMEto2KbTNY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786917924, "uuid": "42284279-daca-4de1-9062-83add839193e", "value": 2927104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786917924, "uuid": "c52d00cf-ff46-4fa2-b835-dfa71f6772db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786917924, "uuid": "c2e2c0f0-646c-4f39-b303-8030f92e55fc", "value": "8cae0ba31a2261827a50bfeb0efd0bb88940aaebfc0ee5d086a033b6639a60dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e839e2-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786901469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901469, "uuid": "0de32644-f3b8-4ed9-bed2-c4d39481f137", "comment": "Malware payload", "value": "be48e37bb0726af3316347b05eb796e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901469, "uuid": "3e2dae5b-7adb-4809-9165-d2ace384bd25", "comment": "Malware payload", "value": "8cf1575ada5eace2ca8195e7bdc130c9aaf70ca6b1764e16cb9eb2c4b84d4ebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901469, "uuid": "e5792a42-38f9-4588-8368-bf3b714f20cb", "comment": "Malware payload", "value": "ea1e17cfa74cb666018ee906f70a7e0856fc710e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901469, "uuid": "13de99a2-f145-4c08-b722-8cd3ee47267a", "comment": "Malware payload", "value": "620eeff219b10d4bb09579c539fffa6f3f95931782bf854ed17532506b77840082d044c459d8571bbd6ba0583223307c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901469, "uuid": "cd17ab84-3b76-4451-ac45-3c1c489f9a4b", "value": "T1FF166B03BC9248F6C499A731C9B74252BA65BC0C5B3133D72EA0AEB82F727D16E35754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901469, "uuid": "bfc6fa4d-27c5-433e-99aa-57a9fd778685", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901469, "uuid": "e03067d9-c461-411d-88b8-c9668b697387", "value": "49152:NQ0rPW9oeXiwYMLCgGMdu0NwxUjsLKgMJh0tDl:NJxNwzGMY27Jh8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901469, "uuid": "f8d4202a-3999-49b2-9082-7647945939ff", "value": 4195184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901469, "uuid": "f28c9170-34bf-406a-864c-0d34be4dba31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901469, "uuid": "d37e7335-dac3-44dd-add7-02b0aa76b8bf", "value": "8cf1575ada5eace2ca8195e7bdc130c9aaf70ca6b1764e16cb9eb2c4b84d4ebd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba6b963-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786870208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870208, "uuid": "c419af8d-15b2-43fb-a244-5bbfe86bf6af", "comment": "Malware payload (ValleyRAT)", "value": "cf7baedcafb716843023534e8635c738", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870208, "uuid": "7a888626-6325-408a-aed7-1e7371f4d3a3", "comment": "Malware payload (ValleyRAT)", "value": "8d1e5f80a54df45e67585513f09b616a0dbe17c313cb321492e56c90b2abd5d5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870208, "uuid": "c9d910b4-f997-49d8-a1c1-ce94a261fda6", "comment": "Malware payload (ValleyRAT)", "value": "c32094d67a9649e3ffe162ede79ca5f4dea2db74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870208, "uuid": "7d695e68-683a-4ca9-bcb0-d3a39bf3c6c8", "comment": "Malware payload (ValleyRAT)", "value": "c93009263137722577753debbb374525e8c91e5ffc6b236815a663e13f3ef219605398b7fc37cf2a41dc4b970b784eca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870208, "uuid": "1429cc4d-34ca-4621-a533-6acbda3a36df", "value": "T13246CF173E5C00A6E05A1133CEA9B6E8F1AEBDF83B76019715A0BB1DFD32741CA1456B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870208, "uuid": "18b8e1ad-299a-4fef-a0a4-f71e7f099ec4", "value": "015ade0acc2769b31f99b52582ac5d1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870208, "uuid": "aa0c6511-e9ce-4aed-b3d9-59ceae15963d", "value": "98304:HZ450y5i1sSv66fjpSBRzPTq02LToBoa+A7Z4OiZrq1DfPHNADtV6v+zM+rwroDH:HaT8iRzPTq02QBFt7Z4O7NADtV6v+zZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870208, "uuid": "6334f679-aff4-4dd9-93a9-2e4125ae34dd", "value": 5762560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870208, "uuid": "47338652-ab5b-4064-bf2e-9120854e4d8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870208, "uuid": "f378df9c-31c3-4817-941a-038c263631ac", "value": "CF7BAEDCAFB716843023534E8635C738.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb5684f-99b1-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786912518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786912518, "uuid": "be473275-b4c6-4aa4-9203-5e3fc05587f3", "comment": "Malware payload (CoinMiner)", "value": "622879d79003e48efb7bd77e4078b211", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786912518, "uuid": "3e5334d5-c007-4c05-af63-f7b2f3dce730", "comment": "Malware payload (CoinMiner)", "value": "8d2035c472e242437a1d8d32e664ef4e4c1073141e41dc9c1dc672dd062c824d", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786912518, "uuid": "802a8db9-05d4-4d1d-bac3-ae935a49a332", "comment": "Malware payload (CoinMiner)", "value": "67f89dc68388bbbf41cd14b2cfc24057a2dd798d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786912518, "uuid": "2b95b467-96da-45b8-a931-3c24da051f91", "comment": "Malware payload (CoinMiner)", "value": "6cd9d8a6d737d278611f17bec9134ef406eea4c4c320fa76841cc2e4aee69d8abf6af8d72de326b86c70c864bcb34239", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786912518, "uuid": "f2ba6d97-559d-4eb7-a832-f92e58ff5bfb", "value": "T1F6363397A9DD9474C066C7F85A5371ECB23CF7528AA1BD477BCD28009C5AE28683E3C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786912518, "uuid": "bbccf32d-bca6-44bc-805a-d3dbfdf246d3", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786912518, "uuid": "e3cdf333-5ac2-40a7-917b-ae5de7d8c213", "value": "98304:KrwIoLJGMpfDxSE2m8a6GNkclmZiW0+iv+ARwfmtAPkjez:LdLJGMxxYmh7W9x0uARmm1jez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786912518, "uuid": "bf24c8df-ad04-48f7-95b3-69e4ec7d53cc", "value": 5229056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786912518, "uuid": "8f2f7887-eb26-4cea-9edd-32d0a843d3a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786912518, "uuid": "64630bf5-f411-402b-8ed5-d06babdffc00", "value": "8d2035c472e242437a1d8d32e664ef4e4c1073141e41dc9c1dc672dd062c824d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d29ceb8-997f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786890880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890880, "uuid": "0c0c218a-3473-40a9-af7b-9f511a391007", "comment": "Malware payload (Mirai)", "value": "28b164086da6bf160cb43d128617766a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890880, "uuid": "4c02655d-adb6-42c2-a929-81e6caca67fa", "comment": "Malware payload (Mirai)", "value": "8d40054d87482167438ca84a4127b817127d427f3b64ca09d9fac43aa6243bbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890880, "uuid": "21c91cde-e770-4373-a349-6d47b8b652cf", "comment": "Malware payload (Mirai)", "value": "7d6e34fb1a6313f0d5097ebd056299d5532b8576", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890880, "uuid": "c279a18c-9118-412f-9aa8-9abf97a1f3b5", "comment": "Malware payload (Mirai)", "value": "d6ca5e51066b03d025536d24e29df0611775e57211f141c47fd618aa5bf7333554f70011ae1189baa2759dbf3f0521ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890880, "uuid": "9673a661-bd54-4387-997d-6cf1433b3103", "value": "T19C24C609AF610EFBD8AFDD3706E90B4625CC650722A43F793674D924F50AA4B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890880, "uuid": "8d2f7db4-e58a-4616-903a-0b5ca1632b6b", "value": "3072:8QOBIjlv/GJsnJZItXZPB5Tbfi8/zQRfAzlTQ6lR4ibXZglH7Si3J:HOBOlvGsaZzHi8/zQRfAzOk4idghL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786890880, "uuid": "5718c7a8-a076-4312-9aa1-af5a23ffa6d1", "value": 225072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786890880, "uuid": "4e749690-0763-4bdc-ac78-a05b2d72fac8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890880, "uuid": "5aa529bd-b42b-46d8-ae1b-0b37f8cff6eb", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b12e2f0-99ae-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786911063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911063, "uuid": "150f1793-e085-44d4-bb5e-a206c83e429a", "comment": "Malware payload (Mirai)", "value": "6782100ca1815095ab2944a2676a401b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911063, "uuid": "0a68fc47-f360-4a37-b5d9-11bf1dd0fb50", "comment": "Malware payload (Mirai)", "value": "8dbfe68e4b4137b418bf926e86252b48be03034b156fc938fcd51b329b6eb95b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911063, "uuid": "55e9f008-f145-4021-a900-2eeac421496c", "comment": "Malware payload (Mirai)", "value": "ea43d367e304607bdf91d0b02a974e4e117709a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911063, "uuid": "3e725292-c251-40ba-84f7-6f3f7fbd1e38", "comment": "Malware payload (Mirai)", "value": "31f3b470685b36f76b9a42e18b3837a95fba905d6256e54680a036812b28bb487f2812dc99ed01504120d6f8fca8ab81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911063, "uuid": "dc167af0-1eb7-4de5-a063-51a24929fdcc", "value": "T12D04294E3710CF61C76DC93109B3CB5666F926512AE28849F32CDE08BE6134DA96FED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911063, "uuid": "812bfa0f-d39d-4898-9168-7922e200e83a", "value": "3072:e4hm4mNNLJw8PcAVRFpWtupG8gBM3W2MmoGO4GFRkqay1Ddj8:PmqupG8ZWzjRr1aoF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911063, "uuid": "fb846629-fe6c-4c83-9132-277cbff21686", "value": 181884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911063, "uuid": "ced194fb-f023-4cb7-b205-2a386ce31a77", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911063, "uuid": "de569880-9892-4053-b9ba-56019dd6df63", "value": "9ca88831fb19228437368213c10e220381cffa782a678755c82ac2ed81544282.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab8accc-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900942, "uuid": "5c5ab0d4-15ac-4b7f-901f-d55f0c968a95", "comment": "Malware payload (Mirai)", "value": "31b85c54b62497a400624f13a43f642e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900942, "uuid": "f02004c0-89e0-44e2-8619-e9eca7a8173e", "comment": "Malware payload (Mirai)", "value": "8e5a3e34e8d5bd7359bc25c73f9e535ad018fb0a9d7f5fe2b36104e18ca2c8a2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900942, "uuid": "f57d793b-7a8d-43a6-b29a-1072c892a456", "comment": "Malware payload (Mirai)", "value": "542a6ad5b673eda65497d0a5b586b50502cee6f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900942, "uuid": "8598786c-b32e-4f10-bb7b-982f62051085", "comment": "Malware payload (Mirai)", "value": "75854a6cdd56d090ceeb8b217d159bbe6a24472fe4d9813a0630a408ae2e472119282e92200269901ae7fab501bdf232", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900942, "uuid": "872381c5-cdd7-4ee6-b85d-80aca1b2331c", "value": "T1DE24091376228FA1F215C1310ABACAD67ED410D326F14CD6A36DCB9C3F22659684BEF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900942, "uuid": "a263bd93-09c6-4605-998e-6cb7e60be867", "value": "3072:D/ao/MmnMJQcnK34PZIqFDFALgnvGvmVzNIbZTEG8NeZWp2p:Da6bV34PZ7FrvOe+bZwG8wZdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900942, "uuid": "a8c5a4bc-03c5-43cc-9577-230d776b9391", "value": 213564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900942, "uuid": "597b4560-723f-472e-9f25-544643e40dd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900942, "uuid": "6d492f1b-5fe2-424d-9dbf-7a3aca659ef7", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de24833-9958-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786874104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786874104, "uuid": "1adb1fc3-05ee-4e43-a62c-db58a6e75771", "comment": "Malware payload", "value": "6697de4bbc5251e432ef5fd6b63c6b26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786874104, "uuid": "26d7374b-6684-4a33-a6e5-90df28ff178f", "comment": "Malware payload", "value": "8f07e8c86b7d44d8e01d15c4fae752cc41383423dff682bf099a36d088c4845c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786874104, "uuid": "009df6fc-282b-4626-a7ce-6fccbd76e460", "comment": "Malware payload", "value": "903f7fbfb9845d177e7e07bdf0870f5263a82450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786874104, "uuid": "65451e78-41f9-4aca-b2f2-ddb4b5a38ccb", "comment": "Malware payload", "value": "98645892f46817a20f6ce1d472d6cb6e5faaa6e55fbcc1747c9482f5a435861f524d80b78f218c61d36e12780308bc25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786874104, "uuid": "69938ddb-5d13-4e33-9ab0-64dab2053e58", "value": "T16BD523D97CF10AB4C836C37A8FD2F5BDB02A77568B609E97268C69015D2350C2D3A379", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786874104, "uuid": "6268783f-2eee-4331-a3cb-4982bb30e887", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786874104, "uuid": "571c25cb-523a-4b50-8177-4651cb7cb343", "value": "49152:I1pdXiv1Uc1HrZIPj0MIirEuC9xutHS9hmOxT1iXtEUQGG5mzAk+Bgy1a:onm1UaYIiAuC9xea8OaTREH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786874104, "uuid": "a6e662c0-c77f-42bd-b501-3f22403691f9", "value": 2977280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786874104, "uuid": "c7e60a63-1bb2-40d0-8f62-fdbb04f88e89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786874104, "uuid": "82f3e44e-7655-4600-9f7c-9f2da0bbfd39", "value": "8f07e8c86b7d44d8e01d15c4fae752cc41383423dff682bf099a36d088c4845c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642d3700-99ac-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786910111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910111, "uuid": "da751e61-e555-42eb-bf04-3c7d090448b6", "comment": "Malware payload (Mirai)", "value": "5412264fc8faccb5b8630ec0d0454110", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910111, "uuid": "6bca8a36-a2ef-41e3-be22-9d80bd09078c", "comment": "Malware payload (Mirai)", "value": "8fe44ef4b92a710ebdea792a18a060230d85f8b010f2b26dba972515f5bc407f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910111, "uuid": "e78f9728-ecd4-47a3-9069-3ed61ef3b240", "comment": "Malware payload (Mirai)", "value": "eaae5e32194611e4a268d84022b12d7ae10f9562", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910111, "uuid": "2c996e13-73c9-42d2-93df-a247aa6c5173", "comment": "Malware payload (Mirai)", "value": "e1ca1a68c9c449c37953852652cac9d96e37e423758f9845611f55b58655c0d7a7cb11f6dddd9e5ecb32e6d748e9fa53", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910111, "uuid": "5439ffcd-fa70-47c5-aa7a-4261dcd2fe23", "value": "T1921429C7F900DDB6F80AF73784570909B130B7A208925E376257357BED3A199187BE8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910111, "uuid": "7bd11c2f-e9cb-40ef-97b2-25905928b8a2", "value": "3072:KX+pwFHtGNxbzm1jGuTEXDyEQqzz4nnRFOp940akeJVnjbi8L0tx1ENfjpViKh:KOp+t0QDuyEDzz4nR0bak4LqxZKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910111, "uuid": "43ac45bc-ef50-4a5f-99a0-8cc9d299bd86", "value": 192376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910111, "uuid": "4b461891-7f6d-44cf-9221-b7a09c73bb88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910111, "uuid": "8fd4801e-1fd8-47bf-aaa1-4da99960b73e", "value": "8fe44ef4b92a710ebdea792a18a060230d85f8b010f2b26dba972515f5bc407f.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed7fb55-99a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786905190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905190, "uuid": "e642269a-d1c7-4a3b-a7c1-dbfd8b73854c", "comment": "Malware payload (Vidar)", "value": "69083090926961dc51128ad347b9d3d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905190, "uuid": "e767b59d-1386-4dfe-ae40-2229def01f8a", "comment": "Malware payload (Vidar)", "value": "9010ae2157f06053bfd2de15548b252fab3b2c121c73805032b6b34dc3a61684", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905190, "uuid": "bf8c192a-5c10-4bcc-9f7d-19ba08fead70", "comment": "Malware payload (Vidar)", "value": "936241541db46929028fba1f9347a7255c4851b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905190, "uuid": "3f701d42-9cbb-4559-8144-d3947413281e", "comment": "Malware payload (Vidar)", "value": "73d2aa184a298c3228bbd2b18ba42f36c99445701167ee271504462cf714dbacaacc2df280dd719da842b2938de7d6fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905190, "uuid": "30ca8f9d-ba05-4d3a-a6f1-2aaf862d8f55", "value": "T174268D07BCE16965C05AA33189B64202BB7CBC19273233D72E51EABA3F777D18A35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905190, "uuid": "6b96f5a8-c9d4-4495-96b9-9736d29567cc", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905190, "uuid": "ccbf58d0-0970-412f-9513-9ae9b4349462", "value": "49152:5SEQWxzHd+jEOkaAPHmZx/M9zMSzCh5cxNS5bE4RJ8MIHzE98cF2ANdZHybHcKWt:55X7Pmz8itb8MIHzEj2A3cHw7mj4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786905190, "uuid": "ba5c86a2-7c70-4291-aeb2-18d25d5a0205", "value": 4780968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786905190, "uuid": "5215413b-81e2-4e0a-ba8d-db4d5df08acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905190, "uuid": "ccb0abc9-5e28-4f68-9d57-1a58a484ce01", "value": "9010ae2157f06053bfd2de15548b252fab3b2c121c73805032b6b34dc3a61684.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34ce1e32-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901442, "uuid": "de020355-eead-4486-90d6-d7ba0e196ee6", "comment": "Malware payload (Mirai)", "value": "33fd648989874a8a1c8a8c93f8b92cfb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901442, "uuid": "98322a6f-1efe-4e43-a6c9-631fd858f0cd", "comment": "Malware payload (Mirai)", "value": "9017f68b9ef0c1f5954e3b50c1984d88e1e49449f1b7afd220b6931fecfe0430", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901442, "uuid": "f9c12307-6a5b-4d9f-b4a7-31df8c96753a", "comment": "Malware payload (Mirai)", "value": "a6a80eed6070c69469807ecd9cdb9ac4e9ec755e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901442, "uuid": "f52303a8-b43e-4215-9841-2f1b58607999", "comment": "Malware payload (Mirai)", "value": "a60de8c60f2de6cef6864845a6a6bbbab8476d8819c84cabf584a53978905fee786eff08a832b8b9ad62f2856fb70c48", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901442, "uuid": "cf9fc437-59ef-4865-b670-32200ebcd353", "value": "T1A7344B45FA418A13C4D117BAF9AF414A3332A795D3DB730699286FB43B837AF0D67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901442, "uuid": "5666ccab-92c5-4867-ae56-61e7745edf5e", "value": "6144:W8tTPAjOBzabKacEK1dAnJd7ELfdfM/9hWfAU:W8RAiBzabKacE62J2p0/yJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901442, "uuid": "ec1ab4ce-0ccb-496d-b44e-272b842f8912", "value": 231680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901442, "uuid": "ca74b3a0-adbe-4872-aa9d-93524c407d5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901442, "uuid": "ddc14a5f-57ea-465f-81bd-791293d1b6b9", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "582e2347-9915-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786845237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845237, "uuid": "a2f30fb8-9d60-43ae-b7af-a5ca28d1a3e8", "comment": "Malware payload", "value": "3f6848b5ad92af81c29567b64adf3db3", "object_relation": "md5", "Tag": [ { "name": "72-56-74-89", "colour": "#09974F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remahook-com", "colour": "#5A561A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845237, "uuid": "6965c311-2217-4e41-a873-464ba6530dc4", "comment": "Malware payload", "value": "90e3e19106fde055ee729f2a309f2519e84309c0275e27f806dc86496653f369", "object_relation": "sha256", "Tag": [ { "name": "72-56-74-89", "colour": "#09974F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remahook-com", "colour": "#5A561A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845237, "uuid": "bde0d239-47db-499a-805d-792a3c6dae1d", "comment": "Malware payload", "value": "997c643034c1fe4f7d22701a81df5d9ad987c045", "object_relation": "sha1", "Tag": [ { "name": "72-56-74-89", "colour": "#09974F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remahook-com", "colour": "#5A561A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845237, "uuid": "a8938ba8-29ba-45b6-96a3-ca88257adc6d", "comment": "Malware payload", "value": "e7d3a67f074d49899ae4b9db667bf727551eeff0b517cd5ffca0f7d8693b60c27b5107a0ec77ce5c976b544d27214662", "object_relation": "sha3-384", "Tag": [ { "name": "72-56-74-89", "colour": "#09974F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remahook-com", "colour": "#5A561A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845237, "uuid": "9d4ba1c6-f5a1-442a-87f9-53e22e114436", "value": "T19D069FD2CDE5DA73D049627DB0168F84BB3A5036B0D8DDBA0006A9D39352612F1F6BE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845237, "uuid": "760010e7-942e-409b-ac6c-1b6797c698c1", "value": "cba6a04e59320572c659515a5eed9fe2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845237, "uuid": "a3e0aafb-10bc-4be7-9c58-b7064a02be02", "value": "49152:j0BdoHjano1OAXOKU8Pmx4/g7Ksr52K5t11j9/2NMWKNpxp:op+FMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786845237, "uuid": "b1114fdc-8e67-4f94-b042-65c3bc65e53d", "value": 3940864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786845237, "uuid": "e00aad2a-11f8-4a46-84dd-6cd6d8f69694", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845237, "uuid": "5657d717-4c89-4963-8ebe-3272f723d1ce", "value": "\ud835\udde6\ud835\uddf2\ud835\ude01\ud835\ude02\ud835\uddfd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f42004f-993b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786861490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786861490, "uuid": "360bc619-63a3-42f9-ac45-802228bf763e", "comment": "Malware payload", "value": "fcb372c1f7bb46f9300861e171e0cd56", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786861490, "uuid": "59e3c6ef-615f-4b65-858c-ff4ff2d76973", "comment": "Malware payload", "value": "9159c6247f2cc43508209840353d0e7ee11d2ab2f61b66b0c5ad28063e139493", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786861490, "uuid": "6c63cfd0-547b-4f76-858b-50881193c708", "comment": "Malware payload", "value": "dbb7f31417d1c27d5f41d27fbed9b3aaa8852cd3", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786861490, "uuid": "e08b8f2a-48a1-468a-8ebe-16a30d68b841", "comment": "Malware payload", "value": "6a60c04bc554a438d523cc4d396428e7a7b24b3be30960fce8142a7909e3b94c8ad3f2433908b5a459ad369af6610eab", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786861490, "uuid": "53cd25ad-7b47-4c60-bff6-c0da4046fecf", "value": "T1F2236D6516857C24AA98D4371D7E2F0CBDAD43E6320492DE7FCB3CF28C5AA9D910871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786861490, "uuid": "bfa29afd-cf17-42de-aa30-2625cf0ede04", "value": "768:rFXRWNGxVf9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:LlxOcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786861490, "uuid": "5784a69b-fb27-4469-87bf-95f5be215b25", "value": 50055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786861490, "uuid": "408e1b78-5f27-442c-98ae-f81736a5d96f", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786861490, "uuid": "a7097fe1-e1ad-4cec-9dd2-bd4e37150bfa", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7a2bb80-997a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786888803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888803, "uuid": "325294cc-3dd8-4345-9f18-5f3feca517ff", "comment": "Malware payload (Mirai)", "value": "9f4b3d0f39be9fd5a5c3556a04d6226e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888803, "uuid": "8a060fef-5fa3-49e0-bc0d-b3aa2a4700a2", "comment": "Malware payload (Mirai)", "value": "9184d5f43df1e46d3c44d8020b1cb2d6d40c9a89c90440884abd5b49cfc9ee05", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888803, "uuid": "abaf93d3-19d6-4c80-a70d-e4bdb880f4bd", "comment": "Malware payload (Mirai)", "value": "7469e83c5f3698371a4002d80e59a6f5c4acad7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888803, "uuid": "c7f486bc-220d-4a34-b198-bf1e3d5949b2", "comment": "Malware payload (Mirai)", "value": "145796d29858356a0852a5c608d81d78f86135dd55b2ec1594328a52f07c58d6a57bc8bfc2dacbaf354429428bf3505c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888803, "uuid": "3914f863-bee7-4a19-b437-5770491dea1c", "value": "T155530132E58C96B0CF6AED748DA8EE002F84175F66B24D91E0C7FD1A1532F8A4576DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888803, "uuid": "fd383e10-0107-4e31-9fe3-4c2b452550f7", "value": "1536:CRdx8QyihOM6XQtdy862/9Xx4cUpgYeFDD/4u+qgw09n:6dxKiwMWJXK96uYWD/4u+qgwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786888803, "uuid": "eaebd732-8ca2-4645-8880-0eb27a26de9c", "value": 65480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786888803, "uuid": "8f7855ff-9a2a-413c-a53d-d07e8405dd37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888803, "uuid": "d2340b60-f9fb-4997-84bb-6c102cb1c835", "value": "9184d5f43df1e46d3c44d8020b1cb2d6d40c9a89c90440884abd5b49cfc9ee05.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5d2ef3-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900941, "uuid": "2ca22098-c098-44c1-b9c5-d49225d2d971", "comment": "Malware payload (Mirai)", "value": "b3b4e0a553da992ce2a3e6e2e4223e19", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900941, "uuid": "f15ddb16-b37f-43ca-b720-b6b3831a2664", "comment": "Malware payload (Mirai)", "value": "91abcf3d119e15566fe214a2486b61324efdd7779cf5ad0865a5d7e56243f44e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900941, "uuid": "e37bd2f3-de8a-4ecd-8581-2213e1dd8f32", "comment": "Malware payload (Mirai)", "value": "8734acfe36c71c005e34cc1668f454f1031b0681", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900941, "uuid": "e4eab75e-8f48-4121-b902-ba4a571bb55a", "comment": "Malware payload (Mirai)", "value": "23f32e060db7538113a2a36bd3c3d00879d743f38c995bb8a9d4d67c8b1791bc0e7186fef802bfc3cbacaa66c3d11b8a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900941, "uuid": "a8ec3659-57e8-4f50-90db-46092479ebd0", "value": "T128E3184AF9028E51F58112F5BB5D82D83F1303EBD3FB79029E185BB43B9745A4E2B942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900941, "uuid": "edb9fdad-46a6-4332-822a-43e47800f47b", "value": "3072:1JuNNwlH5YlsVf9AjewBgLPj37pUURzmQUnEnV8N5Mhq1oV:1JuNNwlH6eVf9AjhBsPUno8LMhq1oV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900941, "uuid": "4ed08af2-97b8-4205-978a-dfada010fca3", "value": 157272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900941, "uuid": "8aa08731-664b-475e-b969-50cb85aa8028", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900941, "uuid": "65726aa3-b161-4d22-9bf0-822071c71f23", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b016d923-999c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786903367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903367, "uuid": "e868367a-e41a-4942-b647-7c4d8da3ff0b", "comment": "Malware payload", "value": "99541eeb32be91965465a05f0c285767", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903367, "uuid": "7bd70c2a-9cf6-4487-abbb-de6988dae8c1", "comment": "Malware payload", "value": "9226c1494be670c0f9e5457b35fa22ae69c3aa4490153dc66395657404837e26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903367, "uuid": "653029f2-482e-4f37-b823-ad18bc0ca7ae", "comment": "Malware payload", "value": "6db3a2fedc41968b8535edf7b9f0dcce574eafac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903367, "uuid": "26166e2e-5a70-413a-852f-e059d4bb5c64", "comment": "Malware payload", "value": "e4f80acc44ae6dddba497b385c70bf05a92fe4849edc2e0ad7e0b334f2571ba63fd27e4cb0baae18f20a8e5955f17946", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903367, "uuid": "8cd26bc5-a4e9-416e-863a-4a5cd9129a88", "value": "T14E465B03A8A26879C0D5FB30447A8296F729B84D573937D32E71AE782F62BD15F35B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903367, "uuid": "da6eb9c7-0f8e-40fb-bf98-8ed86f4a5bfe", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903367, "uuid": "b5304030-f7e5-434a-8ebb-c01b766fe07f", "value": "49152:X+twRgF724U+D5Ed68Sw6eUKI2hIiYBh3tpZXUzUrqUiE9gxIZDFH/t:XE1VJKRInZ2UniE9XZJ/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786903367, "uuid": "b9a81c56-2fbd-4670-b0b1-be0d2f9499c9", "value": 5701888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786903367, "uuid": "38dd5130-29f7-4efe-8a1d-8202f322705c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903367, "uuid": "a26cbe7f-8a35-40d8-96f3-5407ca69da89", "value": "9226c1494be670c0f9e5457b35fa22ae69c3aa4490153dc66395657404837e26.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16662d0e-997b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786888936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888936, "uuid": "d2f80575-be23-49d0-931b-f6e6b212170e", "comment": "Malware payload", "value": "3bc261b066462bd5f30f893a33f046c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888936, "uuid": "a3edec24-68aa-46a9-babe-646896bd4a23", "comment": "Malware payload", "value": "93461c824a8f8d1a7a77ac6b039b15869362af77a5fc913e16dead4b59636e2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888936, "uuid": "e202a0ef-5810-4bf1-b7c4-c3b69fcb4edc", "comment": "Malware payload", "value": "47fb2da9a0e2cc0238be14c3081f6546d2c14f34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888936, "uuid": "5d1702b0-369b-44a8-a08f-87f6e29325f2", "comment": "Malware payload", "value": "a673bb2243024d838973f894dc9414d66f3e298ab81a6a1ab420f53076256be979ba37c960f57a709bb35878136692d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888936, "uuid": "8d65c9b0-8f2c-4021-b903-4b2737bb6f44", "value": "T114265A03BDA608F9C09AA73188B75652BB74BC4C4B3123E32E50BA782F767D15E35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888936, "uuid": "b28ac49c-4676-445e-bcd2-a749d1280168", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888936, "uuid": "d941624d-8094-4203-9e92-51457bc827c1", "value": "49152:t+eMw5fJ3Kg8hU4ZRAQ2U7HQMWAfp9ocHrz9nfxoroxJd0cp2:t9Z4nNVrWcHrVJBz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786888936, "uuid": "5d9d7beb-3177-4ea8-bda8-4803bb4df46a", "value": 4597616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786888936, "uuid": "2606a036-6989-44f2-aa41-c2b86b72509f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888936, "uuid": "2679451e-078a-4092-aeb8-855b6f12496b", "value": "93461c824a8f8d1a7a77ac6b039b15869362af77a5fc913e16dead4b59636e2d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad95b851-994e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786869862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786869862, "uuid": "f1c18602-291c-41c5-b1c5-c88dc05f196d", "comment": "Malware payload", "value": "d7d9c970b87acc56dcebb40353114af1", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786869862, "uuid": "754641ad-0b81-4892-8b8a-4dc31c65611d", "comment": "Malware payload", "value": "93af5b623fe925539626587b7eafe2f7ca672058e4f58604389b44e377587d58", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786869862, "uuid": "8feac72b-18b2-4e04-9c6a-ac2a08ba1018", "comment": "Malware payload", "value": "8adc7bc49640693e0fcbba63c566edcc914e5731", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786869862, "uuid": "3f7de79b-a9f1-4ed9-bed2-d12501760402", "comment": "Malware payload", "value": "94907927e2301c2dbaf90286d318afc65e4172e060867b803d716721fd69e711a71380370ad327c8073111c2b3adad81", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786869862, "uuid": "fce7c683-3365-4abd-9352-69267ae6d8a9", "value": "T1E8263316C1935F40D7B821786A1A87B4EE9BCE63948AE052D39EF713C13EF5107294AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786869862, "uuid": "021aee8a-d636-47f6-a044-bd2d845b78e1", "value": "815498dd6caabe57f34cbb6bcf9662c7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786869862, "uuid": "99a60a80-5c19-4fde-b54b-764cedd2adb3", "value": "98304:CrLauu+zyjZtFwkD91X3zjnvpiuy+B7PQl:4l8DFz1T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786869862, "uuid": "b39babd4-dcea-4945-9d09-3f6d9fcd680d", "value": 4825600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786869862, "uuid": "deeccd4a-f861-40d4-9840-e88fa209e161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786869862, "uuid": "4915f4fc-a9f9-44bf-8e26-ee79fbc72ea5", "value": "payload.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ecd150-99c5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786920751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920751, "uuid": "0383ba1b-77dd-4884-92fa-fe2589855d92", "comment": "Malware payload", "value": "82a8d6a572eea8a20afc59834a5d098e", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920751, "uuid": "c1cc6739-abc2-45e4-b7a5-6a19351a9252", "comment": "Malware payload", "value": "93c43976238785714abed8e9e7b7afbffe5b021517b85ac7166d37e3ba73b46d", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920751, "uuid": "e9d6090d-0eef-44f3-9361-5c4157cd6536", "comment": "Malware payload", "value": "740ca63149074b2c1dcb6724d5b9ae35f1440821", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920751, "uuid": "9e0bf98a-b084-45f2-8f15-fc05986a6834", "comment": "Malware payload", "value": "2997474694e18f49f8846b782418c80afccf170ce05c91ff097c596d9c97c5afa845b72221619f2a52c049273d60812a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920751, "uuid": "9424632e-0e63-4848-9d37-21e523f4a9f2", "value": "T118E6330C6AC025EADE73413CEAE380E5DA79B47A6734DDCB576817629E031E0493EB53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920751, "uuid": "aa07a7a2-4461-495d-ac3e-90d29f8a0f0b", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920751, "uuid": "3ab97b1b-bd11-4d63-a40c-b6c99edfd5df", "value": "393216:gCWa19j77gAEMDKT0PBXMCHWUjncuI3/PGTAI:Waz7EAE8KT0PBXMb8cH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920751, "uuid": "3cac9f69-b214-4f2f-84a4-2f6d45500927", "value": 14060863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920751, "uuid": "65cff900-7a92-4b8e-b145-fa93801c08f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920751, "uuid": "635e3187-083d-409f-8ccb-d1cffc45e651", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cb38de-99ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786910520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910520, "uuid": "d3a8bb49-b5b2-4cb8-b4f8-d31e70bebd05", "comment": "Malware payload (Mirai)", "value": "2e120955cf61f7d3eb7016d666d25703", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910520, "uuid": "25623557-2f88-457c-946a-af1b0e2ab51f", "comment": "Malware payload (Mirai)", "value": "93e25d37381246b8b5be733a38319cabe0fdab4842f0073639f639b73a58e9ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910520, "uuid": "d88b167e-dfbe-4e1b-a8eb-4ad7767c4d8c", "comment": "Malware payload (Mirai)", "value": "b06f88185763ca59bbd5047543fd7ff146fbe0a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910520, "uuid": "9f20af00-44d4-4676-be91-f4b8116632ae", "comment": "Malware payload (Mirai)", "value": "8fdbb7f71b8d8414a4929ca5087444ee6bafc59189014924b694bb4b8c40bd17077bc7ba7e2b39a8e95b69188083506e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910520, "uuid": "d9840c97-27a9-454c-a74e-8a8e81437e7e", "value": "T1FFC32AA9F890DE52C6D52676FB4E428C33231778C3DA7105CE109E34F7EB95A0E3A952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910520, "uuid": "99e5f66c-a9ec-48f2-8350-832021c4d016", "value": "3072:bnsbGXagUQwUex6MTcYEEUji2sUOivLGaIyovL3NzFxNxguCf1Dl3:bc0E/TcYEEUji2szKLjtovjFDC95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910520, "uuid": "fc1405e4-cc53-4988-adb6-90d14eb3bfdb", "value": 124368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910520, "uuid": "ad8d24db-d6e9-4519-aab0-b7359809f614", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910520, "uuid": "7eb58fa0-3e06-4ee6-8dc7-5487de085142", "value": "putita.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad781f99-9994-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786899926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899926, "uuid": "590e78f8-0e9e-43f6-9088-27ca3feefc35", "comment": "Malware payload (ValleyRAT)", "value": "1b8128ca311379eff8a70c9e3cf8e766", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899926, "uuid": "0268a6d1-e841-4598-bfd8-1d57498e213c", "comment": "Malware payload (ValleyRAT)", "value": "958cf7e879ff5a52e365859b81d2ac1f4b198e05e873b438f147dd5975ed77e1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899926, "uuid": "032ee301-139a-4dfb-abe9-82effc564704", "comment": "Malware payload (ValleyRAT)", "value": "c8eaa68324cf39d681af0fb60e0dc92d310c2f80", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899926, "uuid": "0f7a1486-1a83-49c8-b998-68dfe7cd7b26", "comment": "Malware payload (ValleyRAT)", "value": "5810de17b98f734243399be5b989d1498283ff61adcb9349103d381326492aa19cbfae120e16f836ddb4adc2fd6e8763", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899926, "uuid": "c78da77c-774e-4ee9-92e3-0c21bcbb76de", "value": "T1CF647D01B481D136E6AE0930B875DBBB497DB8701BE2E5CFA3D40DEE4D216C1A73875A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899926, "uuid": "9e7571ba-1b4c-4cb8-a645-ec38f2987af9", "value": "e39ddfd958ba9a668dfaf494cb1afb53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899926, "uuid": "0ee44f10-c3a9-47f6-90b2-b74ed0d712ec", "value": "6144:J9ycm+gGZsU4d0gLqiX9wh3h9Sna/MZdwZUUuoDgBz:JXzZsU4d0gLqiBld2URoWz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786899926, "uuid": "38d311ba-9980-4794-9165-40df7e02b6b1", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786899926, "uuid": "ee2097bd-0092-46cd-a60d-0c580ae40ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899926, "uuid": "933a5b6c-5ba7-4a34-a51c-7141207d38ca", "value": "1B8128CA311379EFF8A70C9E3CF8E766.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd9dae5c-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900920, "uuid": "ec8e1fca-3275-4b77-8f5f-283862d0f57c", "comment": "Malware payload (Mirai)", "value": "337f36eba5d192217a2bd5a59ab37937", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900920, "uuid": "fa07a561-6fa6-4a2b-a0f7-e661536b26d7", "comment": "Malware payload (Mirai)", "value": "959ede92b1ab90071cf99b024f2142b5d798a84d8a8709f2782b4fec8bda6e6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900920, "uuid": "6a66527c-1306-46de-a88f-336bb5efe0b9", "comment": "Malware payload (Mirai)", "value": "59d80e57ce98c6600e9f24ba6147b50388f5af3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900920, "uuid": "624dbbbf-41eb-4c6f-9de7-35551c9d32de", "comment": "Malware payload (Mirai)", "value": "1c10f6f9d5947a18f4baed2f5d8df59d75d6cfbfe13abe11ef0970204d699bf774f3604c8cb4d8add535001afac5f8dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900920, "uuid": "9634db64-b936-412a-b76d-4f33ac2dceea", "value": "T13BD32A05730C054BE2A32EF03A3F67E193DFDA9131E4E644295FAB8A9171D321586EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900920, "uuid": "1fa7999a-5eaf-42ac-bc39-1647e19bd94e", "value": "1536:SvzP9gAu5n5z9Cxi28kNKghYp7gKMXS9NOjAmqMvAo/H2c/21OGg/Y1/:+zPuAuJl8xJKpapSjOj0oBU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900920, "uuid": "6486d4a9-a5d8-4b59-b80e-6c39e57fb189", "value": 138224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900920, "uuid": "6b8ea257-77b9-49ed-b563-4f6ddfbaeb60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900920, "uuid": "f6786ae9-1e48-40f1-ac1d-f028210d27d4", "value": "miron.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e11d607-997a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786888492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888492, "uuid": "7115ed1f-1c7f-48ce-85d3-8f39b9d71f3e", "comment": "Malware payload (Mirai)", "value": "0ac8831a35caf037f54f5d1d2541689a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888492, "uuid": "ca411cd9-4758-45dc-9490-e3954f00d7bc", "comment": "Malware payload (Mirai)", "value": "95a4ebf8e7458fb859afc698f4c803fd8bbbfbf6ffcb55afe24badc47790b7e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888492, "uuid": "03f66a21-6104-4e01-9859-66e88bbf8f01", "comment": "Malware payload (Mirai)", "value": "b69ac33927bd1b8d7bad6b6ef86b5d19814ae7ba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888492, "uuid": "b3ecbb7d-5ff0-4057-94e4-2ab523406c4e", "comment": "Malware payload (Mirai)", "value": "b11e643e7171cd255dfbc7fe6a03999f3df833732512dd46ec6aeaccde0fc91a80ca28aef74272424c667b8e745702c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888492, "uuid": "7d98b011-29f4-4f9d-8724-34253ec7a872", "value": "T1A0B36C49F787E0F0E94A0AB1116FEB3E4735DD221021DD5ADBA5FD71AC72602A11B36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888492, "uuid": "a74f0a28-520e-40f5-aa8d-8662d10f9484", "value": "1536:30LGDUahROuFaJjCzy7Wef33R2krWUJ31MDB8ot6Z50k9Lrkqr9WNuF5P4VPAr:30CDUahku+Y8Xf33R5eDDt6/5kqUZVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786888492, "uuid": "2c5f6b62-cfca-49fd-8f9c-4ecf7b77694c", "value": 116556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786888492, "uuid": "4f5f4660-47eb-4c68-9dab-2b12971e95e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888492, "uuid": "f4d1351a-55d1-46c0-a71c-783d1fea0012", "value": "i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2617a20f-99c4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920315, "uuid": "8682a6df-d59d-4d57-8e23-72e3b199df40", "comment": "Malware payload (Mirai)", "value": "67bae47c4d7eaf56c900cbdb717120cc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920315, "uuid": "75a12544-36db-420b-86b3-fb47e0ccf515", "comment": "Malware payload (Mirai)", "value": "95cdaaf1c29013aadd248ad9c6c15922bb420a5558e6efdf6c52c8b16dea67cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920315, "uuid": "6142015d-736e-450a-8166-86b72dfaab5a", "comment": "Malware payload (Mirai)", "value": "5c729a60acb530563f0ca4e3f2e8244fb77b127a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920315, "uuid": "2279d287-ee60-4d20-9d77-4f9e885d4bbd", "comment": "Malware payload (Mirai)", "value": "6f5f87f5c4e4107677ba2b9a6867aa8f7f0c273d66043121016df6196a3d051dbf65e802e67dc5ebd42cacf26bca7fbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920315, "uuid": "562210c3-f0d9-4294-8910-3c6db81b0341", "value": "T145C32A46FC819B22D5C712BEFE1E618D33131778E3DE32129E185F21678A5AB0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920315, "uuid": "c0f1ec20-a6ab-46dd-a1ba-f8a20ea4cfe7", "value": "3072:cZMAszUkNuRi++e0BoakzMyNgX6ye38lnW:cZrWuRb+e0qa9HX6y1lW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920315, "uuid": "7b5927a8-b1e7-4073-b02f-571b770d217a", "value": 120284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920315, "uuid": "dd918456-8882-45b5-8541-555aba888e46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920315, "uuid": "f445b033-5285-4356-8463-2088eb38e21c", "value": "95cdaaf1c29013aadd248ad9c6c15922bb420a5558e6efdf6c52c8b16dea67cb.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d306c5-997f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786890656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890656, "uuid": "26bf501b-372a-48e8-869c-4eb81c1bee24", "comment": "Malware payload (Mirai)", "value": "27f65d5ceb5567a4e5026b79dbf41009", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890656, "uuid": "27936a8c-54ed-4f33-a7a9-dd5685e994b8", "comment": "Malware payload (Mirai)", "value": "95f1bc419adc6090bb3622a0fb4359f0869b5e938ac3e7690466d56045071a30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890656, "uuid": "06620ec8-12ea-4742-a3af-846d6ac0cb10", "comment": "Malware payload (Mirai)", "value": "170d753b75a2699cb1efd67050f54c84d4ce827d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890656, "uuid": "46391b1b-01c2-4616-ab6a-24a7f0bec924", "comment": "Malware payload (Mirai)", "value": "92085823111c098b4394bd5556fa1ce967250097410c658671994fbb2ab30747840d99e648144d6a4397340fab7d5b88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890656, "uuid": "76ee70e3-932b-4975-967a-2211ebd6714c", "value": "T10CF34B01B30D0943E2632EF43B3B27E1D3DFD9A224F4F684251EAA8992B5D315586DDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890656, "uuid": "99f1040e-c80c-4479-af2e-83cd45d7ce9b", "value": "1536:J+uDg0oInOtJ5GtoxbWal/J/cwmV7wdcOcus3Fj2zNSspT06AFJgqivAbtZkz0vA:UuMtI4xbn0mSGTKJdbZ8H9b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786890656, "uuid": "0e99ea40-918b-47a4-acc3-76621c9a26a3", "value": 170780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786890656, "uuid": "92fe135b-6218-4de3-91c5-9fb8e36ec7ae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890656, "uuid": "456b22f0-3733-4d9d-8bad-dd4b7b13aec9", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231035e9-9984-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786892822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786892822, "uuid": "61b0ff84-14ab-4661-b0c4-d827d01730c7", "comment": "Malware payload", "value": "f4f81b712197dd5b242366a79097b78f", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786892822, "uuid": "c6ad3001-e45e-41e0-94f3-304dd8b930d0", "comment": "Malware payload", "value": "96e0fc57aa49a22f375fbbdad431be6459dbda9089c6edc9ee4c23cf17cf27ba", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786892822, "uuid": "57f3dd89-0d2d-4422-973b-beed3ed4d194", "comment": "Malware payload", "value": "3179edd0ce52d913355248bd1790804f5bf28883", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786892822, "uuid": "f2ad555b-a1ac-4f0a-aa72-d2c559fa42f6", "comment": "Malware payload", "value": "cea2c6897e8b985a60dbabd3c55a8ccfd4100225c13ff05bba8429799d1fa5961502d78852660f17f71f2ae36cebbaea", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786892822, "uuid": "8ba4b444-a9c7-49b9-9a38-82474c296be5", "value": "T112062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786892822, "uuid": "d2634888-35d7-458c-87df-6d1451159f16", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786892822, "uuid": "88b2fe5c-f24c-4f4f-9dc3-2d7df872c5e7", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnGO:+MIKhlPGO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786892822, "uuid": "79d3af7c-a8cd-4c3b-9e3f-c1d028d36317", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786892822, "uuid": "7c627cb5-8e98-488e-b0c4-0542b01f9441", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786892822, "uuid": "04d28264-f260-46b2-9b08-9a7b381c0c67", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f3f3b35-99ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786910560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910560, "uuid": "7042808a-9709-4fde-ba4a-d440b3393f80", "comment": "Malware payload (Mirai)", "value": "b35121c5c07a1798fef098ea2b0fdf12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910560, "uuid": "c06686c2-0090-4da3-9ae5-b8f69950c8d5", "comment": "Malware payload (Mirai)", "value": "97c941e1ac351aa3d00bd161b72ff7be619a78a8d763f8076593fea485d776c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910560, "uuid": "4c067d90-2f71-425f-912f-dfc69ed12815", "comment": "Malware payload (Mirai)", "value": "9d98b1bf479730682a26a35d28a3e7538f93ffc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910560, "uuid": "2f1107da-0c9a-45e3-8618-cdf39fd43c75", "comment": "Malware payload (Mirai)", "value": "27e62d1020dc191173f183e954f1c4c1b77eaead6882742bf160aaa9e9e104b908e18a602ed3f24e0acb18e685ae5025", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910560, "uuid": "2de4143f-964b-4c18-bc47-379e3323b66f", "value": "T1C543F1A2C6316DE4E07931BADD51D01287EE416CC0AFB377A661730853C189727BA76E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910560, "uuid": "9a34f4ff-540f-479d-8a93-8d7e1c3cca00", "value": "1536:vkxgyInKM8Kw70gO7/BytpcRUz75chiyfI:v3KM8XO7/B0cRS5XyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910560, "uuid": "784fdd74-8daf-4bda-8733-7248f8cd622f", "value": 56276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910560, "uuid": "8e952fca-389d-4454-b72e-53d244d156f8", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910560, "uuid": "bb8bfd14-d711-4335-8d18-b041a585d8ea", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "668eb6b4-99ac-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786910115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910115, "uuid": "680ba13b-58b2-4e4c-a7fd-501701f38954", "comment": "Malware payload (Mirai)", "value": "f8bf9c16aa8dca4123f1ca70cec5a313", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910115, "uuid": "4d0199e9-5212-430b-a5c6-0a088fc9cf74", "comment": "Malware payload (Mirai)", "value": "980d4b7220194293e408d04c3781817acf82cc62f00874ff65af16ae0f7444ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910115, "uuid": "006d2a37-ba7b-4cd8-89cf-c064590ee8f4", "comment": "Malware payload (Mirai)", "value": "ec83b3ce81055d87e58c9bd087a6b370bba0e687", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910115, "uuid": "c06b48df-29df-4b9e-bb1d-e940ce715b77", "comment": "Malware payload (Mirai)", "value": "90448d228735ee8d2e1b27ba9f07ae2ac6176ab1dd34b26872c8e13b62bf271ebafc87b7bd2e0802b612271a79646ac8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910115, "uuid": "43b847e0-0188-4804-894b-9be51a4d30e4", "value": "T1F55302630BF6D2A0DC8D94BE24CDFE86909F7AD072F6D8B11F86A4AE1845314592C8E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910115, "uuid": "d84df93e-a07a-4fc5-a58e-dc67e161117c", "value": "1536:wQlY8u/H3+6Y5WrMpoocUhtCcKD0QUqoF15uw8ZlrWi82nouy8Lzkk3:wQlY8EH3+6YQSCcfQA98ZJWioutUk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910115, "uuid": "142f62c0-b044-40e7-822c-09d8c1390948", "value": 61100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910115, "uuid": "58f3fbd1-8796-47b2-b8ee-9ed77634adca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910115, "uuid": "87d665c1-5196-48c4-bb6c-97a8ed01d56d", "value": "980d4b7220194293e408d04c3781817acf82cc62f00874ff65af16ae0f7444ab.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb52736a-997c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786889749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889749, "uuid": "21fb1c5f-dc23-4614-94d6-73f44111e828", "comment": "Malware payload", "value": "5d06872610ff6c2575987c82d0c2e502", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "toitoin", "colour": "#5A8EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889749, "uuid": "9706aa5e-423d-446e-8d87-6da2fa0c7b5d", "comment": "Malware payload", "value": "9912b4506f00f8881fd93f69de5c9b26ff0420e621fc14c2da2c254f43f12a3d", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "toitoin", "colour": "#5A8EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889749, "uuid": "399d3641-668d-40ec-b8ee-db106ed38757", "comment": "Malware payload", "value": "f45ebe02dfe00947722f27e960eb037c249dcf3c", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "toitoin", "colour": "#5A8EFB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889749, "uuid": "4967ec5e-a43d-42fa-a5b4-83345fcba7d6", "comment": "Malware payload", "value": "568bee8fc95f8d05f3af8623accb9d1a3f5c030cf4db4cbc0c4bfa4e5ba2a9d450e3bf1354b0f72ed01b5d6a0a9299c4", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mosquito", "colour": "#2F9486", "exportable": true, "hide_tag": false }, { "name": "ssl-fic20-com", "colour": "#28F1B0", "exportable": true, "hide_tag": false }, { "name": "toitoin", "colour": "#5A8EFB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889749, "uuid": "839f00d7-0729-42fe-ab6f-f51df15e9dc6", "value": "T198463B2FB698922CD15DC53785A6CF40A53378F55B3AC7EF229007590E25BC09E3EA39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889749, "uuid": "81aa1fa1-3e4e-405c-bb7a-528ae29598c0", "value": "d43b4a670d26524569e4430f7f43296c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889749, "uuid": "6b150a18-09c5-4bda-853f-a578fc4ea993", "value": "49152:zAbhf3Dut6WOZQnEw9A0DsTMGn8ThnMI8QU9hM/HiLyKN367lsYZ:B6rXcA0Dv5NKtml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786889749, "uuid": "b7b7f315-0025-4648-90f1-5a62d3e99826", "value": 5718528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786889749, "uuid": "ec90ae14-2bc6-4f08-a822-6dda13de2f01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889749, "uuid": "c588a349-3de7-4c36-a47c-bda24f24c60a", "value": "LBUXCP.869.dec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c7e7a4-990f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786842864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842864, "uuid": "b74e6ec7-b26f-45a8-9f80-17762ce2e9c0", "comment": "Malware payload", "value": "873486dafe9cea231a8c8ea79ec13849", "object_relation": "md5", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842864, "uuid": "d0f0436c-2674-446a-8c73-ca8383922a35", "comment": "Malware payload", "value": "997acaae90f21aebb154b75c2b2c787fa49e8d3d0cdf5c5893d6f7ddbb3d67b6", "object_relation": "sha256", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842864, "uuid": "b3837b57-2283-4b43-89e4-8c15d0eb834a", "comment": "Malware payload", "value": "ba0ca40c195d8a71071daa03eb291c2fdc0496c0", "object_relation": "sha1", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842864, "uuid": "d3d59a4b-6bf1-46c3-a95c-5e3b1e900d04", "comment": "Malware payload", "value": "e67ab036c88c5981946a6c57dc7b6fb93e9f143b39821e1d7fe7b6e1d10578dc788eed37151d447a41164565d94f2a5b", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFraud", "colour": "#AE113E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842864, "uuid": "5c299ba9-3d3d-41ba-bb7c-c4de1f75a3d5", "value": "T164061318ABA435BAFC729674CFB38BE0DA717807035195EB1794785B0EFB1D1CA26312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842864, "uuid": "38cceb2d-180d-4d8b-a3ec-f32eee471994", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842864, "uuid": "6c1d8d37-49cd-4700-9b7e-1a01fa7ee856", "value": "98304:06IWd3osQEICM2xSzHJZClQhKC0135eOLbeekOaXFPQdyBf:0ed4+RMiS7ClQADeOLaOaydyBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786842864, "uuid": "8a7e0f70-ca1d-4cf7-b0f0-428ba00ddff9", "value": 3895676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786842864, "uuid": "ff1bb971-4a8e-4d4c-966a-2d44d0bf08f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842864, "uuid": "bd72b904-8eb4-4e4c-a43a-a24108c34f82", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f01b231-9944-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786865462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865462, "uuid": "119ee8b6-fa78-483e-a8b7-03b039561ab0", "comment": "Malware payload", "value": "34d818a4e1cdbd2d6ac62149343ac074", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Poison", "colour": "#A57E37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865462, "uuid": "265f1a3a-4803-44ca-87b3-c1f5511f948c", "comment": "Malware payload", "value": "9a00488667f6582322dce8529936a333fadc225ea394d3f270b0cd56101b17f0", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Poison", "colour": "#A57E37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865462, "uuid": "eb1e54cd-763d-48e1-80e6-7f198a3b9bac", "comment": "Malware payload", "value": "76b72ddd064f0b083446c50acfb172f04e9da4eb", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Poison", "colour": "#A57E37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865462, "uuid": "7f45f69f-9603-4955-a02c-4095037aa8d3", "comment": "Malware payload", "value": "3337faea3e1292279ba919cec9c5c058185b4c6687c125b16c1dc941c689c7379019ec450ea734292dccebaaf57543b9", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Poison", "colour": "#A57E37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865462, "uuid": "598e89c5-7e86-43e0-8ff3-b31c64eb0c71", "value": "T16CF63388643DCED3EA604FFDAC2E36C1AB0BBE6337F0C14B5124718AE1A756C5166D94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865462, "uuid": "620f6bd3-12db-437e-8b7f-c2f3c2e4fd90", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865462, "uuid": "37d24ff0-31f4-49e1-b22f-f6f10751f324", "value": "393216:oCP3R7uBMNoQTDSoYj7w5olIE4lGiuZI4gL:oCPB7uc6oe05KIN7WI4gL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786865462, "uuid": "cbbf5b4d-d5c9-4224-bb05-c5afefea5727", "value": 15999488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786865462, "uuid": "04d0de20-62f4-4902-b4d1-2673d0d7d3c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865462, "uuid": "ab60f162-0084-4079-a082-61e0a77ef906", "value": "Nursultan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6692dc7-9979-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786888452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888452, "uuid": "8973007e-d47a-483c-ade2-0ef9df61b554", "comment": "Malware payload", "value": "d2c113a73475a9eb1adbdaf8d7b20881", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888452, "uuid": "894e4c70-cdf6-4200-9e1e-bb7c5537d315", "comment": "Malware payload", "value": "9ae9d775e20eb0e2fdd33061ba707801cae8177b717ce1a94bcfbb4a138498e2", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888452, "uuid": "226d8574-23ea-4e92-8783-94de1abc298c", "comment": "Malware payload", "value": "18401776aaed59e006d681a6674d4ac18f94ae26", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888452, "uuid": "691a59a8-5c01-489b-8ced-5e124b7310b7", "comment": "Malware payload", "value": "5aec89eb9805a17e4d5c49dadff2b54efb8cb120fbd6735d2c0aef1e5df416ddd5dac0b9664b3305f2707c414e358f8b", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888452, "uuid": "05df2352-fdc4-4f7c-a162-9c5c174144cb", "value": "T10BF5F13FB28B653EE06E5A367AB2E210583B776165578C1696F4C84CCF150B02E3E787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888452, "uuid": "cb1b26b5-a047-4167-be01-7171d16569a2", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888452, "uuid": "e7be24b7-c3e7-4e4e-b20b-806366a90983", "value": "49152:euIihF68Jrw75e4loEubUAaN9Lx8JjWAWpFFw/Znobvb5Bf6kC:e5Sx8744loEub4LPVFw/BobvVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786888452, "uuid": "7e45c89d-cfc3-47cd-875c-efb46a1360b5", "value": 3477672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786888452, "uuid": "946f6488-c0be-43eb-ba55-bae29ee0fc00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888452, "uuid": "117f88c6-face-46be-ae64-05c2fbabcb4e", "value": "Mayskiy-Antivirus-Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aaf4b0e-99ac-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786910149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910149, "uuid": "49cb3420-6e70-46c5-b5d4-4bece6593a89", "comment": "Malware payload (Mirai)", "value": "f2010984c1b883f8554c4876e9738a97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910149, "uuid": "fe338344-e14b-434a-8a31-80b204212272", "comment": "Malware payload (Mirai)", "value": "9b4106fd95eff50ef0be7b4090eaa2dd98fbff829ca2c89514547c60ec9de68a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910149, "uuid": "92404b61-5886-42ef-b46f-1adb20e3919e", "comment": "Malware payload (Mirai)", "value": "ffbe476a034fe11a42cbee787782fd0e292ff577", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910149, "uuid": "78b78ace-e048-436a-b209-9e4a50408a85", "comment": "Malware payload (Mirai)", "value": "f926a063da5c86500b35004e08418872c56c6eb755d211ccc452ce00732772df0c68fa39c8668665f02e819f00b341b2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910149, "uuid": "e2a308fd-253c-4fa7-9329-ee0b491d2a0e", "value": "T1EAB36C49FB83E0F0DD5A1AB0115FE73E4B35DD221021DE5ADBA4FD72AC72602A12A75C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910149, "uuid": "d60d8627-bb33-436f-849d-da3090beb06d", "value": "1536:tEJrE41ixa78MQNuPqLKAeSz30KtzN9QvUu9nUO31EmsoxNmoDLrg6SDl3a5bV4r:tEJ9R78M2ugoopZN9QvpeIxIag6GYVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910149, "uuid": "7adad8af-0bb1-4853-9277-7245ce0139c0", "value": 116944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910149, "uuid": "a703be2d-77cf-46a8-bc79-e891c831ff64", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910149, "uuid": "4c3c7277-21ec-423a-a81b-c5b5c2a68b14", "value": "980d4b7220194293e408d04c3781817acf82cc62f00874ff65af16ae0f7444ab.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18540d0f-999a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786902253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902253, "uuid": "dcd9937e-d64d-49d3-ad31-965857965484", "comment": "Malware payload (Vidar)", "value": "9502dc6a86d835aecd3181ea23570d57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902253, "uuid": "0501e6e5-a73d-4064-86a4-dd529172f550", "comment": "Malware payload (Vidar)", "value": "9b55ad0ce660d573be4d9ebe78a3279bf0cc6afec30b36989b5b1e609f66a3d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902253, "uuid": "84d97da9-d4b4-4d6c-8902-fb15b2de8214", "comment": "Malware payload (Vidar)", "value": "713613a3a71781f6b64587e6bb50543cabaede4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902253, "uuid": "2a0f2df0-600a-436e-8066-39383324c4c2", "comment": "Malware payload (Vidar)", "value": "3e7d130cf949508a85ce3136329d40784e8f1850eabe24f422e72e82d805a7becfbc41431e345d2ef8d36207be7d0930", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902253, "uuid": "87fb66ae-851c-44fe-bb48-d407c321bc3b", "value": "T109565C03FA5149B9D0A8EB3185F78366B6687C4C873037A71E71AEB82F26BD16D35710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902253, "uuid": "bffd06ed-81b5-45f6-9f4d-6bf7fb2af1b5", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902253, "uuid": "aef8d908-3224-4a13-b636-87ba47f6e2d3", "value": "49152:r76aMwYbD/HzFSBQMdrYCwIWaLFAxEUNlujmi+fX7OHeofZ0dNTZ:rpMTFSBTrh5AxvNluqiCKH3fZoTZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786902253, "uuid": "04c4a03a-7c74-4e9c-bd15-f1b6deff9c7a", "value": 5898400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786902253, "uuid": "3ab44756-7e76-409a-a3ec-d6d94a2c5447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902253, "uuid": "e8b164e9-b13f-4177-8bf4-18dbad8901d2", "value": "9b55ad0ce660d573be4d9ebe78a3279bf0cc6afec30b36989b5b1e609f66a3d1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f899a43a-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900912, "uuid": "2e3a2f80-2be5-45fe-82af-da8bed9ab5fc", "comment": "Malware payload (Mirai)", "value": "9ce60059f050b8b57af9e94a0bb0f554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900912, "uuid": "b310b726-75fd-4367-b128-cd22198f4475", "comment": "Malware payload (Mirai)", "value": "9b5602387bcd9bb74f6e811acc66101aea2ba9cbc396c7493cc608d01d0773cf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900912, "uuid": "f043b964-d766-4da9-af61-74cf3659f2a4", "comment": "Malware payload (Mirai)", "value": "f2df7815d0bc845f777cae1fe320823e64c50371", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900912, "uuid": "e2156375-115b-4a2e-a216-1620d8a1496d", "comment": "Malware payload (Mirai)", "value": "62c055d27ce4c8436958d5bfa3ff4030e376ffa2d2117cf9aab664901385e5ece9e6a50c6c1da67b763339074a2fdb9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900912, "uuid": "fa0225a1-700e-444a-8c1c-22862aad57c0", "value": "T1DAE3F996B8818B11D5C151BAFE1E124E33131B7CE3EE72039D146B697B8ACBB0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900912, "uuid": "01f68cec-280f-4024-8e1a-9c69c98ced55", "value": "3072:WGsBkZRC3Un83MUXjafFbfaymiEn/6ZP1slK:tsuln8DX4FbaGCwP1slK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900912, "uuid": "f1f9144a-69fb-45f8-9c3c-5b6766906050", "value": 145820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900912, "uuid": "dbcffd9b-5610-49f4-985b-ea6c626b99dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900912, "uuid": "802deab2-678c-416f-8cce-49129691c78e", "value": "miron.armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8126fff5-99ae-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786911019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911019, "uuid": "83877400-a9bc-45fc-af99-b26500d6c490", "comment": "Malware payload (Mirai)", "value": "94bf0254f0f41393c229c011020807fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911019, "uuid": "1fd1f566-7553-4383-b7fb-de99a37f49c2", "comment": "Malware payload (Mirai)", "value": "9ca88831fb19228437368213c10e220381cffa782a678755c82ac2ed81544282", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911019, "uuid": "a1803a9a-4efd-41c8-ab63-800770f95756", "comment": "Malware payload (Mirai)", "value": "f23b6e2822bdb8c209f07f49ff812f8d3d28a98b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911019, "uuid": "bd27f733-6604-43f7-b988-eefe89618310", "comment": "Malware payload (Mirai)", "value": "be99740d78d9ffbc12590befb98820007dcad9c393b30bcaf2f627f5a185e9dcd70c0b421272560266a3e13df6f19c11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911019, "uuid": "9c24fe48-97c9-4f04-96f4-8d978ab2fa71", "value": "T1B183124734783DACF688BABD0B4EABCD7BF566485C03A6232AD0D8471CF4971A404EE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911019, "uuid": "4a7f0bb8-0f83-4aa3-8d65-2f7035eadde7", "value": "1536:pcar3xelZucT02aBEgmqsmDFjom4EdeoV5tMJsL/cRvzRIxQ2meQdE:p1VIPxaBbhFV5tR/6zRIxv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911019, "uuid": "0d2a5ce4-38cf-44f0-a852-a6e8878f94d2", "value": 83652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911019, "uuid": "a2f32422-b9a2-453d-b71a-7ae8ac6ba9ab", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911019, "uuid": "cd1591fc-4d60-44c7-9f2a-e8fb6d883ae2", "value": "9ca88831fb19228437368213c10e220381cffa782a678755c82ac2ed81544282.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d37f27d-993f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786863150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786863150, "uuid": "19b479c6-520e-4338-bb90-39dff66f0bd0", "comment": "Malware payload (Efimer)", "value": "4f449393902c0b4dc459129d5b37e2ee", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786863150, "uuid": "8fde7be5-9b0a-4ace-82e2-ac6ce45babc2", "comment": "Malware payload (Efimer)", "value": "9cb7ac08fb03c328fae8c37617ae4bd85871bc98cd78f0e75bdde8152262e3fb", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786863150, "uuid": "a5a3c933-c804-43ff-8a4b-29865dca82b2", "comment": "Malware payload (Efimer)", "value": "37902fb92c305eb5185e0ce9d074406a4cbbdc59", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786863150, "uuid": "3a4c34b7-b053-4461-893d-9ca8393d3696", "comment": "Malware payload (Efimer)", "value": "5cf101fc41786e916cf2fae53cb4dd9e8a4e578a496765c08bba82682e91b91aca447099195614ca49041a0e24a599b8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786863150, "uuid": "5ee8971c-ca5c-43a3-b0a3-8a31517a8843", "value": "T109E6334C56D526DDF5F380BC9EE25215E46ABC318732CADB0B7806A52D173E0893DB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786863150, "uuid": "6306e50f-ca17-428c-bd72-0749f82f381b", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786863150, "uuid": "dc42120c-75d7-4f52-810a-8a1a18ef3a00", "value": "393216:h2EmUsR/polXg7S0CXMCHWUjGcuI3/PGTAI:wEPs3Mw7S0CXMb87H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786863150, "uuid": "5e21ac46-8920-46f4-9b8f-8239c26711c8", "value": 14091560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786863150, "uuid": "6eca9e1c-da85-40ea-8fea-21f7cbd7efda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786863150, "uuid": "bfb85f51-2660-4655-92d1-a99a66da8ba7", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05dd7877-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900934, "uuid": "fcaf7952-191c-4479-8ad8-04cf0d28c096", "comment": "Malware payload (Mirai)", "value": "d80abd2e79bed01f0114bf09074ecdcc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900934, "uuid": "5b6beed3-b62c-4a6b-a300-bdd687fdd074", "comment": "Malware payload (Mirai)", "value": "9d1335f1541c054978480ab0330a52d49c452a417c3471563367310f229704af", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900934, "uuid": "dea7a206-6dbc-431d-aa03-c7c555520756", "comment": "Malware payload (Mirai)", "value": "76c47b2217c946990650cc93b79e9ccf68e95f0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900934, "uuid": "20dcb1d1-802e-4b78-8072-628b91771498", "comment": "Malware payload (Mirai)", "value": "d9ad4ed9c4e78c275d4695f5cd9368600bafce5616324b3d572ea5e75d1b8e62f2fcff77e33d5b9525018272dcf133e0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900934, "uuid": "5a20d862-38a4-4216-843b-e184988f2803", "value": "T166E3390BB8C090FDC499C2B44BDAB136DD32B42D5238B66F27C46E266E8DE316E5D750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900934, "uuid": "81dedbe0-3db1-44d0-9dcd-8b086ceaefba", "value": "1536:j3rlZUzFJKtKR9T3jULJg7SAgp8C5HGsBAbl2uXPd+V1H3h:1ufKtKDTTV7SARC5HGTblpXVaxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900934, "uuid": "357542ae-bf0f-495d-9edb-be4a004647fc", "value": 143864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900934, "uuid": "9e61ca7a-52cd-4b59-bfba-ff639b9ad1d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900934, "uuid": "59852255-c662-450a-ac41-e8a6ab1b1deb", "value": "miron.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081ac78d-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786915111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915111, "uuid": "d1bba93f-881d-4913-8860-2af4738046d1", "comment": "Malware payload (Mirai)", "value": "13ed0f2133dfc396e22a9254d5cd69d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915111, "uuid": "b30fb000-0719-49eb-83d0-924a38c49de2", "comment": "Malware payload (Mirai)", "value": "9d32f8797140ba3d6026ed828e15eaa7e01e98177d3155699c39a7a0e514c8ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915111, "uuid": "8c01372c-d16c-493e-bc07-89f6c57a72e3", "comment": "Malware payload (Mirai)", "value": "8b5423933d05183b9b5a04a30bb889c58d9d647d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915111, "uuid": "125fbeca-5877-4a1a-80c7-d837ec604efd", "comment": "Malware payload (Mirai)", "value": "07ba624c0d8c0ba0a895ca4550d286a80dfa4b2eea14a8a9bb4fa9306ea34df514def02444db1f441b416b3e80f50dec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915111, "uuid": "e0cd3ff5-b75a-4eed-b194-526bf4116a84", "value": "T193345AD7BC41D9BEF84BE73A89134409B130A3A300514A36B21F797BAF3A0A55577EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915111, "uuid": "1b847904-40ef-4346-87ba-6375b50acbff", "value": "6144:hVGT1SL+O2DyalrJirRUTHgFNXILDdyQDVClssM7khWoKD:hVGT4L+OATgKKlssM7khWoKD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915111, "uuid": "34708b2a-dcc3-45c3-9fa4-461eb970c9fc", "value": 235052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915111, "uuid": "4c2100bd-4a7c-4471-9479-5a2ea681929f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915111, "uuid": "894ad366-d50d-4129-b8da-168cd76ccf16", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b20a98-99ae-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786910805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910805, "uuid": "e920d7c0-812a-4ee1-812b-b08301fb6161", "comment": "Malware payload", "value": "c39ae01c66c92e53596d2b4ef7224b58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910805, "uuid": "fc9ddc07-32f9-4c8d-88c9-60a61245de1e", "comment": "Malware payload", "value": "9d9c0228f0874af0a04d0953a895476709a08c189ef3916a7acf9e890130596d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910805, "uuid": "576eb527-37a0-48d6-9d3f-548d3ef08166", "comment": "Malware payload", "value": "d61fa18db0d0186139d81b3850afd9317b086c3e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910805, "uuid": "ddad6a1e-87ec-410e-b7d4-468f7871c73f", "comment": "Malware payload", "value": "aea84f465362eb2da5b4c94897c6fbd499be74b9d70cd2e112f6ba2311eb3f2a664d983bfa2d82b7131de90d332048f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910805, "uuid": "2841f775-4fa3-445e-8c04-75be86b39a3f", "value": "T1A0E5AD0B6C9445B8C4AA623D88B65691BA75F8548F3933DB2E60F7343F35BD21D38B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910805, "uuid": "004a397a-2905-462c-8195-81862fa4e2f1", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910805, "uuid": "afd9d433-458a-42b4-8f58-f7f264bb5dbb", "value": "98304:TpP4gr7BPvJCDhBFNIkIAXN+LsTjIHVayMLnacGy/s9qtFpnTDUq8fvfxTsrwOI0:TpAA5sNXZIh4S5KtbnTDUz9LR0Y9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910805, "uuid": "a72c44bb-7e14-4fad-89ea-839d1b17ce63", "value": 3297296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910805, "uuid": "60854f95-cc2a-47b4-8b53-94fb01347fdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910805, "uuid": "77e10b7f-96aa-4736-9f12-4efa80f57c77", "value": "9d9c0228f0874af0a04d0953a895476709a08c189ef3916a7acf9e890130596d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acaff4d-999a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786902257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902257, "uuid": "524c046d-38cf-4dd9-abe5-8b2248a77893", "comment": "Malware payload (Vidar)", "value": "ac35ce3944a12f65d28a791d4b6f9369", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902257, "uuid": "b976c33e-9bb1-47d0-8bb0-bdabdbb2121b", "comment": "Malware payload (Vidar)", "value": "9da90d850c78ef90b4964813b0239864fe0e9e051b118ac0542f6cc6ecb62671", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902257, "uuid": "620dc0d4-7c81-48be-a5b0-94477ff906d8", "comment": "Malware payload (Vidar)", "value": "2666d70ea924eeb079c21b0104a3e2a4e21659d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902257, "uuid": "acc3c56c-29f3-4501-84db-9c434e55b3e6", "comment": "Malware payload (Vidar)", "value": "1dabc05b8b236ff04b9a27a64e56f021846d16fe2323f3e4e6ee7ebd42fd8f9d9ba6b7a89fa8d2cc2e2d53f617c6e76a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902257, "uuid": "b085a08a-bc5b-4632-b2ad-13a366ec21fb", "value": "T131566C03E95545BAD0A4E332C6BA8356B629BC4D873437A31FB1AE782F32BD16D35710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902257, "uuid": "a5db3c6a-5d5a-4e85-8846-bce35c44a1c2", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902257, "uuid": "eede2253-5658-4d90-bf2c-664e9ae48b1c", "value": "49152:e5Ff/ZVbggn6IgdrW51dr54j2cKMYvA+HEht3q3fby+SKlcP79WAPGXkRgVOIheA:eTXmKkTavITgkRgUmeTi/WSU/9dZYf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786902257, "uuid": "fa87b7b8-b409-4bf9-820a-e2209ee4bc60", "value": 5899848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786902257, "uuid": "dd94e554-0cb8-4d85-bf80-5dbd49633b70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902257, "uuid": "1621b074-e464-42d7-8828-02dd1309ccff", "value": "9da90d850c78ef90b4964813b0239864fe0e9e051b118ac0542f6cc6ecb62671.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0cc8ce-9995-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786900085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900085, "uuid": "f73a8e70-cef4-4b8a-be76-fdf9e46a4e38", "comment": "Malware payload (Vidar)", "value": "0fdbab0ce6c462ab2815c21213995e77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900085, "uuid": "3bcff32c-6b6c-450b-94e2-a2c4040ab165", "comment": "Malware payload (Vidar)", "value": "9dcc03d8c394e1866700702a08ff62f7b267ac0ba78cded56f0e7d6103eda576", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900085, "uuid": "3d1904ec-dfb1-40aa-8d6d-dd221d116c66", "comment": "Malware payload (Vidar)", "value": "86aabc03cdc3227711b365bb9f9a19a52975f780", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900085, "uuid": "240774a8-b594-4b9e-ae97-ad0b504bdedf", "comment": "Malware payload (Vidar)", "value": "86a106d536a67f53e4e92cd4827b4b01ee8cc04bd8e00769318dc763c234d3b063304f97f1785bcdd66f0d08726f7e51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900085, "uuid": "c459a259-5291-4da7-a6cd-644c9152b322", "value": "T1AC069E17BDD04CB5C4AAA73289AB5242773DBC4A4B3233D32D217A363EB27D19936750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900085, "uuid": "335eabb0-0003-49b2-ac42-cba583fda943", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900085, "uuid": "37d225fd-31a9-4933-ab8d-4835b10db5d4", "value": "49152:PXxT+3I/Q+S3UKvGrz6dzLXxM0cHA7vGwaj/b9ICWj3n2SNEX8:PBC4z69LvckebX9Iz3n2mEX8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900085, "uuid": "edb26375-da61-42b8-a0cd-a17e52ca2a23", "value": 3657280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900085, "uuid": "5c87c286-6ba5-4c67-867e-9ec24020cc88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900085, "uuid": "813eeef2-24ba-4a96-b4a2-f07ea3b54ad3", "value": "9dcc03d8c394e1866700702a08ff62f7b267ac0ba78cded56f0e7d6103eda576.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b06967-9935-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786859183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859183, "uuid": "d36c5776-c9b6-47da-9c07-1848cf5a5d35", "comment": "Malware payload (ConnectWise)", "value": "7c25026a44e8ecef8bfd6bae85621f10", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859183, "uuid": "eb52bbd9-8433-422c-9ac9-5b9bb2b60f07", "comment": "Malware payload (ConnectWise)", "value": "9ebf52f59547e6b9c2cc08c829f4f4d8ecf6a2063bb07cdc26d6d17920ef3213", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859183, "uuid": "9dff9023-3865-4706-95b6-dfa03a7aa6d1", "comment": "Malware payload (ConnectWise)", "value": "600ba5a9b9e460f7c88d596c3beb03fa29cd30ad", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859183, "uuid": "d2982f69-cdc4-4b95-949b-309fd9b6b28e", "comment": "Malware payload (ConnectWise)", "value": "f8bf6a57fe71bde42a0398d157b4dc6636c4d37e4204b67088d18113fd727b7be2fdbe11f9c428a84e09ff2906238881", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859183, "uuid": "336198b8-6668-4923-be6d-c97b14a7446c", "value": "T19C647C11B9C48432C673383147B4E2B28DBDB8302D655B8F57A81D7A9F741D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859183, "uuid": "65b2c370-d5a5-4909-949d-8a5a49579ad5", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859183, "uuid": "8254cc0e-e00b-45ae-974b-bf2f87d060b2", "value": "6144:CmlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9d:B1iw7gryNkSV1hy1Z1u2JLu9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786859183, "uuid": "a47ffdcb-7d1d-44c0-a7ce-38c68610fdce", "value": 312528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786859183, "uuid": "73092af4-443b-42db-b6ab-799bf7990bc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859183, "uuid": "3a260bc3-d817-4daf-a132-65b91a5f0ac6", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cfd84a-9956-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786873367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873367, "uuid": "d8195b8e-5a15-4a31-ad84-819bd9ebaf5f", "comment": "Malware payload (ConnectWise)", "value": "f41c68d38d739ffb21cdc6d0371647bc", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873367, "uuid": "b6f81afd-995b-4724-8c19-11e7f8512a37", "comment": "Malware payload (ConnectWise)", "value": "9f4db76352f4314f4e0a6a9fd9173b1ccbb7be69993673ba194c0a8cfab33086", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873367, "uuid": "5587ec45-2dfa-428d-9263-2aefa3c267b3", "comment": "Malware payload (ConnectWise)", "value": "6243c0a7631b59bd26f33ab76d7a4fa6034cd475", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873367, "uuid": "ba802f39-31f8-422d-becd-abcc27810b59", "comment": "Malware payload (ConnectWise)", "value": "9cdb9e4d6e9aeb277208c771e0b2608c4a4f91b54838565a25d2202402932aa18160cff99338d3c65573112ab2997be5", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873367, "uuid": "f75ea056-5b36-4dd1-8c41-c0240b91b438", "value": "T1D2647D11B9C48432C273383147B8E2B28DBDB8301D655B8F57A81D7A9F745D0EA29B6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873367, "uuid": "1ed7b578-49ff-46f1-89d5-09780091301f", "value": "c2fe6927e1db8cf00400dbef9e5d35be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873367, "uuid": "149e83cf-f667-4ed8-a8ed-6aff30d45458", "value": "6144:6mlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:J1iw7gryNkSV1hy1Z1u2JLu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786873367, "uuid": "c1763b0a-41f7-412c-8028-8ec6cc18bdd5", "value": 312568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786873367, "uuid": "55a1154d-a1d4-4b9e-81ae-cbcfa0f5db4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873367, "uuid": "50ae0f9f-bbe8-445d-b23e-2b8204987d94", "value": "support.client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfa7ecc2-9944-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786865624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865624, "uuid": "5c1a7300-c54a-43a8-a624-8c13f52c0b02", "comment": "Malware payload", "value": "69c135c6fe79b7827e52c552ba859f80", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Poison", "colour": "#A57E37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865624, "uuid": "84c9cc1b-c71f-47f9-863c-bd750836b920", "comment": "Malware payload", "value": "a08df11222f9a4b3d72b1035d195a4aad830a3a01e4b3590a0e8f86a7231cc34", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Poison", "colour": "#A57E37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865624, "uuid": "3c14879c-02fb-4a0c-af7c-8c0fbac53111", "comment": "Malware payload", "value": "33995e70ccb4dc332ed32a14fa7cf5c2cbca0f95", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Poison", "colour": "#A57E37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865624, "uuid": "82ab5f56-c15d-4131-a954-d847a038aec1", "comment": "Malware payload", "value": "003ddd8bd0c792ab8202e1e56e7e3c1908c441ec5165995694ac7c1f7f8d7885724c6ed8fd49e68e4dd417bfe16e85b6", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Poison", "colour": "#A57E37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865624, "uuid": "65fd88be-b58c-4717-885c-93bd2624200f", "value": "T1F806332DE93A58F5C174AAFCCD5341032B10A9971991023FF206E6F8A7E4E4C2FDA9D5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865624, "uuid": "fe96ec90-881a-43ef-bff5-b1abed507285", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865624, "uuid": "39d1544b-7562-491d-8944-3d5a684be8bb", "value": "98304:IdRNkg45C3TjczRyONtp2brnyreEkwFZtL:EgCDYNyONvZxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786865624, "uuid": "68400ebd-667d-4bd2-aa38-24eb3723467c", "value": 3658240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786865624, "uuid": "0ed04c8d-cd20-4310-9f89-cf6562f4b92a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865624, "uuid": "7e786a50-84de-47e1-9711-133eb4341f10", "value": "winws.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa1b80e-9926-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786852551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852551, "uuid": "e13c81ed-771c-4d5c-ab28-56f0c9f21cf1", "comment": "Malware payload (Mirai)", "value": "487d5aea24b7d21b7d8a79f37bb04504", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852551, "uuid": "ef03ca57-cb0b-4555-bba2-1b755622e093", "comment": "Malware payload (Mirai)", "value": "a0b52c93b606d2c7b5d910b215b8d342f8dafab9afca7014319fd62bad4ca3db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852551, "uuid": "d7c94bcf-8475-4fe9-9860-69c80fa0dfd2", "comment": "Malware payload (Mirai)", "value": "b2dc56a3c34201318b7eb0d6d87fff4e9c0ad653", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852551, "uuid": "6172ab2f-8226-4d09-8178-b5eb4fcbab4a", "comment": "Malware payload (Mirai)", "value": "9daf0579781482887ad29f9428ede1f8138eb060db2361b5d41f6220a1fed8500ce24c8ae4771a05b4851f496cbf154e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852551, "uuid": "e6d17947-b8a6-44fb-af9f-a0f6acccc071", "value": "T1B32423AE73660DEADCB2A468EB75C58AF0D547F7C26AB263DA87014536B07534308CF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852551, "uuid": "f54a5dec-a22c-49dd-8c17-4302902789b3", "value": "3072:KuKzx5MwLIaP5U/8NByP9RN1qWSEwwZVOWAQug+MAfvzuQ1mAuad251goaEo:5wdIaP5FuPDN1wYZVOfQ6t9u0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786852551, "uuid": "a2d76d52-bf77-46e7-8f74-711c81ec930e", "value": 209784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786852551, "uuid": "9a90f71d-b9e2-477c-88aa-491a9a37c50e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852551, "uuid": "8ad8fae9-2241-47f2-b762-ca0b481ce86d", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ee220e-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901009, "uuid": "90f3023c-38f0-4e6f-9033-23172176f24e", "comment": "Malware payload (Mirai)", "value": "671380022648b6b638e3e3d45b934a50", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901009, "uuid": "f0e8bc7b-849a-4ad6-b701-e82d0114183a", "comment": "Malware payload (Mirai)", "value": "a1388b624bb5dde9d26dfe68b4c2d4d9741861a13c4f6d4e85c48b9283c52b80", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901009, "uuid": "aaeac5ed-3a30-45ad-a0e1-37320e307065", "comment": "Malware payload (Mirai)", "value": "2eee34dab6add8df097f0343ac7beaa12d28f42b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901009, "uuid": "ecd1d6c6-7fab-4629-a4c5-bcab21c8bdf5", "comment": "Malware payload (Mirai)", "value": "3c82d557955230fd617712b0060481655685e172dbe958a6ef3da0ca2f951dde991b57feca46c6d06e5f1ec3f231e4ea", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901009, "uuid": "f78c0a7e-0522-4617-b0d2-d06cf5963b71", "value": "T1EE935C22B439193BC4E4943712F35326F1F6439A24A89B1E7E710E8EBF156D0364B7B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901009, "uuid": "8bdeee48-e41e-4174-9fb0-1eaa5206d564", "value": "1536:yl5GrqkdLGkr/gzYeR9Xi/3StnpYm5mwAtQIt2W5:1nY5VGCRpYO31W5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901009, "uuid": "8a5e14be-a22e-4579-bfa5-912bf4d01537", "value": 91968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901009, "uuid": "ebf5281f-7fa3-462e-a342-56c1b978d04b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901009, "uuid": "3fe20c1c-88a6-4e99-af29-2254f86e763e", "value": "nz.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0255e96f-9917-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786845952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845952, "uuid": "bd6fae10-1db1-40e3-bb0a-7c6439de511d", "comment": "Malware payload", "value": "995e3533e618287a3f96cd98f29574f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845952, "uuid": "66d4f532-4fdf-44a1-8f8c-1ab7028d0469", "comment": "Malware payload", "value": "a14c82f0a4088147b6a34d9893f8afeaf0a78b0599486d6d52eea70f89c1e929", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845952, "uuid": "1fe7f7a0-cb62-477d-b3df-bd286a3e20fb", "comment": "Malware payload", "value": "a5328f4d2e7ec4cbc8228d807b26183c40af32c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845952, "uuid": "e966e418-e0d3-4dfd-a8c5-816a005d5232", "comment": "Malware payload", "value": "cb6b26a2be4e8bd659fcce3a93b0dc67fe9aa0bc7387689ea5699b2f5d0d507444fd1470a278e77ead7cd11f19bfade9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845952, "uuid": "f780e878-74c8-4c76-921a-7092df37fa30", "value": "T1EBA55B176D9081B6D49AA73984B642A5BB32BC4DDB3273D31FA2A6743F723D14C36B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845952, "uuid": "dbd8c9ba-0cde-4fde-9689-2cde3a7ee63c", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845952, "uuid": "2f65b8a4-1b8e-4a99-b2c6-ad462ff293ef", "value": "24576:btC+LcfV87syCmEIpozdZj//1FK6qnJNBRZ3jlFXhwULu8:ZLcfVYsFDIpoRZT/1FWJNB+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786845952, "uuid": "6afafacd-ef6c-404c-af51-027485cdcd85", "value": 2216464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786845952, "uuid": "d57e505e-1203-4e61-9be2-b963b914c329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845952, "uuid": "0b8954c0-a946-4165-9448-f639da13c09b", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b859076-99aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909211, "uuid": "bbc105d5-52c9-4d65-9175-f09897d598a8", "comment": "Malware payload (Mirai)", "value": "2eef21b130468150c0f82fbc31edbaeb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909211, "uuid": "f3138baa-d47e-446c-9c82-48432bb8bea2", "comment": "Malware payload (Mirai)", "value": "a39b08c06b02a547516c3b34449821a4f4e921999e78dc6bfd9718b5469571fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909211, "uuid": "1db6f775-c171-4185-92c4-f152a3676b54", "comment": "Malware payload (Mirai)", "value": "6ee7766e6b39f1909dcf8c6c714e0c7b86b7e1ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909211, "uuid": "115685a0-ccd9-4bd8-8a17-d55a6e41ff33", "comment": "Malware payload (Mirai)", "value": "bdd7a9fd7c33a1e82c018fbcdfb22abc7ce490201b708b5be1e44227092345f6650806d5f5106822b3fc5889b54fdce0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909211, "uuid": "2bf2e6a8-9e20-4890-ae16-e7604c08355f", "value": "T1E3E36B72C869AFA8D538E5B0B0B48FB91B539850844BAFBE54B7C2798043DCDF5053B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909211, "uuid": "54a4e5cf-90bb-4c92-822a-10fd07a33bd9", "value": "3072:L3w6WPD8FgV5es3d73slw/Ox/WhHAH+w8TsHG:L3srzV5es3dgBuhHAF8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909211, "uuid": "86dab524-ccaf-4b44-8c1e-51597f1ed5a0", "value": 150232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909211, "uuid": "65d962c1-2541-4a0a-b3ef-61ccbe43d01b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909211, "uuid": "fbfffec0-ce2f-4a49-aa99-559b987767f1", "value": "a39b08c06b02a547516c3b34449821a4f4e921999e78dc6bfd9718b5469571fe.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178f6245-9953-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786871758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786871758, "uuid": "20a96e21-3dfa-4d26-ab51-7f5f545a75fa", "comment": "Malware payload", "value": "ad73ec3c4c0c38d8302e0f1b9d8c110f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786871758, "uuid": "2f7ca0ae-27e9-4969-a1aa-644145668edb", "comment": "Malware payload", "value": "a46364a51d363d404b5528d4203580e92fad910b2a1a06ae6849191eed16840d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786871758, "uuid": "ef56ef4f-b5eb-41c2-9f1e-6adb0ee5069d", "comment": "Malware payload", "value": "1c4a90010acfcba81a44938fa0e29a2caccf2c13", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786871758, "uuid": "7535d498-e84d-410c-a05a-fbc2b6e02a3c", "comment": "Malware payload", "value": "0946e170575973ee7f3dcf2eda68c8d3d5a056d65815360ae7fe535880d675acef834f8249c98760295afb13be5bf7a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786871758, "uuid": "09589f0c-a249-44e0-94c4-7c00d5ee795d", "value": "T19227CE77914338E9E5A98DB4D01025426DAC388B5738A3C7BAC471F667EA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786871758, "uuid": "2b862891-367f-484a-a9a8-fcac9cda7868", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQ5:cqYUQuVDt0TZEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786871758, "uuid": "4c9f9bf9-9bab-43d3-8f98-7e73fb24f67f", "value": 21659648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786871758, "uuid": "fe51f833-db03-4268-ac2e-79dfaded4f15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786871758, "uuid": "9a8f89bc-9d09-4b6c-aa34-1052e28789a8", "value": "a46364a51d363d404b5528d4203580e92fad910b2a1a06ae6849191eed16840d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce74b45-990e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786842212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842212, "uuid": "da66701f-c3e7-43eb-b472-93c8dc48ee3c", "comment": "Malware payload", "value": "3f970b3cc1750863a65530f8b10fc1b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842212, "uuid": "4c24d15d-2750-477f-a25c-7e5bc55ab026", "comment": "Malware payload", "value": "a4e7500f5e360f33223c504da7c953894ff2053fec6f5b6a6ca772bc78a61742", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842212, "uuid": "23ee3d3c-d7a6-41e0-b99c-e7a426d42b29", "comment": "Malware payload", "value": "5cddabef22b54c78e8a79568a83b1e8c8ff2b747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842212, "uuid": "6c2a4434-6b24-4880-b257-65e3f19bf4c2", "comment": "Malware payload", "value": "8813fa194041fa532c6affa141807414756df1f76b292883a8134916f20aa8f9acf63ec860e411deeb17b04a5dd67655", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "sfx", "colour": "#01BF67", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842212, "uuid": "aa61fb25-cf21-44eb-bba2-eeb5afd445da", "value": "T1BAA51218D7B405FDE0B3D578CE574912EB76BC4A47B1E68F03A0A9A61F272A08D3D712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842212, "uuid": "92b6b3fc-401b-4688-8534-ce8a8e2b8023", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842212, "uuid": "204f02b8-034a-48ab-af22-321230b005e3", "value": "49152:06xcx0yWXe7pKUoFFLDb+9Twus084y0zjp+/kPM:06ILIUwrAsut8/wN+/kPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786842212, "uuid": "f47014b6-42cd-4f0a-a680-68e8f5d7e257", "value": 2077973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786842212, "uuid": "ddc9c1a2-55c1-4068-985f-92d897e82088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842212, "uuid": "ced19cb4-8a86-4adb-93fa-1211a703e6d9", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac08b30b-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786870289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870289, "uuid": "e6ba5765-0c11-483f-a6be-60c689ba7b8b", "comment": "Malware payload", "value": "156a1f3a78d7eaa3522f38686a854226", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870289, "uuid": "f935be91-401b-4379-9f08-6557f196cc8d", "comment": "Malware payload", "value": "a5d07ca615baf5cf80059ca963915b616006e323cfbda14ce44ac775c5ba0ddb", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870289, "uuid": "5be9be29-6c3e-467b-898b-0e6099e62441", "comment": "Malware payload", "value": "614526ee5cc167991c0408c33b00e4cd961fb5f5", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870289, "uuid": "d6eea6db-2882-4dd6-9f34-01bca0dbc7ba", "comment": "Malware payload", "value": "e879e942bc5d72ddf377677ae05f20ba8387ce518504ffc17a58984bbdf1e9810b19489b90987b00ca696b1f0fbeb607", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870289, "uuid": "e4b13dd2-a609-445c-ba2a-cafd6561267b", "value": "T161B2E60EB76748EDC949D43881FB9636AA72BC0849B12B3E4324EB711E95B643D3DB44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870289, "uuid": "576b4bb1-af16-491e-ad4e-4bcf3ccb7c16", "value": "5bcfd99140b04a4b24c742176fff15d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870289, "uuid": "3f1773a8-0238-4b36-9758-0f606c50883a", "value": "384:dpU6Gj9idaq1eln4neTOdRHBx4yEyPhsfcnkdCVUh:dp0jm1el4KQ5jENc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870289, "uuid": "5964eee0-8702-47a6-847d-c28225eb6918", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870289, "uuid": "8f1fbe00-8336-45b0-9b73-18081d2faeff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870289, "uuid": "02c2c067-8e01-4f11-b946-5530dca8f15f", "value": "18cb7a9ae6f1d608.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee10a6c5-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920221, "uuid": "3155c93c-10dd-4496-9ee9-0fc70003d5dd", "comment": "Malware payload (Mirai)", "value": "f9d842a80ec15879fa964f0bfd205bbb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920221, "uuid": "617b6648-e2ec-43e1-8e54-295c8573b87f", "comment": "Malware payload (Mirai)", "value": "a667186cda26e52f3cd9c22b56101384cf274439a24ff2c5cacc181f2d326c9f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920221, "uuid": "5a872aec-63c4-4fe3-9e88-bf3567469e1c", "comment": "Malware payload (Mirai)", "value": "58a784ebf4c452466b04873d7d0e606f4011d31e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920221, "uuid": "1d672abd-79e8-4028-a9d0-bcbcae5763f9", "comment": "Malware payload (Mirai)", "value": "631ece9316de0c4077023074560e1fb05fd6f48a1068169a2b56ee88cac19b432655a94dcae05570f4ba7143e79c2e4f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920221, "uuid": "00aa3dd2-d363-42c0-808f-585befb355fb", "value": "T1F7D3E069F8C0CB23D6D1667AFA4E254E33131B79D3DA73069E109F3123D341A4E36A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920221, "uuid": "6dc4aaf0-d5eb-4245-8781-e439a105c9c0", "value": "3072:7D0ownSrawJoWjKUDVSg3XHcknauNMGk7F3Vlahu5R:7xwSuwJbjKIVH3X8VuNgR3ChuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920221, "uuid": "82926cac-a6e0-4d26-ba37-eb8374c59840", "value": 142002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920221, "uuid": "f1752039-c5f3-4c81-b0dd-a983cc54f970", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920221, "uuid": "6a6a1da3-b6ee-4ff3-b2b5-a5d2e6c0eea9", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5364786-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900772, "uuid": "8720d58b-90d5-458c-b51e-08dc38933e3d", "comment": "Malware payload (Mirai)", "value": "757d2a195d0283048dfcb522148fa123", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900772, "uuid": "162f81d2-367e-467c-b861-8c5e5951b289", "comment": "Malware payload (Mirai)", "value": "a6ae3d4fb33fb7d06e99f90657693e935c71afa179c70ce226020e16d0b97e2d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900772, "uuid": "efcbb9de-4023-495e-97a3-897e0c6ea1e1", "comment": "Malware payload (Mirai)", "value": "6d886bfb40cef646754b22fed24b7c80b8141e5d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900772, "uuid": "589a217d-0514-4643-b9f8-d55245d03f0d", "comment": "Malware payload (Mirai)", "value": "06fa73d6ecce5eaaf37d44ef4a6eeb0dd1a03870cf93d4c9081efa9d42784edf6816a775feff9a466c0c3181448e5bbd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900772, "uuid": "ec449a69-6f89-4a90-8594-847550fa1eba", "value": "T11CE30A45FC909F26C6D6267BFB4E438D772A0768D3EE7203D9255F20378A95B0E36242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900772, "uuid": "65176e18-2dc1-46ef-acdf-2adda4833453", "value": "1536:HkgglfWNO6vC5dJQxv98K+I7XIgONEmPFxp1ADebtTqXISWfUODbyHsTJDOQl5iu:ofN6vAecNvF1A6twIHrYsdD9/iQ15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900772, "uuid": "9ff130b9-af65-46a7-81cd-8e0025ba0459", "value": 154336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900772, "uuid": "4a3d4030-ab4c-48cd-86d4-7094db44100a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900772, "uuid": "f721fb1d-039c-4741-b428-7c59082e552b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c5aab45-9917-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786846050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786846050, "uuid": "c4ac116f-ece4-4d64-aac9-a2a45c30c141", "comment": "Malware payload", "value": "3e336b956ca4804d695ef530d36c2e90", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786846050, "uuid": "64d585c0-abeb-49e4-88da-2b1afd67249a", "comment": "Malware payload", "value": "a7485df161e31b9e812b9cad625f300daa603fb4a987b7e46ba1038badaca1ef", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786846050, "uuid": "e783327c-29bd-4d65-b7e3-c5efbbdd55d1", "comment": "Malware payload", "value": "b02ab5defe334b9bf9bd99419fbf1651d848eafa", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786846050, "uuid": "1494ec94-eac0-48fb-a982-05184e1309de", "comment": "Malware payload", "value": "6a7445d298016a830632f5b7cb7d5561de7b634016fde0a74455a60569c867be3165acc6db7ea95a70b6baf7a83d724a", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786846050, "uuid": "e7c865d2-4cbb-4b03-8c05-e64a2487afe4", "value": "T17C062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786846050, "uuid": "ee788caa-ed02-4117-8a1a-7643aedf6490", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786846050, "uuid": "bc94b1fa-ea8b-43e2-844e-768e24bbf4ee", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnGQ:+MIKhlPGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786846050, "uuid": "e32359a8-5679-40d4-b6ca-48f3a6b01aff", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786846050, "uuid": "cbbce5a6-09f6-4d01-ad14-742683c281d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786846050, "uuid": "18372d23-dd08-469c-96da-fa468ee13767", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca20403b-99ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909853, "uuid": "b51c3f71-08dd-48fb-9dbb-8127c373c811", "comment": "Malware payload (Mirai)", "value": "31e24e120228731f3c56b0f07761f91e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909853, "uuid": "c294156a-b761-4e45-a158-ee0d13728a9e", "comment": "Malware payload (Mirai)", "value": "a7782011e7707311062f88241d0e554f93fb81568bf2910591997ebbfe357631", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909853, "uuid": "b4fb8c1b-d6a1-4317-af0c-fb44a40f1dd4", "comment": "Malware payload (Mirai)", "value": "e561946106132fdc6ea90955664c5dc9a3f27387", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909853, "uuid": "1f832137-a7b1-4048-a0ae-5beaec46d0b3", "comment": "Malware payload (Mirai)", "value": "05d4d2e66775d70f2d4bbbf316a532f59fb5f0bf2f718835ebef93c7aa09259021930fc34cc1281424cb95684a2ef3f6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909853, "uuid": "f8ec8237-0f6c-4c46-8dec-23d6d7f78413", "value": "T1EFC32AA9F890DE52C6D52676FB4E428C33231778C3DA7105CE109E34F7EB95A0E3A952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909853, "uuid": "2c8f6444-49d1-4fb5-a3ed-37551433c187", "value": "3072:bnsbGXagUQwUex6MTcYEEUji2sUOivLGaIyovL3NzFxNxguzf1Dl3:bc0E/TcYEEUji2szKLjtovjFDz95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909853, "uuid": "9c5ddd2a-b222-4b96-b7b3-8a7796a03e68", "value": 124368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909853, "uuid": "3654c123-d890-409a-b854-2d427e126a20", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909853, "uuid": "822aa95a-0cf5-4f27-b1f4-6269a228ffd3", "value": "putita.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09994393-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900940, "uuid": "73ed3121-a018-41a2-96cb-c52af95570f9", "comment": "Malware payload (Mirai)", "value": "b2b59eae12a5737c5bd839dcd8c05f56", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900940, "uuid": "61c8971b-f421-4570-963f-538b47751e72", "comment": "Malware payload (Mirai)", "value": "a7ff91703ad022f190f8632ae272826d1ac48e02e155ecbbebbfa3f4c93dda1b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900940, "uuid": "ceead2c5-e11a-444a-998d-de645a6e53a7", "comment": "Malware payload (Mirai)", "value": "d62d94f433a95a87d1604d9c7d836332c324fc00", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900940, "uuid": "38751473-0902-4c72-98a3-563785441bb8", "comment": "Malware payload (Mirai)", "value": "b5bc81fcb5805bbe6d0fe5f6b3c17bf5a663d81b585e5cc8eb662a56f2e7a1133cad8e4f211c08f1fd638977fd0aa4ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900940, "uuid": "ca2bbd41-52e3-4dc1-9271-9bfabb8bf6a5", "value": "T1FAF3085BF8428E11F5D112F5FA8D42D83F1313EBD3FA78129D144BB42BD799A0E2A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900940, "uuid": "c23b2d43-5ee5-4d11-b754-c487210a6055", "value": "3072:Cf63PbywykrTjGHppFJRcHzaZHQyYnTN2y/GZrgnFdX7e8jeMhqM:EIbJroppFJRcTIlVZrUu8iMhqM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900940, "uuid": "f1036d9a-7a11-4d33-8115-1e5e6ca8e08f", "value": 161364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900940, "uuid": "1e2c8e7a-b025-4845-a414-0306a8192c12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900940, "uuid": "34238701-4a39-44eb-8f97-53e26564d1f0", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82be8ea-99a5-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786907273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907273, "uuid": "141e6052-c0cc-4222-9f60-017dc9037812", "comment": "Malware payload", "value": "359ad8aa694d3dc55553ab215237c188", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907273, "uuid": "efa66554-490a-48a0-a31b-6eda31764b68", "comment": "Malware payload", "value": "a81353c2839e2f8ec2c7127be7dcf516a6f18708cb1f2dd564caf7d4aee50fb4", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907273, "uuid": "5abf6a43-e4df-4448-a345-4bd82f8c7528", "comment": "Malware payload", "value": "879b3b03b68130ffeb3e0d90b9e0a2c2c2b60c68", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907273, "uuid": "f9ca8574-ec66-4a4b-96ab-b79b4a7a5384", "comment": "Malware payload", "value": "c8bd2b020d1c134fdba02f931a952b3dd71657902698132aae7d106876de9a959ff9a6fd272af3d8a96db43b6227edbb", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907273, "uuid": "2a660840-e897-49b2-a6ac-5db4c438409f", "value": "T1C1764903EC5919E9C1ADA63189B39253BB717C491B3223D72B90F2383E76BD4AD78354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907273, "uuid": "e4997a1e-42a7-4663-99e7-c8e3b772c0cc", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907273, "uuid": "0a0420b4-7f9a-4e59-bdcb-13ea07e0cb7f", "value": "49152:+fUUn8tWezw/a77G2dJwDms6UWyaMJhuTw+Njjv+M4QZ8mgA0rXIlI1yjzU9UM8X:+fP8wzyE0T+IGT9v0uvbEz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786907273, "uuid": "3987a017-a1fb-42bb-b5e1-d3813c1a0960", "value": 7407616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786907273, "uuid": "bd717a89-1dfb-47b9-a581-73d8996cdbac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907273, "uuid": "3b68487b-eed2-42ac-8f13-4e35b8e9f1c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352f2cf8-99cd-11f1-bd95-42010a9c0009", "comment": "Malware payload (Loki)", "timestamp": 1786924206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786924206, "uuid": "04f43db1-ae76-4ff9-8cd9-3367a285d29e", "comment": "Malware payload (Loki)", "value": "1e40620ada1a6be34e9e3899fa6e2d7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786924206, "uuid": "0b5b4461-b573-41b0-9ec8-30fb38252fa1", "comment": "Malware payload (Loki)", "value": "aabd2d5eed42d47bfb6a0170acf4bdf9a21be4c3121b262b86a826e0829b7bca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786924206, "uuid": "2d53a1d9-549a-4f13-befd-6222368653bf", "comment": "Malware payload (Loki)", "value": "17097cfba6c49b5db0b5deea0ae70d5b1cde3dee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786924206, "uuid": "070f73f6-70df-43f5-b309-f3f1d7999e7b", "comment": "Malware payload (Loki)", "value": "64950d8b43aa4e655bf1f4d2b4451bf16e3092d0beca54754800a5b5578806a1d50329346dbb61499bea49213ec430d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786924206, "uuid": "d8d95c11-f837-400e-8dd4-45c375596fa4", "value": "T114A31942B2A5C030F7B74DB2BB73A5B7857E7C332D22C84E9352459A14215E1EB7AB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786924206, "uuid": "21452648-7fb1-41aa-bad5-403f7e1ada94", "value": "0239fd611af3d0e9b0c46c5837c80e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786924206, "uuid": "898a9c18-b5e4-4891-9c74-4750ef2cb84e", "value": "1536:czvQSZpGS4/31A6mQgL2eYCGDwRcMkVQd8YhY0/EqfIzmd:nSHIG6mQwGmfOQd8YhY0/EqUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786924206, "uuid": "d0d43c80-7a05-482c-bdac-41d65af6c16c", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786924206, "uuid": "2ecfb0eb-3064-46e8-8785-7c58d82a1ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786924206, "uuid": "c81d327b-7546-4242-856e-0956bea5922c", "value": "1e40620ada1a6be34e9e3899fa6e2d7b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bed8d2b-99a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786907977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907977, "uuid": "cef7fff7-355b-493c-a903-e8f79f49bdc6", "comment": "Malware payload (Vidar)", "value": "784ebe5bb8dd81130425729c03f0b39a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907977, "uuid": "14801fc6-b5fd-41eb-be45-bb231ad1d4e7", "comment": "Malware payload (Vidar)", "value": "ab72ee6a19c7408857caa4d8f1d1aefb9f5013cc05a1826f1ea3ef9a4fce3ef8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907977, "uuid": "151b1dd7-f629-4020-aba5-2b2893d3ef32", "comment": "Malware payload (Vidar)", "value": "b0ed990ba4fecd5e04382430f734b7886e805c73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907977, "uuid": "bbecf288-a7f3-4812-a71b-c8ffb2b78953", "comment": "Malware payload (Vidar)", "value": "5042b9014acecc48a97b34f5355512fbe07007b12e54fad6c2453c8f9a9c1d268a13cd1453216a6e40c78f614d8f65f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907977, "uuid": "fd04155e-1474-4229-90c0-da1af4465fa3", "value": "T1CD268C03BCE259A6C09AA73185B35242BB38BC0A573373D72E61E6B62F737D14A35744", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907977, "uuid": "9e81bbe0-0294-417e-b06c-a6b58f5febac", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907977, "uuid": "1c72a7dc-064d-44a5-a09e-dabdd8cdb152", "value": "98304:pDTkymnSlnIinnnnnnnnnl/Kg5YDItv69UvvHNhp3nkRn8D/Ao:pnknnS+DYv69yHNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786907977, "uuid": "de466b0d-0c63-4ae2-ac6d-3bb4469c095d", "value": 4781504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786907977, "uuid": "118bc633-f84c-465a-8fa9-4e5c8560ca15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907977, "uuid": "1652ff36-519c-4191-9c85-59ecb8b50789", "value": "ab72ee6a19c7408857caa4d8f1d1aefb9f5013cc05a1826f1ea3ef9a4fce3ef8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31852540-997c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786889411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889411, "uuid": "c4117bd1-bcf8-4917-9d88-aff41efbd5dc", "comment": "Malware payload", "value": "9e16c8250a13c737b0a0cc95d5f09313", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889411, "uuid": "986c35c4-975b-4bc8-90e5-a275f1a16148", "comment": "Malware payload", "value": "abb109b77d1aaea2a6dcf74844d9c1a2e11859568e000ea51e9850f893e8c476", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889411, "uuid": "cb48b65c-cfc4-4787-a353-5c62060ceeb3", "comment": "Malware payload", "value": "33ec852d63c028060e50dfcc488ba646ffcf39c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889411, "uuid": "def9f31e-856d-43ba-affb-0ace513b2268", "comment": "Malware payload", "value": "b332e8133a1a942bba8f5c30df232ce17917f0c0780dd02e353abcf51570db7193fa7fc190152f57a5a3a3a49ff388f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889411, "uuid": "b2e87f31-0155-4456-9f3d-edb9ed5a2d37", "value": "T1C0B6330775A0368BB84E9D184148134D9FC5253265832F863E5F7B19E2DF3EFE4A26B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889411, "uuid": "13d0e05c-ebf1-4135-8bf3-23a922b48d92", "value": "196608:hntNtnLMsncWJF/UNUUYFtvvGhpYEfa6aqhm1anefeFzBJ6laPhOHHWM+m7yT/nT:dtHnL0q8NylvGjYj6XeK1JHPAH2ZyanT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786889411, "uuid": "dd50b909-ba89-4e16-86bc-0b912a5dbea8", "value": 11457401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786889411, "uuid": "01e959f5-5194-450f-ad26-311791bdaa71", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889411, "uuid": "bfdb5a52-2e2b-4806-a307-bb7fe0ffb635", "value": "abb109b77d1aaea2a6dcf74844d9c1a2e11859568e000ea51e9850f893e8c476.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e0ee0dc-99a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786907981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907981, "uuid": "294eace3-18dd-4ad7-8d5c-baa52ada7d13", "comment": "Malware payload (Vidar)", "value": "8077818431905d11b44d7f648cd24732", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907981, "uuid": "f3f44fa2-3269-4857-ba07-bfe154de51a6", "comment": "Malware payload (Vidar)", "value": "adc857a97f68ff07f50143708bec6faa917d55fce21e3294b7213b6a5d0507d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907981, "uuid": "3848b239-46f6-4a8b-8397-8f105ae0fcc7", "comment": "Malware payload (Vidar)", "value": "45019ba8959cbc8a4585d20d029c17efb2359633", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907981, "uuid": "2839ef8a-b751-404a-ad64-134ffb2b1f50", "comment": "Malware payload (Vidar)", "value": "1e352e753881b65cf0de0296449098ac15fe660ddacee0d6f02fd44cd7197efa1ec40e0c6e5aa6400243e2b1bf708a0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907981, "uuid": "81d673aa-95f3-4e36-b6ec-43521b7d77df", "value": "T17FF58D07BCD058F9C0A9973586B76292BB31BC480B3163D72EA0BA342F767E05D76B51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907981, "uuid": "9d2d6387-d08e-4ba5-bcf5-3647cd22a802", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907981, "uuid": "b10bfdd9-9d0d-409e-9f92-20053e404e59", "value": "49152:FQBLpzcjQRaS0UgVKHhp0fMdQ6b1HoaqddtN8ff2:FQAoBp0fMdQ6bdjqXtNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786907981, "uuid": "22b9ced7-4b1e-47e7-b2c5-8cfd46cafcb6", "value": 3338616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786907981, "uuid": "18d129b8-8ea8-4086-878c-c85bb215722b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907981, "uuid": "b7443204-d0d5-43e2-9376-31b40fdddcb4", "value": "adc857a97f68ff07f50143708bec6faa917d55fce21e3294b7213b6a5d0507d6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6d6790-997b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786889082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889082, "uuid": "f233e0d6-2983-44b0-a3a7-6838f705488f", "comment": "Malware payload (Mirai)", "value": "d32dfc62baac0041a4c983ba346b0b86", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889082, "uuid": "a502f35b-7644-4d61-a647-ffe91e1bfca4", "comment": "Malware payload (Mirai)", "value": "ade1b4543e39ae9b7f8766ac00797d1d0f9da56da3a8714e82623423ee3a31c0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889082, "uuid": "ee34ad8f-0faa-413b-9500-94ecdf9db7e3", "comment": "Malware payload (Mirai)", "value": "8c41e9b7f49fa25b57f346a328ffef17901207a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889082, "uuid": "2f94606f-5200-4589-892b-eb137a19f791", "comment": "Malware payload (Mirai)", "value": "e4a143542617dc616208ddb3e74c9c222ce700c7b17b4aed224e2a90200ddc1c48291b2f95c5812f36a2f8ed77c355da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889082, "uuid": "df69396f-7bce-428a-914b-89e19a7f0fa4", "value": "T14F6302290791E1EECF3F807E295F2BC23C185EA244415EDEA24DDF54BD22638A04769B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889082, "uuid": "c7ec0aa3-b28e-4938-b075-4cd1d7fe0af1", "value": "1536:NvFqSdSwmdAj7vj/W3qhKr6wJkT21MFmZ6UtNT7VJuv9:PDXmGjrIyK+wJ+cIs7VQv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786889082, "uuid": "d612f831-2fff-41ad-aa7a-a73eae18269d", "value": 72112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786889082, "uuid": "f06f1536-8889-40a3-95f6-b950ba894f0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889082, "uuid": "bad9ab74-b3c0-4f8a-bffd-4fb51e616067", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5e5b2e2-99a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786906061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906061, "uuid": "8e8b3745-6e4c-445e-8a0a-600149e99140", "comment": "Malware payload (Vidar)", "value": "6babc33b1ca2abba202e7f172cdfc343", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906061, "uuid": "16e5e6de-6e4d-4d21-86fc-f5166cb4a50c", "comment": "Malware payload (Vidar)", "value": "ae5d7efecc8cb8c91a77cccadf38757e589210a7732a8d1ec40fc4c3c4d2bc13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906061, "uuid": "7b9eb32c-570b-4861-a36f-b0e96a7ddb55", "comment": "Malware payload (Vidar)", "value": "aeb2368b8593ace88282c14033e0990850bd8ed1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906061, "uuid": "cb3dfc8f-bc81-49f1-aa15-e5ffbc658154", "comment": "Malware payload (Vidar)", "value": "51388d01108d7aff8b0b2f7b9bded93941b92c831b51d3ad890f01b034f103c65b732fd2c988b749927593da34d01c59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906061, "uuid": "fda708f3-0c1a-49eb-99d7-42068a406ddd", "value": "T1A9269D07BCA26965C09E97358D7212507728BC8B4B3A33E72DA0E6753F727C28E74B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906061, "uuid": "8a23527e-ac96-4eff-a45c-a5da980a7b21", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906061, "uuid": "6e3fd49b-3492-4727-addb-1e5c6f5a76b0", "value": "49152:P3VQbviFMdf+Pp6+3HFKlkCerdq9ARiBcnrasEbnVryC8mJotbKUAiwQh0RxD0z3:P3c76QEPIwrcN0hySyllANuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786906061, "uuid": "25f31729-ee04-41bf-b85e-1c43f5c896fe", "value": 4588728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786906061, "uuid": "bc151d85-3965-4d89-b51a-6de52340f716", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906061, "uuid": "a2e9d679-ebda-41bc-bfef-7b56c0c7b792", "value": "ae5d7efecc8cb8c91a77cccadf38757e589210a7732a8d1ec40fc4c3c4d2bc13.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece84433-9947-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786866962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786866962, "uuid": "50532244-319f-4392-9aab-f64ec006be15", "comment": "Malware payload", "value": "2e9174c8490b2a064306f989cd61cf94", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786866962, "uuid": "cbe0c224-ee16-4f0b-a1f8-4fa82fca7889", "comment": "Malware payload", "value": "aefaa46082749a5d322ccada8e12edec3c24e34777db26865d1f357749261e6c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786866962, "uuid": "a27522ba-2fc6-49f6-a3e5-e2fbd56d03fa", "comment": "Malware payload", "value": "1d2d1b9d2498e64b5f7d49ae06d0985d2df7ffb9", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786866962, "uuid": "e9b474ac-f577-4f94-95dd-d6c7e763ea7c", "comment": "Malware payload", "value": "2a50b01299b3954cd3850b25fa05ee5c806103013608dead7e812829cdc47b0feb0768a455ad1f279d29cfce8087dc06", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "errtraffic", "colour": "#4D7B7E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786866962, "uuid": "801ff692-28d7-4fbd-b97d-0c870e9d6761", "value": "T1B7E2724F5F099665ED3E267951BA8DC2F378B2644331C8EB2D80981E0D42BCAD735EC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786866962, "uuid": "719b6257-9e2a-4f15-94da-f2a12afc0648", "value": "39695b44850f54fd8f8c638668d5f311", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786866962, "uuid": "fa8cdf02-565d-4aaf-8729-65c4da30c073", "value": "768:iPL/F/k9fCyqUmnZzBeWUjuESb90sngUg/ijhAFgMQi:Qdk9fCr8HCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786866962, "uuid": "4a06bada-84fe-434b-be0b-1ec502ece1e3", "value": 32256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786866962, "uuid": "dc7876e8-d83c-4285-b041-7dbf06cdabeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786866962, "uuid": "5b6e458a-4446-473e-b1d2-008c3314401e", "value": "WindowsCodecs.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ae2a4d-997f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786890916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890916, "uuid": "354624ac-6e47-4ce6-a73e-597b02179048", "comment": "Malware payload", "value": "a5065df165978e7f48a2bc29cf7db920", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890916, "uuid": "3deb3366-b60c-43e5-a850-92f038da78e9", "comment": "Malware payload", "value": "afd47ef7378e573c8e575b2030355a2b65a888bdaf56c00a1e6f8e5dc980e7e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890916, "uuid": "8e9eb883-3023-4f10-b5b9-aadf72744d43", "comment": "Malware payload", "value": "6e76d91e55c69b3146f368c7fc5d4ae1083e570e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890916, "uuid": "ac19eeca-8d69-45c1-ac9c-cdbc682e583e", "comment": "Malware payload", "value": "dabb7070c0ff8d4cb2e89bd39aa6b24bafb2af3b5f152a7a7b91590e5e69312fa401828ea4884e35a3637d8f5978d63b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890916, "uuid": "149e0380-fe77-4253-9ea4-33913a68ebe5", "value": "T134D5239E7DF61A74C036C7B6DE93E82E7125339647718E6732CC6A004D225986C3737A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890916, "uuid": "09fda9f7-f2e7-461e-b611-717a43c6e0f4", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890916, "uuid": "90298203-691c-495f-9db3-97db925065f5", "value": "49152:NHsrc7i3whMp0wAHMuR/oXA6uorsYGZ47cfYbbjoewzE:97MSMp0HrmuL1Z47cfYbbUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786890916, "uuid": "d33c1a25-ffa3-4884-8988-7eecc1c446a4", "value": 2989056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786890916, "uuid": "ea948768-d5f3-4998-a0da-120cfc3abf8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890916, "uuid": "2c43b2a1-a684-4f76-8bba-c4e0a02ae576", "value": "afd47ef7378e573c8e575b2030355a2b65a888bdaf56c00a1e6f8e5dc980e7e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bb2ab7-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786870063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870063, "uuid": "ae4a441f-eeb2-45ed-a50e-88be4c28ee28", "comment": "Malware payload", "value": "97c733d803708f1bb5f0968cb1ef2e3e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870063, "uuid": "ff4a6c9c-883a-49c7-b99c-5b67d19f0f7e", "comment": "Malware payload", "value": "b095dae4040d3089625a846784f5c783b9d8d571a988f6f14239a8e719a729b0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870063, "uuid": "ff3b4530-95ee-4e04-ba53-88150dc249ab", "comment": "Malware payload", "value": "7fa2edded640dd00a5c60e2f7b471a1d6f27bd8d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870063, "uuid": "9cb07f80-8edb-4ae1-9749-345825861f7a", "comment": "Malware payload", "value": "052bb2ffb81480a547d2eb06051f95a270eb07db50603a4ef808cc389a01f3f23cd331f9db9e3cc8b91ace19356164de", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870063, "uuid": "5c7c172e-ef59-4f47-ba2b-9371b072218c", "value": "T138A67B03EC6515E9C1AEA23189B3A213BB717C495B3227D72B50B2346E77BE07DB9314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870063, "uuid": "82816ae8-9a61-4971-ad34-2b76fff950e5", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870063, "uuid": "648b85b5-7636-450f-b591-513cd8feb4c9", "value": "98304:0u2dj+g4tRQ4Al/nWeE+bwKv9CqdUazxkE7ZeIyT1O6iZCUXmDN:0bGQ4OQSwazdtk64rUbCUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870063, "uuid": "ca3bdf41-22fe-4b8e-9cad-ce5d86e5d1bf", "value": 9698304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870063, "uuid": "0c726b19-42e2-4232-9c14-3346f23832a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870063, "uuid": "df407e47-48ef-461d-a29b-c4daf82d60b1", "value": "crypter_server_linux.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bcf4886-995a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786874959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786874959, "uuid": "9430b03c-eaf8-4dac-8eec-182979bda490", "comment": "Malware payload", "value": "6f74daaff0008d3fe420423ee9b2a0b8", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786874959, "uuid": "d3f45f1f-03a8-47dd-8364-ba1920ffbdbf", "comment": "Malware payload", "value": "b0b06eaddb560628ad14e5aa059c3faccb9e55de0d1c19510dbf345537ac6b6b", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786874959, "uuid": "939a5b17-afb8-4582-93d6-494c87517a19", "comment": "Malware payload", "value": "cc990eba64381d0cf2a4f843c992d0dd767a0e21", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786874959, "uuid": "c0a8c32f-3986-4dcb-ad88-a9e6c5a71511", "comment": "Malware payload", "value": "76e7ad8de31b0028f5eafd0d2b39e3bfa62ee4573a6bbf5578f051c766ddbabde0b82a29c754d6180d099b1a9fc4cb24", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786874959, "uuid": "6a416baa-4cdd-4193-82b0-132594cf64e4", "value": "T17D062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786874959, "uuid": "733013f7-d0ff-401e-8e40-d103664aba9a", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786874959, "uuid": "ad6a0c2e-e1e4-47f7-88ca-bda5574ed234", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnGA:+MIKhlPGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786874959, "uuid": "84324ffd-d853-402b-a46a-7f789344b99b", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786874959, "uuid": "d3c096a0-cc9f-49fa-971d-1fc76bd1e0f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786874959, "uuid": "ea3de696-5f67-4ddd-9df9-ef67a15ef8b9", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87f4271e-99ac-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786910171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910171, "uuid": "85b2f74c-1578-4fa6-b45f-49f52b793dfc", "comment": "Malware payload (Mirai)", "value": "80fe8d88adbec40a85426f4139e4d080", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910171, "uuid": "23fc6fde-4994-4549-ac5a-540414c8e934", "comment": "Malware payload (Mirai)", "value": "b0c71961215911168cd968cec82b8409f057289de29d94be34e8ae5a1262864f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910171, "uuid": "a1f6e975-5bb9-43a7-a738-05f2704c675d", "comment": "Malware payload (Mirai)", "value": "61bfb13ad9c0bb425eb76ba74054f3c43cfa1b42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910171, "uuid": "56df7997-5727-4e0b-b6ef-0c13d2725af3", "comment": "Malware payload (Mirai)", "value": "de754dbc94b2a576d3ee991e15197f68ee9a0064c7585b34b00df971c6addc6415a5827863c1a3d87dd7b47118890d44", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910171, "uuid": "ba07c34d-d5bf-4f88-99bd-1584a6eb73e6", "value": "T1EA53F12CE8079FA4EAFFDDF16E18778F0C41F112849060957189767845C1A8D362FC9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910171, "uuid": "78fddae3-7ffe-46e6-9f99-224f924bf8e2", "value": "1536:wvQdGbMked+S1piCVcqGDoEO2tHczcEJXFcjS7nouy8DMK:wIBk2pGnRtHczHJ1/joutDMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910171, "uuid": "c5c6ae0b-8665-4412-be22-b0ba3c9a7472", "value": 62232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910171, "uuid": "0be99acd-635b-4db1-bdb6-43aeb71581fa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910171, "uuid": "550fece0-ebf8-491e-a50f-bea2c52debeb", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c09d55e-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901374, "uuid": "36fdee62-8c01-4bcb-b46f-842929c87359", "comment": "Malware payload (Mirai)", "value": "498de8547fc389650c33d3e3a328c47e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901374, "uuid": "07706499-9fc4-4f3c-a0ff-0b2770fe36a2", "comment": "Malware payload (Mirai)", "value": "b0e6ce2d90b7de7c784b13421ee68ca0c528dcb62b64a8e4c54aa4e2b03daa5e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901374, "uuid": "b1dfc624-fe93-404f-9abf-e2bd108c5760", "comment": "Malware payload (Mirai)", "value": "06eb54e50ff6d620c2b740e72ad00889145106f4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901374, "uuid": "9fa90626-3bce-4505-bc3e-e01ccf31a7a3", "comment": "Malware payload (Mirai)", "value": "17222c73ba5bc8d9b9c7cbea59e3b3f96704eb4c85684a174f57a87ad843317c265907a3372041279c6223fb1dc01c2c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901374, "uuid": "7ee4ba48-2ca4-4150-be76-09e31d8298c2", "value": "T193C3E649A9429F01D4C731FAFB9F425833536BBCE3F97101EA20AF6123CA59B0B76516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901374, "uuid": "6b676fc2-1fb0-4aa1-9e17-006b7a2422f2", "value": "3072:XfijTbU+1DALDopa2+laBIxKIjddOTcL4oD:XinX1DIspa2+laCpjPOTcL4oD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901374, "uuid": "55bff262-c556-426b-a505-f12283fd9500", "value": 120956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901374, "uuid": "21c456cf-0da1-4676-b0aa-4204f99f0bc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901374, "uuid": "a0d450f3-73d4-4956-8afb-4298f139aace", "value": "eclipse.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "355c4130-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "1fd51446-1092-410b-91a2-5c70d9103e84", "comment": "Malware payload (Mirai)", "value": "5e14892d465058fd1dbc69869582007d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "d8ac9078-8ec5-4341-bcb0-4154416852c4", "comment": "Malware payload (Mirai)", "value": "b1f1b197882e2b6547bd2bea358bf949a12724fb024bbe8899e912e066ce2e16", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "d352993c-4bea-47fc-9c00-a5df0e0d2e09", "comment": "Malware payload (Mirai)", "value": "74ade0175c24cb4e53da74e544a5d14fba8bf52b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "d9b70220-9296-4860-9c44-b322bf720c51", "comment": "Malware payload (Mirai)", "value": "0bbe9ded136097f1f403c76b8d5d1790c09f4b564e9075f7b67170d8dd6fdddefcbe43ed0f9182266f8545a36e19f19c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901443, "uuid": "7bfa7424-38ee-4d2d-b389-e823edca9d05", "value": "T17204B50E6E198F7CF79987345BB79E31925833872AE1C582E1ACD7105E6024F641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901443, "uuid": "e4b70f81-873a-40fa-866c-4d6ced9acc36", "value": "3072:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJBQX/uw9EfszRpSP/QBrj4jTv3TcJ2tD29:1OATXjpCgqDJHDexBJKfjPV4kuMu8hJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901443, "uuid": "5c1c1d14-d742-4c72-b4a2-bfdf7c97c210", "value": 175820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901443, "uuid": "3d2f7a4c-0341-4865-99ae-fe07b43fe7df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901443, "uuid": "24f67385-0011-4d55-99f8-80ff6f1525e8", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c9088c-9968-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786881150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786881150, "uuid": "51dbfa6e-df3a-4b73-8c1f-b9790c93f87f", "comment": "Malware payload (Efimer)", "value": "1b6521fd5653b30f77fd1a44a0d3b3ed", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786881150, "uuid": "4d0e6f8b-4604-48e4-b545-6e54ad697939", "comment": "Malware payload (Efimer)", "value": "b23fcd8667153dfcb3cf8361e80b0a0d119db93b4f4ce452572e55a247f8f223", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786881150, "uuid": "624f6995-98dc-4a8e-9eed-5f058f172b44", "comment": "Malware payload (Efimer)", "value": "1f751399827aefaca27afae720cb7bd17e44b9f8", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786881150, "uuid": "0295a619-2d25-4a8e-b7c4-0e40070590b1", "comment": "Malware payload (Efimer)", "value": "2aa9197922a36acc7497e5f2f1d84abf2d8f0dbc7e468a69dad37347ecfc0c52f7c40efd9b06da2839b670ff2526139a", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786881150, "uuid": "59f02018-d82b-4ca7-a788-3d2992229a00", "value": "T1AFE63388BAD011FEE9B3417DFEB20494E57AB43993B0C5D747A403A6AD632D04D35B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786881150, "uuid": "17bcdf18-11b6-4095-afbc-35c5e70c0cdb", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786881150, "uuid": "096823ed-2ae2-4a66-aeca-b04959f0a758", "value": "393216:aWL7IafhKAZQ0mgr20eQXMCHWUjrcuI3/PGTAI:aIbfhKYjhC0DXMb8IH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786881150, "uuid": "0ba08426-1382-46e8-a2c8-fbe0b7b11c80", "value": 14085872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786881150, "uuid": "5e2cf65a-7993-4d8c-a6f3-613fddb7b334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786881150, "uuid": "7c114471-1fb2-4d1a-9ad5-89e2c70c95c9", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b9fa11-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786901467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901467, "uuid": "8c921eb4-e94c-45c1-8e47-9871d02c5892", "comment": "Malware payload (Vidar)", "value": "0a1f96469e370a63c8e521c05dd97888", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901467, "uuid": "0191b3c5-9ae5-4ad0-96d4-8a4af1f25200", "comment": "Malware payload (Vidar)", "value": "b3625569bf2ed8a61c0bd3b256413f9f6396142fa93753d4488e5dbd3550b69d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901467, "uuid": "b47dd123-9394-471a-ba10-e679e4642c20", "comment": "Malware payload (Vidar)", "value": "7f480e57aac187e3878fc504fd0334b2126e3e53", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901467, "uuid": "c0e82344-fef8-425b-981b-b7387378c765", "comment": "Malware payload (Vidar)", "value": "4bc4f6529eb166074e0e5b56d38d3e08d3b324367b3c196447fc384ff14c0d563a19fed56b61161b0ade9c42dd8823d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901467, "uuid": "4ce79cd3-3fea-435a-8a35-453b2332532e", "value": "T137268C43AD91097AC499E236897782007738B84B4B7633E72E627E797EB77D04939F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901467, "uuid": "d7502b44-b851-40d0-bc7d-ecb2c7178992", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901467, "uuid": "f84b242b-bb1d-4484-8c48-a5375cecbe6b", "value": "98304:s35IweOIdCVzaqwEhkTMJDNVNMN/UiHDS3818AU2/BKiR3BBm656Y6gBjK6NV5a5:sJSHl0PxiqbCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901467, "uuid": "52e22334-da71-492f-9fa8-004e7a91da81", "value": 4756008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901467, "uuid": "32e3b6df-ae01-4fea-be33-86f78867487f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901467, "uuid": "4c2be33a-45d0-4233-84f2-04b41e334d23", "value": "b3625569bf2ed8a61c0bd3b256413f9f6396142fa93753d4488e5dbd3550b69d.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984aac6b-99ac-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786910199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910199, "uuid": "6e715c0b-c248-4bb1-abab-74e225d9b216", "comment": "Malware payload (Mirai)", "value": "a0fcf7a80f652da06211e4411b2d100a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910199, "uuid": "11632c7a-91ed-4ebc-9d3a-f1b1e65342b5", "comment": "Malware payload (Mirai)", "value": "b377da9b8cf1d5864205f4498a4d0fe1ff633674034fe007d9372d874e0e3f52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910199, "uuid": "be2ac988-894b-49f6-b506-b70cf2a55f70", "comment": "Malware payload (Mirai)", "value": "625a11de817b57a754ac6f29923ba40cacd0f3e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910199, "uuid": "71ac053d-ff44-4fb1-bf30-4338dafd387e", "comment": "Malware payload (Mirai)", "value": "5d8f87473669e08316ae87ff493f52ec1f6214a46a10004d97ed760d645f692e3f1b17b1604c919ab1b124ca71c6fea5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910199, "uuid": "980d41c6-47f8-4f7c-b39c-0609e0942280", "value": "T102E36B59FA5FC0F0E6D340F1062BEBAA963699216132F4F2FF563671F8B1301598626C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910199, "uuid": "aa79807e-99e7-4ce9-9dcf-352e6d1fad42", "value": "3072:yNElJFGQ9thjPfJ6k2zfPnaABFaWIr3XOd:yNETcQfhTUz3FXa5H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910199, "uuid": "19101634-afcd-43a3-9fde-5d2828f353fa", "value": 144796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910199, "uuid": "7104c3ec-7d91-4b49-a372-37f01f89ad12", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910199, "uuid": "751e49d9-16d8-4868-b15d-f826868d01c5", "value": "putita.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa16895-99b2-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786912726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786912726, "uuid": "9b21afd8-a1e4-477d-b527-638f38d7ffe6", "comment": "Malware payload", "value": "077124b02fa726423c86b0ab4960553a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786912726, "uuid": "6a5c7246-5f74-4797-a7c7-5b5a4a1b2c96", "comment": "Malware payload", "value": "b3a40a38e3168bb9c39aa51214d046d35f824bea354ec75295c36d7a26fbac2e", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786912726, "uuid": "44d71eeb-d8cf-42e2-89c7-30f37d811030", "comment": "Malware payload", "value": "6acab21a0d3214678c0623f0430e5e8d931fa369", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786912726, "uuid": "a6f133c9-e3f3-4692-8092-8b86b0a0e128", "comment": "Malware payload", "value": "7e3b932eb598a1621f6670b3a85336981006a156e5ca82e27448f9bec6bf6e543713070f7d46b7d4e588ee191bb84877", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX6.file", "colour": "#8A9FA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786912726, "uuid": "2c590eea-c199-44e8-8c88-99dc0679f242", "value": "T129763803EC5925E9C1AD923189B79252BB717C881B3223D71B90F6383E76BD4BDB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786912726, "uuid": "7154ca33-9fc0-44c9-be87-5394c0a442ae", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786912726, "uuid": "7955728d-58cc-4dc2-91eb-f6f90e9d8194", "value": "49152:QJr1V8RW1KsRCKA9wA8b2uTExwiMavwRI3l1+5GVcjcJw85b9AOSl1cyj9U9UM8K:QJZCQPfXEIGVpAS4xGawvpEzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786912726, "uuid": "d2e31e7f-18ef-4467-980e-f0e4d2007d2f", "value": 7407616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786912726, "uuid": "bf9865c3-e8c0-4f07-a2d2-b6e3c4ec8179", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786912726, "uuid": "ee70b0f1-0984-4532-9049-0b177cf492c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b60448d-99cd-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786924351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786924351, "uuid": "2d39fc6f-8f7a-4158-aaac-ddf6d0fcc29c", "comment": "Malware payload", "value": "851ad904d553d452c45d5879832c2e70", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786924351, "uuid": "12ad2227-8d9f-4b23-bc49-5b5ba81f74c7", "comment": "Malware payload", "value": "b3b2d61cca83df235b52368ecff6142594fbfa1ff96bcc0ce5c12d4b3e1a50c1", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786924351, "uuid": "335a7922-e5b3-47e9-901a-b52f1b70af73", "comment": "Malware payload", "value": "654350ffc1ecbc1c639226ff4d769b86765ac32b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786924351, "uuid": "02ae3796-f227-4824-ae7d-7cc8c70824d4", "comment": "Malware payload", "value": "d86a37ceee11885ffffa5e1ca6f1a05fed306e8e576663e17b18cd919aa8e192c66faea22069cd2d89d8ab01513533e4", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786924351, "uuid": "879abf71-4c8f-4dae-8506-bafa49ec36e8", "value": "T182E6339CE6D112E5E9B7913CDAD29155FABC78324734C9C79B984361AE672E00C3E323", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786924351, "uuid": "ae2be6c2-7105-427d-b6b6-6014bf8ae959", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786924351, "uuid": "110bfe89-a9cb-4ca0-ad8a-91b1a6447bb0", "value": "393216:KgXt2awHg/2RENpgDCrv0PFG0jtXMCHWUjdcuI3/PGTAI:KksaNsCL2E0ZXMb8qH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786924351, "uuid": "f9bf7f0e-87a9-4c93-af24-5b775fa84540", "value": 14103248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786924351, "uuid": "5d791931-e6bb-47c0-b070-e85c475800d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786924351, "uuid": "007b39bf-e25f-4eb9-aa48-bd3ba4db38a2", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f5a2101-99ae-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786910989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910989, "uuid": "d1d7b85c-26c5-4d87-a830-f77b9ecece77", "comment": "Malware payload", "value": "79b2de151b241deac5ad34320f8cf8d1", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910989, "uuid": "f681f2fd-7ae3-4ba0-8444-b44cd809fb8e", "comment": "Malware payload", "value": "b3e63e5ec603c73fc05bd560d26ba21e19e35cee3c0cc606519c734a6f25df03", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910989, "uuid": "ed6aa109-a825-45cf-9a86-0008ebc06f1f", "comment": "Malware payload", "value": "b5200ee060f713ef7be0593a716ad3c680c1c6d2", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910989, "uuid": "2ad8236c-ea97-4910-badd-73db2c142117", "comment": "Malware payload", "value": "4fa01f6a55f13ff7764c193ed81bc0548408d7d3aae5e1270cf27da20c00972df809242141c006559a83decc8b1dcd36", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910989, "uuid": "e028731c-26da-4d92-8889-73ad84069c8c", "value": "T18F062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910989, "uuid": "54b30f39-b6c1-4a84-b4aa-f873b15df37d", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910989, "uuid": "1da3d193-5e33-4937-a7e9-715b489c7436", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnGS:+MIKhlPGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910989, "uuid": "60bf82b2-0602-4b11-8b99-b5ef36e0c798", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910989, "uuid": "8d5d3324-a8ea-411a-9c35-0b1e257b0202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910989, "uuid": "4569e3b9-e21b-416b-ba4d-24f6039e6140", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c47cd6-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900773, "uuid": "f7943fee-90f4-4cf3-83aa-1ca7637e5d98", "comment": "Malware payload (Mirai)", "value": "8347ff4c118cb7416bce63d20278762a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900773, "uuid": "d6910286-5f42-40b4-be9f-ffd083a8adf0", "comment": "Malware payload (Mirai)", "value": "b3e8b3356fcef5ddcc8d17201929fb417a4a3a74bd242ab8bd19dfea2fc3e616", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900773, "uuid": "ae94b893-5bfa-4dd6-8a16-e56d4b2da12d", "comment": "Malware payload (Mirai)", "value": "767c4736ef3551345c7d893fb06ed79f21e337ac", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900773, "uuid": "21882c22-5115-4528-b18c-d3c79b5067a4", "comment": "Malware payload (Mirai)", "value": "5a1ff0befabf45508a3e270bb3041fefbe0a97da9f876de851236be275e5d3a0dbb954a456600f08896969332c4cf1e0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900773, "uuid": "42e46fbb-b7c8-4097-98a6-fc2bfb4f849d", "value": "T1ECF30946F8818B15D5D255BAFF0E128E37231B7CE2DE73029D246F307B8A86B0E7A515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900773, "uuid": "4fbe6291-8b0d-4cf6-b6a5-6dc740827140", "value": "3072:j4uBhyF/dbQwhlmKAvjJ7VMfe9auNTix6expoFtBm0sByJs8klw:YlQU6VSf2auNixVoDT6yJmlw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900773, "uuid": "47ce65ac-067f-4e25-974d-45b713b7b8d3", "value": 164284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900773, "uuid": "6022ff53-8bf7-4b93-ae56-45b3c979cf69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900773, "uuid": "bd237ffd-09f8-4331-b809-737ac34afc1e", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f657f3ac-9915-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786845503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845503, "uuid": "61be531c-e5f6-4a2c-aae4-b2e02e6d2e05", "comment": "Malware payload", "value": "16165d3d6ccfd3404b2fd36dbb4cfa81", "object_relation": "md5", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "titatitato-net", "colour": "#C33C57", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845503, "uuid": "ca7130ff-5d01-400f-9675-5aff3e48a97c", "comment": "Malware payload", "value": "b41017f98f93938550a6655981a500ca5a5a97ea9503e3de89948f8d3cab057b", "object_relation": "sha256", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "titatitato-net", "colour": "#C33C57", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845503, "uuid": "c7c55798-081c-4ab3-87f9-4df41a685162", "comment": "Malware payload", "value": "f032e1b825b176def5a5ee56a0fc5579b5d17896", "object_relation": "sha1", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "titatitato-net", "colour": "#C33C57", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845503, "uuid": "daf2b50e-ad5f-41e6-84ad-e8c0418d9969", "comment": "Malware payload", "value": "f132b21bbd97ffdd95182e646f85f3aae215005e6a7b355c933fd8eb032229b91cff9dc6e3d2a7817fafe8d76b225982", "object_relation": "sha3-384", "Tag": [ { "name": "BlakcSeeStealer", "colour": "#2FEDC6", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "titatitato-net", "colour": "#C33C57", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845503, "uuid": "cba75684-b793-44ea-85e3-990dd8c9bb65", "value": "T1B086BE55A3C45AE9D416DA38CB14E332C2B2BD624A76C08B499AF70A1F77E514F3FB10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845503, "uuid": "ee0d159c-ffde-4efd-b20a-0e3fd5576cb2", "value": "2d4dda0786e1ceafdd51569972dea026", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845503, "uuid": "10238584-69b2-4d33-a2fc-6498076dc8eb", "value": "196608:URobyBfr2lJOVqKXWcF5t2Q8X3ZYFTSRzOeYT9UMeN/I5us:URobyBfrLgU3KFnZE86eYTOMepx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786845503, "uuid": "bada49fb-4d1c-41aa-ae5f-e5a85fb1f218", "value": 7853056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786845503, "uuid": "17868340-d3ad-4113-adf8-5ad9ef1b8804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845503, "uuid": "d48999b3-68d3-47c0-a328-921d0159f9fc", "value": "atom.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b6aaa73-9910-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786843149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843149, "uuid": "08634429-9e78-4a22-9d61-28c281be92dc", "comment": "Malware payload", "value": "d08c47be7eaace5d8117519d20cd72db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843149, "uuid": "3d68ecb9-2551-4c2f-855e-9f9ac4bde888", "comment": "Malware payload", "value": "b4e869d592baf4370f850cbe71c7ae653ac1078646ef6633a4e769f6752b4d2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843149, "uuid": "ee95aa9e-c1a2-487c-a8c6-91cf6c765648", "comment": "Malware payload", "value": "032c74957fd1fdb9024733f8aece15278d30b498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843149, "uuid": "276c13d9-0f0c-4c1b-96c5-c630d6735b46", "comment": "Malware payload", "value": "950616beff90c618596a335ecb81e1051c67fae1a263eb67c61f268cfb8747fd547f8baaf87020d42be98a72c9dc197e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843149, "uuid": "b6298b5d-3308-43cf-b727-0b1d198fd440", "value": "T11CD57B07ACA148F6C0AAA33189B352517B70BC484B3627EB3E90B7382F767D05D79B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843149, "uuid": "2c5e80c5-7c34-4f0d-8d6d-677ab035c817", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843149, "uuid": "eefaaf29-67b0-4d83-ace2-0dd8e40064bd", "value": "49152:rxru8nXP9dr1O0URC1vfcsPLHhz7DNYHWmV:rx6E/dzzyHl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786843149, "uuid": "45128f29-8124-48ec-a19d-21d67fade9e4", "value": 2789232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786843149, "uuid": "42612a8e-d4bc-4ecd-aab6-7d1ec7f6c1b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843149, "uuid": "f97ece8e-18c2-4892-926f-ff7495e694ba", "value": "dollar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3513b351-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901013, "uuid": "6c80b98b-c66a-4c63-a06f-4665bfeb90c2", "comment": "Malware payload (Mirai)", "value": "df9d811b402ef4698e03e1c7dec1dd54", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901013, "uuid": "69f922e4-c4ff-436e-97fb-1c597ad1ebda", "comment": "Malware payload (Mirai)", "value": "b58767097829b7b07d35b5e25e49ab97eb203139fa56ce29283ac55a30893c68", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901013, "uuid": "d7f70b3d-ff67-42e7-8cd6-d790ea37b779", "comment": "Malware payload (Mirai)", "value": "43acfc759d251fc88de8d758c407ad6369b6b1f1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901013, "uuid": "0340e1f9-56fa-40a9-be66-79f9902cdb84", "comment": "Malware payload (Mirai)", "value": "2c9f85f100457ca753092055c643aa5209d96cbce2c66d6d14ccd18638eb0cce9f6905f4d3c4e1c61bc9ffd7c5355ccc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901013, "uuid": "7e2e318d-fcbd-4258-b683-a7be70edb3f0", "value": "T156739E23C8AA1998C25C42B8B070FF3A6773E45056536FF7059ACA7AA047EDCF8053B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901013, "uuid": "bf961641-c582-4e82-a943-97e2a5b95b26", "value": "1536:8/H/lVA7lzCicfaLKoJqU74Q/FwC9yEht8Li:8f9VU8icfauo55/FwdOSLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901013, "uuid": "0ce5e3d0-d4e6-4c3a-a0a4-1acfdffff61b", "value": 80368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901013, "uuid": "410d76b6-95fc-4792-ae54-ddca25fa25f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901013, "uuid": "4714b507-b9bc-4c82-b55d-60d8d6810817", "value": "nz.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7a1a5d-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901373, "uuid": "aee9abb6-243c-4085-a77d-f7dbfa7641b8", "comment": "Malware payload (Mirai)", "value": "95ee3bfe62b9c93b77e58d443e1c3a23", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901373, "uuid": "a8b553ac-522c-4b7c-935e-d38b21b0563a", "comment": "Malware payload (Mirai)", "value": "b89466bdce836e75804beb65996517aa8b4cf2dd1251eeede50a955380a6f5b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901373, "uuid": "8489c38c-a819-449c-b775-515663bcadaf", "comment": "Malware payload (Mirai)", "value": "63fe580ab0d6926033bf6b3936d5a3a6fddbf919", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901373, "uuid": "2ff4a65e-2136-4ecd-9d66-3ec5199f1ead", "comment": "Malware payload (Mirai)", "value": "b39c6de0760d5230d45ede8e10504c77c293224eebc8b7ddcf267ad9e0a63e3ba6ba9238416d5019e922c9e03c6df3aa", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901373, "uuid": "406e32fb-2bb9-4f3e-b213-c6ed0af80ab8", "value": "T18BC3D846FD418F13C5C321F7FBDE42987B166B6DD6FA3102A925BFA0374A4D60A3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901373, "uuid": "d45f90b2-bb8c-4f58-84c9-3a7d49c6fcb2", "value": "1536:/UcFH1Qzy1EAtse4VSiZTjoUrqDhEyp0wLcN+gl67wywvPJT3jTrKypQOxIrM16:McfQO1EQ45ZHoUrVUdL8J3l16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901373, "uuid": "143c7494-cfc5-4d7a-8ae3-b0ed79ba7def", "value": 122556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901373, "uuid": "36f9d4e0-847d-4ccf-b692-ee5b9cf3d035", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901373, "uuid": "f3c346f5-5c5d-453f-a425-3a06598a1696", "value": "eclipse.armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f29453e-9995-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786900090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900090, "uuid": "7d9b5dbe-5f4c-47bd-9894-738763f166c4", "comment": "Malware payload (Vidar)", "value": "d10671cb8cddf0e4410315137a260fdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900090, "uuid": "acc5bdc2-7560-4480-950b-1fb784b5d5e7", "comment": "Malware payload (Vidar)", "value": "b89863817ef1085e958e14eae1429441505e50d7c5840ce908d99a0e5fb74b11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900090, "uuid": "3162d0b3-1b14-404c-8b99-d09fd7ee356d", "comment": "Malware payload (Vidar)", "value": "1111a4f45c2f5c20c156f5fda55817cbe265e567", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900090, "uuid": "6739ea17-b974-4657-82fa-294d9db75ad0", "comment": "Malware payload (Vidar)", "value": "66aa1fdb9a4c20c767412d8fc9f2167607758924d3a970c7dfc430883afd6ac538af8fd3b4306883cff7794d4ba9468a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900090, "uuid": "79c3a701-80b6-41d5-a83e-9b7dba2ad40c", "value": "T17CF58C07BD9109E9C09E923198B351A67B78BC095F3223DB2F90B3782E767D06D36B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900090, "uuid": "7b545e91-c316-471b-86e7-598e020ac689", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900090, "uuid": "9c3f65ef-a97a-4d6a-8ea7-6e56fc341d6a", "value": "49152:q4QZNBEnNVQQVLZnB5nIln7taA1EWD/CHiGRK2oCX8J/:qlpeB52JaA1EW7RH2NX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900090, "uuid": "2f7cf74c-fe73-4a05-a82f-f6ef838cf5c2", "value": 3410304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900090, "uuid": "1aa0a15d-3744-47c7-8851-41462e659545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900090, "uuid": "dfd86a5b-ca87-48d6-88f3-f9d19be2a940", "value": "b89863817ef1085e958e14eae1429441505e50d7c5840ce908d99a0e5fb74b11.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bce623-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900774, "uuid": "319cf103-94c1-4543-8310-7165537bb098", "comment": "Malware payload (Mirai)", "value": "d9c0d448d36da7d932c244ceead43969", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900774, "uuid": "dcc11c4b-a606-4890-9388-da86b22554f4", "comment": "Malware payload (Mirai)", "value": "b8e0ac95d8af4581cb06441ec64a5690441d25f52a28fc70bfdd0d6f3a09bb0d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900774, "uuid": "781dd612-d5c2-402f-abea-11929f73a2dd", "comment": "Malware payload (Mirai)", "value": "bfd1f854ab5c403607ee2bc276fab826822bc378", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900774, "uuid": "4d082f9f-cc1f-4070-a507-2772f8fa32d8", "comment": "Malware payload (Mirai)", "value": "150f73a6eba0501187ba24069a0539e1cc01a3d9edc93a1f1a57754189d3fb1e731b86d4babc12fc535c8f97fc504e87", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900774, "uuid": "e5494983-bd81-434f-9e0d-c9833f538657", "value": "T13CF36C0AB1C084FEC49AD1744FAAE137E972F41D5134B1AF27E4AF221F4EE215B2DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900774, "uuid": "a9c61239-c986-4eb8-a1a7-edfe985e4e61", "value": "3072:5q6GwrU4vVgSX+XOYv+TyozpM03tauGJhddtcOZfQ60o:MarvtuiX9aeBxo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900774, "uuid": "2d7538d8-dc65-4a12-8e75-3faa667ab9e8", "value": 159816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900774, "uuid": "7bd3bc1e-3587-4728-8b9b-cd7099e442da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900774, "uuid": "aa5368f7-cd21-4c4c-a316-e963649b56c1", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cbbc93-9979-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786888215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888215, "uuid": "284d08e5-9abf-4a5e-a596-82dcb828538e", "comment": "Malware payload (ValleyRAT)", "value": "e025f4b1ce02afca0e3f6537e37b87a3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888215, "uuid": "23893da6-441c-43e8-827e-e41b51753ff6", "comment": "Malware payload (ValleyRAT)", "value": "b8e6f4c11e1b47c755889a6a647115aaaa6fcffa75cf3d47d116b2b54623035d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888215, "uuid": "22235def-b9b3-4561-aea5-845dd398b949", "comment": "Malware payload (ValleyRAT)", "value": "2c45ad05c8f4d6a6be00954966186ffd159ce504", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786888215, "uuid": "e6bacaef-00a9-4962-927c-f4e821a72c24", "comment": "Malware payload (ValleyRAT)", "value": "940dfe66894f3d1a654d905f23342271f3e863a348e0046cc0c10a19147dd096b793f10178ebf59c01a764bdfc03de6f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888215, "uuid": "921e8b14-b889-4cef-9453-ecc008020d16", "value": "T13CC38D01B492C071E9AE113D0C74EA658B7F7C74DFA09DEB37940E6E8E742D09E32A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888215, "uuid": "f753c6eb-4c98-4718-9b3f-ed1c3a8a7586", "value": "e10b0b843924caf8202bb955abadc259", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888215, "uuid": "cc148cd5-9530-4d5c-8576-156976b6a99e", "value": "3072:v2eDaNdyV1DuFA/SwEusz6e+GYi7MyQhxBBN1XwrSh8:gwueyxz6dnrFh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786888215, "uuid": "ac362d5f-7940-4439-9aee-40214c992afb", "value": 128512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786888215, "uuid": "8912521f-a749-41fe-a6b5-903d4ddb32b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786888215, "uuid": "a6a78c21-6880-426f-b48b-db9e73493f62", "value": "E025F4B1CE02AFCA0E3F6537E37B87A3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99124aef-99ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786910630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910630, "uuid": "56ff74d2-ef43-4185-82f3-a191a12d35bf", "comment": "Malware payload (Mirai)", "value": "43e58940b75469d39735becd2458f10f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910630, "uuid": "58fc33c2-695a-463c-a026-e20cfa638745", "comment": "Malware payload (Mirai)", "value": "b8f16d61b55a014b33c78efb68c229073cec7076fe02787867f28b73ca062be6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910630, "uuid": "1594fbda-deea-4e7a-b411-9731d1145596", "comment": "Malware payload (Mirai)", "value": "21c4cef710b1130dcfda738ef685487debf73555", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910630, "uuid": "917d6310-6a15-4bfc-a12e-0186021430a3", "comment": "Malware payload (Mirai)", "value": "36d380e36680ef53bcbae13a04b99e08ad2d266412d220c5bd331d1e385efc471a1e0d82601758351668f763afc90c0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910630, "uuid": "56b290da-be77-4e58-aa0f-8becdc8f3476", "value": "T142C32AA9F890DE52C6D52676FB4E428C33231778C3DA7105CE109E34F7EB95A0E3A952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910630, "uuid": "3b1ef61a-0131-4ff3-ab4b-9a0520268ef9", "value": "3072:bnsbGXagUQwUex6MTcYEEUji2sUOivLGaIyovL3NzFxNxgudf1Dl3:bc0E/TcYEEUji2szKLjtovjFDd95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910630, "uuid": "880eb3c2-6cd2-46d9-a475-affa0960f74b", "value": 124368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910630, "uuid": "9bb89da5-3432-4767-a562-be177c68609a", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910630, "uuid": "3c4224cf-01fa-4002-87d9-dbedd1f0d8c6", "value": "putita.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8694fc09-9925-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786852187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852187, "uuid": "18c59d29-fd35-40a6-bf11-5b547ffa9922", "comment": "Malware payload", "value": "463cb3b76ba5fbc1356c1282301d570b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852187, "uuid": "8f4eb438-5c9f-4607-a005-4cf30c375c7b", "comment": "Malware payload", "value": "b926d74878eda32e3998bfbc22457cfa8a9f67a7c14d0f8491c1b92226c58e4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852187, "uuid": "531fed1e-f277-4412-bfba-32e616eb4af0", "comment": "Malware payload", "value": "a78c11b350f63e561c08812470c43e70a52da691", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852187, "uuid": "1ad2f8ce-6168-47de-9439-5d1027bbc4a6", "comment": "Malware payload", "value": "3210e019638db1e220064c865bb21bf3de7f821bc80e274c4f9dba134f7d5aa823a43e9227fafb308a2066b5592aee12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852187, "uuid": "1986b8e9-2dd4-4dde-ba14-68344c92e758", "value": "T199D522967DF61AB1C4B7C3778E86F43DB2967F904A704E8232CCA9109C13A556C723B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852187, "uuid": "512882fb-efa3-44cf-b448-0b6a299a89dc", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852187, "uuid": "24910fab-ce70-4df1-a842-493da4906a1e", "value": "49152:XJjv+8snSA5tP9E1Bn2eb4nqC8mEXznzmQKv7/Z/+6TSI1AyQV+SobzttNfkcNrr:XE8sSGPiDTb4XzoznzQv7/Zm7d+7z+LD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786852187, "uuid": "4918f66e-761c-4302-97c3-719d4f14dce6", "value": 2996224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786852187, "uuid": "070afde9-5dff-451d-9b7c-9ce1b8fd1978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852187, "uuid": "d45d2be1-2676-40f2-9fcc-6e298e5ba8e2", "value": "b926d74878eda32e3998bfbc22457cfa8a9f67a7c14d0f8491c1b92226c58e4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ef061a-994c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786869009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786869009, "uuid": "4441d949-e5b1-4413-8afb-703b48e525b8", "comment": "Malware payload", "value": "3a37107f1089df1431d597aeaaf69ecb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786869009, "uuid": "f202874f-d920-4b49-a46a-4207301054bf", "comment": "Malware payload", "value": "bb18f7a08dda73f7133c39f36c9ad6efcbf774b32c0e6156fc9a2edd7537295e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786869009, "uuid": "1fc4fdf9-eb97-4ade-8c24-20f0b6436657", "comment": "Malware payload", "value": "ab10d97f4f462bd9266401f073e679c7f92b3783", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786869009, "uuid": "08328c25-450d-4b01-807f-654b9ac0a37d", "comment": "Malware payload", "value": "3b024a68e2869f7c74f50885246a6a2fa1afc020a6402940b0c3f826505e599bfd99188af9c629714cc750dedea2df99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786869009, "uuid": "5c64aebf-670b-4865-a772-d515554a2c3f", "value": "T162D5239A7DF22DB0C876C3B58F92F09D702937A48761CE973ACC2A118E639445E39375", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786869009, "uuid": "b9c6aa94-cf66-40be-a85e-ffe8fa8bbbe1", "value": "44140cbbe125df54636c585913f74c75", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786869009, "uuid": "036c6365-c348-442e-bd36-c786c6dcfd74", "value": "49152:s+nB4O+mEpZ7Uq1V/nM9sn62Mte5ptfvP1vv+2zn/JlU+jxL2:5nO/jHoqH/nfv5v+o/T5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786869009, "uuid": "6b453a60-64a0-4795-87d0-d4435bfd264c", "value": 2980352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786869009, "uuid": "2b2f215e-934a-4c75-b943-b3751b69bcd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786869009, "uuid": "7dc5f62d-eff9-46ac-98a2-ed7661469061", "value": "bb18f7a08dda73f7133c39f36c9ad6efcbf774b32c0e6156fc9a2edd7537295e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91eb52e2-9984-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786893008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893008, "uuid": "bb948912-db90-44e3-8b77-6f1c0f919d7b", "comment": "Malware payload", "value": "b33067259b86cab383d1989c349bf290", "object_relation": "md5", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893008, "uuid": "11433174-ab9d-4c19-b334-3a0c805b1337", "comment": "Malware payload", "value": "bb36568c1f0a4f4d604cc67f8692506291eb1ffd217a451ffc846c94daa09440", "object_relation": "sha256", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893008, "uuid": "23222a7e-df91-4fc1-8baa-97897e30fb7d", "comment": "Malware payload", "value": "64c43cf7e484cf04d65b9d37149dfc08630dbe96", "object_relation": "sha1", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893008, "uuid": "135226f9-e0ba-4c2a-8685-f883b88d9b43", "comment": "Malware payload", "value": "c18fecf2756f7e345cf26b763b4d8e6da0c97205006d93f3cd3cf5bcec2b25c89a1f6ddb082341c1d8e1753784f99d29", "object_relation": "sha3-384", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893008, "uuid": "75656c96-5ab1-49e3-bcff-7b228af89b0b", "value": "T1A05181C811E268717CF69C2772698814B8C4B582EDCA6E04E8DCF4F958CCF0AB515BB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893008, "uuid": "251f271b-dbd2-4a7d-a0fa-ee1b9becc931", "value": "48:2RKhEcfEnsTE1hxzTfTTzzsTZz1T/zHT/zKT8MzT3Ty6z0TRzwTrzlT7zcTv:2RKhEcfEnsTE1DXKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786893008, "uuid": "f7aa00ff-69dc-4002-b1d0-ac537e2509f8", "value": 3013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786893008, "uuid": "f4d1bdfb-7331-47f5-ad93-cd84bd56909c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893008, "uuid": "acaf346e-649c-44f2-a3f7-ba7b7b8a94c6", "value": "bb36568c1f0a4f4d604cc67f8692506291eb1ffd217a451ffc846c94daa09440.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8afc268-9949-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786867733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786867733, "uuid": "4b3a5416-1e43-4e94-94d4-c6dbf51c506a", "comment": "Malware payload", "value": "343f7b9959d7b95c4f8323dd429a653a", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786867733, "uuid": "dcf9304b-c77a-4a4d-b434-3ed04a859e8b", "comment": "Malware payload", "value": "bb6950d0a9551419c778150019b6bafe22b326cdf39defe2035ab33044ae487d", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786867733, "uuid": "9b6c0f34-63a8-4e92-a052-e3e51911db31", "comment": "Malware payload", "value": "40b6094f7196b40a59762cc3cc60ff5508d3d0bc", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786867733, "uuid": "acabd2e5-ea5c-46a8-9fd8-8bd6d3c5af7e", "comment": "Malware payload", "value": "ee76d7fa359b9e933738192144ec88e58664e11f9cd289819efc61a491aad56dc166249ef9a3bba671a44586bc74a0f9", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786867733, "uuid": "63621a65-5d0d-4d79-8e94-9a2966b47a41", "value": "T1D2062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786867733, "uuid": "2a37ae43-a028-4687-b879-8e13c745508a", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786867733, "uuid": "416ac63f-e69e-434a-bf8e-7f6e2ae28170", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnGm:+MIKhlPGm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786867733, "uuid": "a5ea4d5a-9db4-43f5-a025-824721ae0423", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786867733, "uuid": "3b06d928-a601-4ab1-8d7a-d3be441df546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786867733, "uuid": "4c7315f6-73f7-47a2-95c1-3f2f4fce7375", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c22ae68-9916-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786845754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845754, "uuid": "31e70e0a-858c-4ba3-aec0-2795f29b4fba", "comment": "Malware payload", "value": "5c3dac1fbb4cefa79533b28b0b24accd", "object_relation": "md5", "Tag": [ { "name": "45-115-27-4", "colour": "#A3A751", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "VorishkaStealer", "colour": "#AA7A08", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845754, "uuid": "4702a02d-c6b0-4a51-8d86-3f3c153e095c", "comment": "Malware payload", "value": "bcc547826973f84cf542f9073d79054a32b6d2eb99170e809461ed5da877fbe2", "object_relation": "sha256", "Tag": [ { "name": "45-115-27-4", "colour": "#A3A751", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "VorishkaStealer", "colour": "#AA7A08", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845754, "uuid": "acfa7d7c-431a-4051-8645-ee94702cc734", "comment": "Malware payload", "value": "3446e02ccabaa7729aa8c2c68a889740b70e27f3", "object_relation": "sha1", "Tag": [ { "name": "45-115-27-4", "colour": "#A3A751", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "VorishkaStealer", "colour": "#AA7A08", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845754, "uuid": "048bf10a-3a54-41e8-8101-15d3e4037ab1", "comment": "Malware payload", "value": "86f2ff19c182b44bc5b0379f8d9a87c318c51003ae9a24bb8edb99f73fb1945bc11b85710feab24a1e9e12f5663d1c2d", "object_relation": "sha3-384", "Tag": [ { "name": "45-115-27-4", "colour": "#A3A751", "exportable": true, "hide_tag": false }, { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SunWukong", "colour": "#B3DA64", "exportable": true, "hide_tag": false }, { "name": "VorishkaStealer", "colour": "#AA7A08", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845754, "uuid": "77978c5e-9b83-4766-9913-f301deaadc53", "value": "T146F7234157E50096D074BBF8D9A545A25A31BD421BFA5B8F22B4F90E2F722E3EC7130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845754, "uuid": "a930d1c9-6980-4438-8a22-5691c298e5d9", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845754, "uuid": "12be2054-124d-4eb8-847e-f565d7243507", "value": "49152:rMz0Md4S4UAv9M4k5582WqcCY9tOOESoYse8UNGnfaUhT/V:O0MWCAG4kj82Wds7SkmGhhT/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786845754, "uuid": "dbfc97fa-4cb7-4dd7-a32c-37a6fde68e74", "value": 74448896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786845754, "uuid": "1f2a3d42-39c3-476f-aea2-c13164152cb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845754, "uuid": "4bc2bb5c-8870-4a22-a637-87874e6648b5", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa9ac7ba-994b-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786868703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786868703, "uuid": "293af2da-93a9-432a-90dc-d1311a472fd0", "comment": "Malware payload (CoinMiner)", "value": "922bc38742b4bf19df78d60f8f1ce9ad", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786868703, "uuid": "89ab7e12-1c0c-4101-abe9-f63a362702d2", "comment": "Malware payload (CoinMiner)", "value": "bce4b5338870d28c27190d56df547dd25fe42c419a01173e24e1594bdfaa85a3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786868703, "uuid": "16046152-2e56-4e41-80a0-a0b9f685da2c", "comment": "Malware payload (CoinMiner)", "value": "d5f128208240d2d30405379767834753208ad258", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786868703, "uuid": "e616a741-696e-401b-b7e0-fdc1ab8faea3", "comment": "Malware payload (CoinMiner)", "value": "de3f387f47c6add4d85981077e622b7c0f4c476a1b511a30ff9cd2cf3275ac42d3cdbbdf33020f16a6a5dca368b71b73", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786868703, "uuid": "5d4b47f9-7f57-409f-9450-0579ca9d1ab0", "value": "T19D36332B3CC69074C07AC3B85693119DB23E77954AAABD0B36DE6F098D8AF05547E3C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786868703, "uuid": "24628d67-2119-4d5b-b583-367149ddc581", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786868703, "uuid": "85e2a150-22c7-4349-9882-e8f3417fd0e1", "value": "98304:BPy9hk0I+ZrVIGx7whs6NVcFZuhx4WAkMQ9jyKHGapy2HhypxSR1gc2B:BPy9hkVahjH6O6JAfQ9XHQ+yH+Ny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786868703, "uuid": "aabbcc9f-73dd-4dec-9d25-949509107e50", "value": 5256192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786868703, "uuid": "a2cd3182-d4ee-4c4d-a3ce-3f3f6c011248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786868703, "uuid": "8e58f5cf-8e53-49f4-af90-f7fe9d1e0152", "value": "bce4b5338870d28c27190d56df547dd25fe42c419a01173e24e1594bdfaa85a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39dfc4f0-99b0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786911758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911758, "uuid": "f1ae573e-b90c-4363-9fa1-3a1348dddfad", "comment": "Malware payload (Mirai)", "value": "b382cb8bc47900363445bbcf3fdb3996", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911758, "uuid": "4e146515-9850-44f1-8aa9-3a70b62c0142", "comment": "Malware payload (Mirai)", "value": "bd452a29195e8701a88e3fc511005ccba9d6c7bf285b0624c14fc5b6556374bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911758, "uuid": "6443d514-8cef-43be-aa06-5ecbb7af9c5e", "comment": "Malware payload (Mirai)", "value": "0a9696b89b9f4ea5671e3ca1250707f3a43dd2b1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911758, "uuid": "5be0faed-3438-457b-8869-7ce3d18d9590", "comment": "Malware payload (Mirai)", "value": "a0ac816b6e9780bb346b5e3a071e04a85998b01eb6d38297fe5cf5ece9bdb0c694803393230017e07c608402c3986172", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911758, "uuid": "b2f38d9c-57d3-4388-a934-324108acc6fe", "value": "T1B704084E7710CF61C72DC93109B38B4666F526512AE28849F32CDE08BE6534DA96FED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911758, "uuid": "ed842980-a8cd-40b7-85b8-f9724c18faee", "value": "3072:ZS0sGtQAywQcv8gFyBsNubBul8L45tmwRd2/KHJbjy1Ddjt:FJubYlPvJW8BjoFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911758, "uuid": "6ad3f8b8-409d-4418-9972-882e77931a4d", "value": 182088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911758, "uuid": "111920dc-c58c-4cc9-b379-1ad15d02e5fc", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911758, "uuid": "f6dc9eb8-e82f-485d-937b-ead89576a847", "value": "putita.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fcab586-99c0-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786918587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918587, "uuid": "842abfe1-e77c-4262-95a6-9e7d8a5b62d6", "comment": "Malware payload", "value": "f8fc684c76bb2794b30f2e3a7fa78d14", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918587, "uuid": "f693cdb0-175f-42af-a06f-9b4cbef54db7", "comment": "Malware payload", "value": "bdbda982e1274016554e1be0a5c35d094c08efd0107c87e347361fe580f0111e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918587, "uuid": "c3e9440e-4d3a-41da-8aac-194576d4252e", "comment": "Malware payload", "value": "185ff5b4c017e1a142ba06ff6e0e4c536ea66783", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918587, "uuid": "ba20325e-aec2-4a28-b696-c683084c8f4b", "comment": "Malware payload", "value": "13df98f1bd8d7f4d8bd13f82037946dbd0e609412031cd5984828f0d0bc57f153bec49d803a06dcf8a31dbd0a3476fcd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918587, "uuid": "9cbef931-155a-4f6e-85e5-1567548fd452", "value": "T1D111A38BE4538173184A483A6F7EB040F687507B8EF16C65340E7C605F59D13B4D2F12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918587, "uuid": "a341fdd3-9691-43ec-9e1e-351a7d347bdf", "value": "24:ooC3jpzAFF6HwFFaV/H0Mfsr7sqFBMNLyMgIAW3:ooC3jpzAXaV/H1fsr7s+yNOBIAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786918587, "uuid": "05e146b0-e442-4d83-9b08-c38a6abb1ffd", "value": 901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786918587, "uuid": "3eec7a41-5e4c-46d5-b6f9-bc9535177233", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918587, "uuid": "9930b3a6-0194-47b9-8802-c60887c9076a", "value": "bdbda982e1274016554e1be0a5c35d094c08efd0107c87e347361fe580f0111e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59cfe9b2-99ad-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786910524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910524, "uuid": "770f0c1f-bc4a-4f91-8921-fe914703f5dc", "comment": "Malware payload (Mirai)", "value": "1b881c10fa49fa39f007961f1a3cf32d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910524, "uuid": "492b1cfd-04aa-4f60-98a6-c61ab9062f9f", "comment": "Malware payload (Mirai)", "value": "bf51022b610a76ff9894a07f282a780373fdd5d4b78367d080eb4ae36302a28c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910524, "uuid": "b1a84105-7be2-4e6e-921d-502a09bd7013", "comment": "Malware payload (Mirai)", "value": "1ad0a599c0e4994fc6d3987f92d629b4678053b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910524, "uuid": "6f358cc3-b8dc-4eb0-9080-17c8bf157e5a", "comment": "Malware payload (Mirai)", "value": "d1c93f07efca649fb960fedd680cca4f5eaab86157138721db519877e66a7cd906cd8a80c388d869d5eb1cbf9823bb39", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910524, "uuid": "0c555152-262f-4bcb-885c-caa962131671", "value": "T192C33A0675A148FCC156C074C77F9927EA31785D13343ABE6B84BB31AE22E365F0AB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910524, "uuid": "9bb6cc19-0099-47f4-9103-d57d101bee9c", "value": "3072:sPVlR6dXl0IHXZWPGAaAZAx2nijPp/d6EtG4U7:sPVsH3APGx2niLpQEti7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910524, "uuid": "37b70529-433e-4be3-a8b3-367767c88079", "value": 124808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910524, "uuid": "d765ff7d-c647-49b6-9249-f5083d0de01f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910524, "uuid": "6dc8ae6f-fb1c-4173-b14d-07cf4c8dcee4", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed68a1d-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786900788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900788, "uuid": "7b820724-ca5c-49b2-b39b-0e89e62f6950", "comment": "Malware payload", "value": "d9543eacd67b6b4d1be50e499ed72fc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900788, "uuid": "5ef6b5a5-fe3b-4bbb-b26e-833a5518e170", "comment": "Malware payload", "value": "c03fd9986c9b7620ca9d77829e1280fb6696ba5a24bb9b860bc8613d74fc5723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900788, "uuid": "40f73fa9-2e91-42fe-aba0-4b2a83f79451", "comment": "Malware payload", "value": "f5fdc45c9eec3c4346b3b38f7cc8716d298164d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900788, "uuid": "69b9d6a2-cc4d-4493-95e2-3e24f5bca401", "comment": "Malware payload", "value": "1327d8f2567ccdfd3720474413f7c008efc98b6a1fc686b6da84998d4ad4554e2eb087a657c0b41ed51389cd716a2dfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900788, "uuid": "77196497-a672-4c49-ac30-ffda8c70bf80", "value": "T1292833E866585DCCE5C216B8264ACE76F9F0AC490FD8A75A87C9FD333F761432908B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900788, "uuid": "3026f95d-8d66-4787-b99a-185150c5e686", "value": "7e0a0e8f80bbd1a9c0078e57256f1c3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900788, "uuid": "f128d2b6-8bc9-4cf2-8e98-d3b86e744af2", "value": "3145728:JSwhwwYQu9rKiBV1MSbDmJGxEjsdfMA080ow7:JSOwwRM5xzbDmf4dkAw7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900788, "uuid": "23e277aa-8be9-4817-87a5-c625cdb9f7e3", "value": 101207515, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900788, "uuid": "f13b3e21-f433-4966-a82f-cc271d72a937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900788, "uuid": "5953d8fd-58eb-420f-af29-5ac61f17416d", "value": "Hello-GPT_1.4.26_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa8bc068-997e-11f1-bd95-42010a9c0009", "comment": "Malware payload (CoinMiner)", "timestamp": 1786890607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890607, "uuid": "51d04220-4943-4c32-a5ea-b0156cae2856", "comment": "Malware payload (CoinMiner)", "value": "4c80c1419eaac1af67432a9811353f0e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890607, "uuid": "b97dc9f4-ce21-4822-9c91-426efd3d185c", "comment": "Malware payload (CoinMiner)", "value": "c0522430955b7e888b58b5127d2a35ccdf5d427be8b236e732bedf89cd21b01b", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890607, "uuid": "75cf8316-4267-4fba-9fce-3b56850f3444", "comment": "Malware payload (CoinMiner)", "value": "b97db7e105a81a41ddf3dd2cdd101b23136a8e81", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890607, "uuid": "6a79d1f4-26ea-4c8f-b920-7d6fe99c1dd4", "comment": "Malware payload (CoinMiner)", "value": "2d7a5a731255c62cc8c8b21ae72ba56435ea46669a75476b1fbf1ec1a561228e767cf78e81a99dd8633a96a5c88bba37", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890607, "uuid": "02f47e17-62d3-4710-b3c2-6f7761dafaff", "value": "T1AE36338B69C650B4D486C7B58227909EF2393FD48A30BD1B3ECD2E0C4D576A41A7EBC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890607, "uuid": "15e27c54-a7e7-4502-8783-842eb368e345", "value": "35171f6f6a1bfee47cbc04cb345c411f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890607, "uuid": "1c5a1868-27ee-4a01-9f0b-f28731d33951", "value": "98304:I6hn4ZVUA7FiYEauMFUOA5hJ1vcSut6y/w4qxcBCMxYGQjQtVD1w906v:+libauMF09cSutHbqDZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786890607, "uuid": "875e9bbe-cf18-4bb3-9e4d-a4d9d1b20026", "value": 5222400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786890607, "uuid": "f9a1fc67-12a9-496e-83ba-26e242879ded", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890607, "uuid": "cd7370ea-5f43-4b3c-ad52-e0bb0e5b9a29", "value": "c0522430955b7e888b58b5127d2a35ccdf5d427be8b236e732bedf89cd21b01b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e79b9825-99bf-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786918492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918492, "uuid": "ad9bc05f-9a68-4306-9bc1-10c16c53baa0", "comment": "Malware payload", "value": "da18b3f823bae8ac76e44b524004773d", "object_relation": "md5", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918492, "uuid": "71e38afb-3e00-4654-a68c-23d9da0bd412", "comment": "Malware payload", "value": "c08f8a396bf9c1b5eb9f7fb1acba8a7451b42295dede49210f7866bb540934a3", "object_relation": "sha256", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918492, "uuid": "e3f33133-9c99-49a5-aa04-21b608e5560e", "comment": "Malware payload", "value": "2df11cf2f846f6603282127bce55c60467fdeb0e", "object_relation": "sha1", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786918492, "uuid": "bdb1e5bc-7f24-47ec-847a-51888fed707a", "comment": "Malware payload", "value": "722ac1cc5734a0e47cfd7f74e2eba0d75cb8c34a27b2a584a86f214048adf441adddf654786cee67b9675a92b61e3a1f", "object_relation": "sha3-384", "Tag": [ { "name": "ClearFake", "colour": "#6536C9", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918492, "uuid": "08a40030-e1aa-4da2-8123-ea11b8b010e4", "value": "T139062C3227668A7AF57156B1293C992E542978710774B8CBD2984C3DDCB8AC30F36F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918492, "uuid": "cdd0c7a4-f585-4290-88a4-b946fe53d315", "value": "545ab5f5e725852666113bb96037b688", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918492, "uuid": "1a3e05d7-36d4-4585-985e-743455c86288", "value": "49152:X8JY14H9AIK4soeI/K/0yyqBW9SwP1gPnGN:+MIKhlPGN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786918492, "uuid": "9a938894-c4b9-46eb-8a9b-8fcbb41c360a", "value": 4017152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786918492, "uuid": "7e8bb95b-18ef-42bf-a4af-6e2a64c7568c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786918492, "uuid": "cb9a9cb6-a714-422c-a8d7-46807f2aff4d", "value": "hutepkeazyauxbqsiykw.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f0f822c-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786915123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915123, "uuid": "c1aa1fd2-93b6-4c5f-a76a-d69fadd453c6", "comment": "Malware payload (Mirai)", "value": "6fcb646d0b8c26305591b4d1be1f2a6e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915123, "uuid": "94476f59-0bbb-4d3e-af0a-3d374060a7b7", "comment": "Malware payload (Mirai)", "value": "c1d0407eee3da384e83c5cf6025d7e1f8cdd275566f4e1d00ec579c60002a895", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915123, "uuid": "7b00b4b4-6b1f-482c-86fb-12c03bd4b9ca", "comment": "Malware payload (Mirai)", "value": "e4b9229f18152d6d94897aa40492aa695bbab180", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915123, "uuid": "fc592013-a475-4065-a8ce-3ab4cddcbd5f", "comment": "Malware payload (Mirai)", "value": "0dadac683eb75f321dce1949171e5ae4134f2d7380a93e176dbaa0f274bfcd1587ef634f711432dd4fbb37b622c6c474", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915123, "uuid": "9a3ecb8a-2178-453f-bec8-c933803e64b5", "value": "T178342856B8D29B11C6C2517EFF4E414E33136B69E2DEB102BD2C6B703FCA46A0A7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915123, "uuid": "fd8baa80-e1e5-4fd7-8072-43f0d3ae2fb9", "value": "6144:d+phSVYKiN+q/ogQtXIatGDLBPLTsy0dIZGFlssM7khWo2:d+phSVYKiN+q/5kXIaaBvsyi1lssM7ks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915123, "uuid": "103acdd0-0133-44ab-a376-c521c7b69079", "value": 242960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915123, "uuid": "d9129204-0954-4c5d-9179-ec08d3e8ce5b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915123, "uuid": "efc8c580-6022-41b6-a9b6-48b3c74f4e35", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf95631-99a7-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786907979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907979, "uuid": "3916b553-0c32-4633-8dcf-dac3ee7ad8d0", "comment": "Malware payload (Vidar)", "value": "a182e73d3bcea78539e2182f8fc3259a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907979, "uuid": "b426a2f4-f4a2-4343-9c87-56b6adfcf580", "comment": "Malware payload (Vidar)", "value": "c246350ce25814be7a8f27d9866508a885c5aa984b50af3c63445ef1adca692f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907979, "uuid": "2bca75eb-14ff-43ce-970c-afa7999a42bc", "comment": "Malware payload (Vidar)", "value": "c08ad19ccc9ccb61044b5f539f120bccfe868862", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907979, "uuid": "25181547-e9ce-44e5-898d-ab52e299aa76", "comment": "Malware payload (Vidar)", "value": "8df4f4f613eb2ac66c6656ffb04d1e85381f2061047e06571d8c04d24b7194d8d54c28ad193c67c7b989b1ad6e6d8446", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907979, "uuid": "b3b086ba-bd12-4a1a-b592-13fc260aef12", "value": "T1F8F58D077CE008E5C4AEA33189765696BB31BC094B3663DB2E50B6393F72BD09D75B90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907979, "uuid": "588b9efe-8a4f-454c-adbc-9cc0b21e5748", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907979, "uuid": "56474cff-e391-4c75-b616-b20b968fe366", "value": "49152:N4FJ3/YbecuA36L/e0TGvntkXN4Xtbg2LQxeaGsH641pEi46bH9o73:Nc0GinUqnUxeaGsHRC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786907979, "uuid": "1d3376ca-7817-424a-851d-8d748d1d24e6", "value": 3338240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786907979, "uuid": "634f9b0e-0ac9-437c-80a7-cbd7a6c4642f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907979, "uuid": "e25c1e8b-3b30-4bff-810d-509e31130844", "value": "c246350ce25814be7a8f27d9866508a885c5aa984b50af3c63445ef1adca692f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc7427f1-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900918, "uuid": "bd86eb70-b1c3-41ff-a002-0853021bb6a0", "comment": "Malware payload (Mirai)", "value": "dd86f80009783c7c3e317738fa415fed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900918, "uuid": "e13154ac-f8f3-431a-a9ff-3377fd8c43d3", "comment": "Malware payload (Mirai)", "value": "c28f928f430bea9b57febefdf3590aa1f3d6b5f8dc9111e0207e924092e74747", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900918, "uuid": "95e65138-0749-4eb9-894c-2c1e8527c94c", "comment": "Malware payload (Mirai)", "value": "b7183e06e712ae07a56e5621e6dd2c5987c300c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900918, "uuid": "5279f590-6293-42f2-a2e3-30a450d76726", "comment": "Malware payload (Mirai)", "value": "05823fd9697ed47f4510d9fbaec1365c7c6fad7e65a0ed23594397fb447e6bac194e32ef04c59914f65ae9af281f51bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900918, "uuid": "54b58d04-7fb5-49b5-a7c8-6484e0350a41", "value": "T17A83289ABD809B01D5D626B6FE0E114E33134B7CE3FA72038E145B2E278AD6B0B77515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900918, "uuid": "8fce1836-7b42-4972-a84f-a91640a46b0d", "value": "1536:RQnIVIq9zisH5BJOZ9MC1E4pmCPDRXaL4miuWG/3l7w1iQKIJiTkBfY8fj:YF+BJcKC1ZPDRXaL4miq2RKIJiTkBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900918, "uuid": "9649f85a-d542-492e-88b1-a37f39936117", "value": 87872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900918, "uuid": "125d0005-d670-48e8-9aa5-cd4c49719b91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900918, "uuid": "580b80b1-d74a-43f6-b207-fc91f2752c7e", "value": "miron.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f16dc5-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920213, "uuid": "8b129678-f3ec-43ed-868d-7f6ac38c43b2", "comment": "Malware payload (Mirai)", "value": "02b357c22c8af54a0adf9703c688c04e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920213, "uuid": "cd45ed6e-3dd0-445d-901e-4a6abe01b1ff", "comment": "Malware payload (Mirai)", "value": "c35dc6618d1666b0562f7c6c40d1e231ddf33efd6eeabc1a9a289a178fdc3b5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920213, "uuid": "de9fbbaa-c154-4f9a-9a7d-93b6a3cf2daa", "comment": "Malware payload (Mirai)", "value": "6a2c74f6b51a4170b4d5281d15386bd50231d7fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920213, "uuid": "faa87847-d039-4bdd-bf0b-f4978fcbde9c", "comment": "Malware payload (Mirai)", "value": "e75f432ca2029f85634e0694bc3896cc08c46d3b398ba6e545110b13ff275d91f27d359b84f5149074440a6965c6b596", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920213, "uuid": "e88531a8-265c-44b7-8f1b-c7ba9416cb3b", "value": "T1C0C30252FAC380F5F54340B610D7CBAFEA34EE294012CA96D309BF517992B5A785FAC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920213, "uuid": "bfeeded9-f760-41b2-b98b-b720398e1cca", "value": "3072:qa3z5a9yc6D4aNZZJ//YfNf3aUWAFhmeflvITOBMf3lT:qqm10ppJ/8aw/liO+dT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920213, "uuid": "6733aa1e-8b08-4834-836e-b317ebfb88c3", "value": 127073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920213, "uuid": "2181cbbe-04ed-4ce2-8f2c-cf9ea75a5efe", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920213, "uuid": "2bdb990a-6f41-43fc-b51f-753aafc9c0e6", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63ef05a-99aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909417, "uuid": "3f07fa23-7a67-45ca-b83c-a364b1cf1d35", "comment": "Malware payload (Mirai)", "value": "805351b76772591ff725257c319c9888", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909417, "uuid": "d2e93c18-2f3d-494b-91b4-d8d8261cb7d0", "comment": "Malware payload (Mirai)", "value": "c51525ebba4ecc2cee1656f351fd9bc9393d58275a910dfc738ac0c91e1d8644", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909417, "uuid": "8f84956d-ebc2-41cf-b1e4-83b24eb4dd95", "comment": "Malware payload (Mirai)", "value": "53aadbea9cf9f2af62637826c5bcf46b20a93a39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909417, "uuid": "cb4529ef-cd6e-40bd-80f5-1ec699bddc24", "comment": "Malware payload (Mirai)", "value": "89a2cc802090a859cbfc06f7f593ecdab7cd7f9bb37b62f2cc57aa99fcfad0d0672f151c82a54e72f244b215967b0649", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909417, "uuid": "f19a4836-3260-4c92-8660-52c335bb18f8", "value": "T1F5C33C99FC90DE12C6D52636F95E428C332357B8C3DA7106CE209F34B7E795A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909417, "uuid": "3c7bd0e2-81f7-4280-ae20-288a89d8d986", "value": "3072:UtvYQmF1wmes1dLoMiznLf3UQ4g8OlCVeFnsVFNVpJNs5Qf1Dlr:Utypd+Lf3UQ4g8OAVeFQVpJ0Q95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909417, "uuid": "be40072e-8edd-4064-81df-1a90671d2c8f", "value": 120276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909417, "uuid": "5edc1ccc-7a34-4e48-825a-ef999942135f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909417, "uuid": "8289b8b7-e2ea-476d-8cdd-9e90010f80de", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9e5d63-99ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909644, "uuid": "1b793694-22ce-4058-879c-1282341721d0", "comment": "Malware payload (Mirai)", "value": "90da445a83dd19ffaaff6ee4250f2960", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909644, "uuid": "8819fc8f-8260-429d-ba00-c585d8fef075", "comment": "Malware payload (Mirai)", "value": "c581115dadc5417494c41bdeb6fc65ebf33b62e21a6f6f101d03fd5f54882c97", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909644, "uuid": "79e33a84-39a3-4637-8176-a9ce78fb70eb", "comment": "Malware payload (Mirai)", "value": "a80fd7ba13192619c8613f11a7ae99b91fffce4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909644, "uuid": "3f24d1b0-0b52-4e40-89a2-21de8bd27327", "comment": "Malware payload (Mirai)", "value": "0bf202db085525ff03961625a5428e00abbc2078e9a0cbcb9fbacaea2dec57b5454c015f0b5296f280a5a89ba309bd2a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909644, "uuid": "edc395d4-c6ab-41cf-9883-ed7b6b2fd47b", "value": "T1CB5301A5317AC224D4359C327E6A8780EADF684E90871B070DF525DDFCB9E98B014BC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909644, "uuid": "8afaaa22-3d5a-46ac-ba0b-3fb757a1529a", "value": "1536:shfeEnwRBCdrXhjQstGKH9k65aTeGlsuNwi+nsCXVQpq58SE:shtwRBCdrGLKdk65a6GtNYzupq5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909644, "uuid": "8027c048-6cf1-4e0f-b6e9-59f896f923e8", "value": 60676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909644, "uuid": "209fc589-1fa2-4536-b8af-d6ade978c129", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909644, "uuid": "1699e9b9-c69e-4781-bdba-acd379148ada", "value": "putita.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06410d37-9941-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786863998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786863998, "uuid": "f7d85666-7865-430b-9045-c8760df2f589", "comment": "Malware payload", "value": "5c7135cd1c652084a59164d9fbb46f41", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786863998, "uuid": "6362c853-32ec-4d1d-97f3-c3d91ae32d40", "comment": "Malware payload", "value": "c5b1e5a9160ff3f5672d6a20bffdbb232ff60db400b18cb073adc38e76c35ed2", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786863998, "uuid": "bae91e8c-795b-4f11-bf47-3915da9b38f6", "comment": "Malware payload", "value": "0a3dae82c0da5010a50e60839b980e7a63d112b3", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786863998, "uuid": "f9e0e066-71fd-4555-b7e1-ae38907c31e1", "comment": "Malware payload", "value": "267ba7e42a92d86b3f4e4d892b9d7da5a3a19f270ad212673ddc45619e1a3a761c54f89bb65dd1279f9b33a9cfe706e2", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786863998, "uuid": "0c0a0c7a-99d9-48a9-bfa5-8cda0bea2c74", "value": "T1CAF5F13FB28B753EE06E1A3A7A76A610583B7A6165134C0696F4C84CCF250B11E3F797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786863998, "uuid": "d012f75c-66a4-4308-9458-6d575f06c4e0", "value": "88016fcdef7f227c62171d0afad9aae4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786863998, "uuid": "022543db-412b-4685-9d68-7c7474dd4c62", "value": "49152:5uIGhAjPTzLdx7Kctn4AIfsna9wJ9UJFVK/32EgqAmlVDyn1Pv:55eAjvj7Kctn4ASsa9wDE0TJ/Dyn1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786863998, "uuid": "a26b81a0-9347-4c18-960c-4cfd81a43b54", "value": 3500416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786863998, "uuid": "a8694f05-a006-4363-82bb-0caf989f4d25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786863998, "uuid": "371a6228-c19e-462a-93a7-d7b2a5328020", "value": "CrossDNS_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee7338f-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786870294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870294, "uuid": "88967d04-0c83-42f1-b9e7-ca1051bcb1d4", "comment": "Malware payload", "value": "9f17f098d77edf23ac2e6335eaaa3bbb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870294, "uuid": "54a3b918-15f1-48af-bc4b-14fc9d774059", "comment": "Malware payload", "value": "c5be8f760296c65eb64465594f7eea280a8c01b315cb816a905481baf5b40955", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870294, "uuid": "055e1df7-5d4a-4587-9772-a51941d0793d", "comment": "Malware payload", "value": "caa162bc345767fb53f08aa48d3936d039021846", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870294, "uuid": "03919101-bfc9-47ba-9aef-869c9b798e34", "comment": "Malware payload", "value": "fa3c4c63aca8c71d06904051fdbca83e13911984d7d4b1abc6301d8f0a1274dc3ba68f6660b278fd054f93fce3018065", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870294, "uuid": "55c47cff-4711-495a-b79c-769b58568111", "value": "T13CB2D60F776754EDC509E43881FB9635BA72BC0888B02A3E5324DF711E95B652D3DB44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870294, "uuid": "41f20467-0ec0-4cfe-9c7e-36eb199e2565", "value": "5bcfd99140b04a4b24c742176fff15d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870294, "uuid": "f0cc995c-dd93-4d0b-afae-b457d77b925c", "value": "384:SIeIGk9iiOgqwmnxZaQHHTrdRHBx4yENPNsDbnNVGVUh:SIYktSxZagh5jEAI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870294, "uuid": "dc389b23-35f5-4eb1-9ed4-674158f30c36", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870294, "uuid": "08e7934c-0aaa-4ad0-9f24-b8ae18a7bb81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870294, "uuid": "1d343fed-f5c7-48f5-856c-bf5eb1c8295c", "value": "18cb7333cef1df5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2f36cf-9911-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786843657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843657, "uuid": "5c29d635-e7a0-4cb0-b4c0-b86902e40392", "comment": "Malware payload", "value": "66de63904fcd5d1fc61985563c17b0a8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lenaogfkalgklagl-com", "colour": "#F46D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843657, "uuid": "7d663fec-2bd4-4a3e-a149-df0af2094e55", "comment": "Malware payload", "value": "c6838b96ea38a6ad9b3be9fcb630db0fb6eb14ec206998f49f1d3767aa8923db", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lenaogfkalgklagl-com", "colour": "#F46D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843657, "uuid": "7413ffec-f296-4d8f-8bf2-4a2c7e494d74", "comment": "Malware payload", "value": "98f0386953528dac42e3e13cd10f6e9699ac6b17", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lenaogfkalgklagl-com", "colour": "#F46D37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843657, "uuid": "0e55d70a-43a3-46d4-8662-9d14e893e2e0", "comment": "Malware payload", "value": "14139c6cb20ca25a2bfa05209935e9100564a396e5c5c544146028f8b2c0eda5ee27b17449c786ad8eaef8f04db62b74", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lenaogfkalgklagl-com", "colour": "#F46D37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843657, "uuid": "850c9cf6-2563-4d42-9375-6e4432c8e453", "value": "T19F7501D2DE9205F8D193593C416E2B5FE33834064B19A8BFB2DE01613F265AD45BCB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843657, "uuid": "86384276-e0b7-40b8-8ca8-dfe54dcf7fe7", "value": "de85a398477c39117ee5fd3f2278b959", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843657, "uuid": "3c6374f9-85a5-4fcb-9a4e-b956c5c78756", "value": "49152:HlOitYd6466/8R02gfti0HqxLw/5lNtD:9M9FJH1/NtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786843657, "uuid": "3c26d621-c7bb-4ec9-ba87-00593e7d7851", "value": 1666560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786843657, "uuid": "fc0dea8c-1b82-4fb8-92f7-8fededb898e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843657, "uuid": "0a914a68-a91d-4922-848c-3f8129311776", "value": "JupayoManager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d179d10-9995-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786900087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900087, "uuid": "a2f044fd-01d6-4f8b-936f-5a28a7c4066d", "comment": "Malware payload (Vidar)", "value": "3c627b68168c2a22bc5466a63a80a3db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900087, "uuid": "66c18d7c-c5f9-4638-9ebc-0c01e9d38099", "comment": "Malware payload (Vidar)", "value": "c709fe4d80c49a8905f35bb33e12f7b3fe891347884a4d00099a46a5fc5b9e53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900087, "uuid": "c2a6acd4-2920-4ee4-81a9-6ad144ec5307", "comment": "Malware payload (Vidar)", "value": "33f9288f748bd6a3ab071a8fe6035ee98a9510cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900087, "uuid": "c7f6e8fd-748f-43f0-90ef-629ac2a8f6ff", "comment": "Malware payload (Vidar)", "value": "3d68ed193324608c572519f0fd21df01b479ef5c503c2c766c1d3915746f3e2e9daa0a434266f84ac64fb2158c8818e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900087, "uuid": "1ea8091a-d7e0-409a-a8ef-48351123231f", "value": "T15D069C03ACA148F6C09AA332C9B796957B74BC491B3623DB2E507B782F767D05D39B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900087, "uuid": "1a22324d-70c4-4ae7-a7bf-2419722ba2d7", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900087, "uuid": "c61e7a75-44a9-40e5-877b-2ec624f9c3ed", "value": "49152:8E4JtWxbMQ4h2MkRjTs28nG9K+r4LafvrkuJHYuTxa:8r12428ncvYuWuda", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900087, "uuid": "e3cefd56-70c0-4ad7-ac8d-b0f01e21592e", "value": 3787592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900087, "uuid": "62cd7e3c-9aea-4b41-9b7f-9d42dba25a89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900087, "uuid": "a521c777-bee6-4fbe-94bb-44d8d3574b23", "value": "c709fe4d80c49a8905f35bb33e12f7b3fe891347884a4d00099a46a5fc5b9e53.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5185107-9915-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786845366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845366, "uuid": "8fc9503d-f88d-4789-beec-7dcb64650134", "comment": "Malware payload", "value": "8368a56d82bcb70487ee1bedf1d6bd35", "object_relation": "md5", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845366, "uuid": "d5715eee-5505-433f-92dc-f470576116f5", "comment": "Malware payload", "value": "c7d9c7f67b761688cfb67083b7e01381db90cb67adb06c8618889dfdff2396e8", "object_relation": "sha256", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845366, "uuid": "8db8898f-97ad-43da-96c7-089976a9f7ee", "comment": "Malware payload", "value": "5ddf025fa119109f74ecb3495427e378637ed860", "object_relation": "sha1", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845366, "uuid": "7d29fa04-866f-4e8e-bd1d-aeaedd05268f", "comment": "Malware payload", "value": "8d30e582abed226339d3d693b870d66d6dfdabdad189ca4268fedc93f740d323e09410b9a47645b58bc51ba7d5b5c864", "object_relation": "sha3-384", "Tag": [ { "name": "CNBackdoor", "colour": "#4F51EB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845366, "uuid": "8dab7257-b438-469c-a4d8-8630dbec8f99", "value": "T108E633E63D13F1A2DCE9C5F13239EB4B89830191CA0B707DBA593F6B6635D01076962B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845366, "uuid": "5446a599-b615-4094-baef-b10aa4da8482", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845366, "uuid": "0d7ee82e-f511-4280-be04-60b61bd6626f", "value": "393216:JbDgNJjnIMn55jNbA0VzhMc3xpRkYql23AJ0Zvc:afPtbhVNMc3xpRkYqKxNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786845366, "uuid": "c130a1b3-dfe4-44c1-a54d-78ffa74ca02f", "value": 15003136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786845366, "uuid": "582f55a0-c85e-45ec-951a-bcadc1151ff0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845366, "uuid": "fca1664e-2686-4836-a8d1-73f82028e7be", "value": "InstallerV14035x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67942d3f-998f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786897662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786897662, "uuid": "86281916-8063-412c-b6bd-612b0f33ecb1", "comment": "Malware payload", "value": "a0fdba86b8ec2a758859e289cee62fee", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786897662, "uuid": "4e3a24ab-9dcb-4080-88ec-e009d1c1f6d8", "comment": "Malware payload", "value": "c7e1769322ecccf378b41dd9d5fb616150953d0f9f08cd48a87a78044c467a9a", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786897662, "uuid": "e55fce4d-d062-4246-b995-eca37249119b", "comment": "Malware payload", "value": "1b1bfbd4ce252318dc61b454130bf050875f2ff6", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786897662, "uuid": "285f39f1-cf13-440f-8e69-0d9c27ddb162", "comment": "Malware payload", "value": "157e32f09efd50e17660f63ff4569fd0a9d850989c4efcc390be5b379f997d23323c2be8935e68849d1e705c8205314f", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786897662, "uuid": "1aa158a0-75a6-49a9-aacd-b040e6c66ab7", "value": "T141D69D05B6E581E8D476C07C8E97D803E672B8960F34A7EB3191572E6F376E08E3B650", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786897662, "uuid": "877f6f57-4013-433d-bb48-bad6df22f3fc", "value": "7cabc441789f036fe6fbaad2b488a57d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786897662, "uuid": "32c132a7-eae3-4f08-a75a-4b893878b4ce", "value": "196608:RgTpepG45d9FwMvzOwpZac3hQqw885or:aPwd9FwMvzOwpZHDz8E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786897662, "uuid": "57b159bb-c171-4e1c-a514-a42dc701620a", "value": 12707840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786897662, "uuid": "22ec4dab-f0a2-49a2-9348-782e1843d29c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786897662, "uuid": "c1fdbd5d-b986-44ff-a641-731d00b2a585", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a066c4d-99ae-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786911034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911034, "uuid": "73c49196-d0cd-463b-8db4-4ab7f5ffab0e", "comment": "Malware payload", "value": "9806ce0c7217a7d83388cd1a545ac42d", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911034, "uuid": "c04038f6-2eee-4e57-a7d4-624885988a42", "comment": "Malware payload", "value": "c8db4cf01aee956de7c133d15474c91f4fe8b57c129d621bcd946c3d8af4a445", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911034, "uuid": "777f588d-8510-4951-a93b-00bb59423c45", "comment": "Malware payload", "value": "0e6671dc33ca3f5072c54edbb0abf73780d46882", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911034, "uuid": "e45df00d-8402-42cf-a05a-915abd337783", "comment": "Malware payload", "value": "1090a88d0fb0b910b8ef47c06256c2536a3498cc02c4b721ff48293342faab9dd5e5c815cb4422d029887425437abc49", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911034, "uuid": "96a160c2-24fa-4b9e-b847-4289a4f1bb91", "value": "T143236C551A857C149A99C4371D7F2F0CB9AD43E6320452EE7FCB3CF28C8AA9D920971D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911034, "uuid": "93759483-c0bf-46aa-b3d1-01eb28b4ff05", "value": "768:fVEJVIhtM19GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:9EJ2Mmcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911034, "uuid": "87791032-badf-4aa2-a0b0-2a56104bf4a2", "value": 50071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911034, "uuid": "ad6fb237-26cb-4624-87fe-cd9044aaebad", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911034, "uuid": "a188f869-70ef-43db-872b-e421e3cfeb7a", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "115714dc-9936-11f1-bd95-42010a9c0009", "comment": "Malware payload (Prometei)", "timestamp": 1786859292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859292, "uuid": "a68c89ec-fca9-4f0a-bcb6-52e4be73ac64", "comment": "Malware payload (Prometei)", "value": "386930bc20335e144bd9b506465d2346", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859292, "uuid": "c00a733b-0317-461b-b438-1377b424d712", "comment": "Malware payload (Prometei)", "value": "c92ee0be79d2d1bf7257cb4ecea7a5d64533e128babde7e453e48281090a8f42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859292, "uuid": "488dd278-1cc7-46cb-8482-1c9fd919e589", "comment": "Malware payload (Prometei)", "value": "7adb67ac95a83ea28b6701ea011fbc93fbf57a50", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859292, "uuid": "ff2f2353-bdba-44ec-a1e3-b7d740b198e9", "comment": "Malware payload (Prometei)", "value": "45b850929615d8573703233589d9459feec24ab0ce772d7a7e9875940c31c923523072fd73986a49216ca3596d3c2d79", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Prometei", "colour": "#9B2708", "exportable": true, "hide_tag": false }, { "name": "wraith", "colour": "#BBC3B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859292, "uuid": "7aa3b839-1ee2-4242-bbde-9b4fe252c4fb", "value": "T107A423B4F9129E9F6DD769B91B24831DE181C172589D4C2313AE94A34F3D632BF2C816", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859292, "uuid": "dba7f35b-84f2-4aef-abea-12d7d81e53ef", "value": "12288:Fs+/py5fM2l+M5F7TsJwtY1yvr+bT1psS+6T6NCj76tsdF:Fs6pyCC/Ya2hpi6T6N4L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786859292, "uuid": "f0d4fee0-a3cb-43bb-8ef7-117cf9e37fc9", "value": 449083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786859292, "uuid": "3151a320-7620-48dd-9e62-6ce360ab3559", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859292, "uuid": "4fe89f35-1705-4f75-baa6-0db8253e39d9", "value": "c92ee0be79d2d1bf7257cb4ecea7a5d64533e128babde7e453e48281090a8f42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed525500-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920220, "uuid": "0a6ab4bd-d5a8-4f70-8b58-449e8e9df30f", "comment": "Malware payload (Mirai)", "value": "a0dd26015a23dd2cb6f3e692be7c863d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920220, "uuid": "a8d5b73f-994b-43d1-afec-c1e70a003c47", "comment": "Malware payload (Mirai)", "value": "c9aedcb8f48886d9aee54d164136220d5d184c65ece58514de6f0fbce071a5b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920220, "uuid": "500b6a02-3266-43cc-b4ff-3b66b825357d", "comment": "Malware payload (Mirai)", "value": "a58b7ca783b0918b5577b7be8b503ac7ec133cf3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920220, "uuid": "7b36cf29-a359-4eeb-99e1-d4648991cd61", "comment": "Malware payload (Mirai)", "value": "60d82935a17aa479f15f6e63f0ad5d8a2e6939c78a26fe916dc50c033c0e7b33dd2c626a77ed51b390ad8ad3875e04c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920220, "uuid": "111376d1-172b-4808-af1f-9a516f464e4f", "value": "T197C30280D9A1D5F1F843457100AEDBDA9F72EF390045DA3BE7097B283DA67A2850F768", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920220, "uuid": "a48c1624-1fd5-416a-9dce-196351d12503", "value": "3072:rOlNTZa+Ef6jO6gqBsiaXmf7gCPEml/Vw8kuiB8b6P:aPGfczgqgXIsCMml/VNHiKb6P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920220, "uuid": "e3e4668b-11d5-4c71-a6f2-7350fbc9b22e", "value": 126940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920220, "uuid": "e4cf7816-1ed0-4ffc-8c14-c41ac964c691", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920220, "uuid": "d003e925-68dd-42e6-a987-577a7721d566", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c62c61-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901007, "uuid": "f4402b81-c4b2-4f0d-81fe-2ff7916ade93", "comment": "Malware payload (Mirai)", "value": "a06edb68d5a217988ed36e4792f7b056", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901007, "uuid": "205ace6b-9fb1-43f7-b8bb-f034515339da", "comment": "Malware payload (Mirai)", "value": "ca50f51d036e9fc256d99272f792dde00c7b5d67bed4012ee0ccb9d92dd60004", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901007, "uuid": "4b86086a-5769-4de1-8090-10142fd4deee", "comment": "Malware payload (Mirai)", "value": "d9673802f058c223348fff0d04e14a21d1e86814", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901007, "uuid": "1dd942e1-56ba-4124-9140-af44be60989a", "comment": "Malware payload (Mirai)", "value": "536447735bcb3ff12737200929b03e3bf0a1b14e89182087391ed1c98cfe55709486cf031b3c9647482e3ef87bd6519c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901007, "uuid": "a6df87f5-0bee-4d97-a570-91a230c0232b", "value": "T11613F121E13A0635C7F55CFED9A8C64BAD0A6970D55A3532E3120B3038E731F8AB5AC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901007, "uuid": "b691e610-4248-4412-a03b-e2f2155c1d80", "value": "768:5rAQZt4VZbSAUZCc5SAjPt5bOYt65yRGuASJ9t1mtXX0j0fzUCeZs3Uozd:4bEMSSwPt5Q5yRTJ9t1UX0j0Bekzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901007, "uuid": "f0ad0a4d-af2b-4f41-98ed-9397fe890684", "value": 41644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901007, "uuid": "6bfd908d-e2c6-476b-b973-89315a87bf46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901007, "uuid": "1e282ae8-6716-4f6b-905b-66a50716cca8", "value": "nz.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35398f5f-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "2a946e20-212b-4acb-8512-2880387b442a", "comment": "Malware payload (Mirai)", "value": "cbf8e8940b197f470b4ce66a9d7d930b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "39a9b258-704a-4d0d-aec7-13df4a0e80d6", "comment": "Malware payload (Mirai)", "value": "cacb6c487a48887fd5567e4dc61dd799ab03edcc153608e7b8c0df9eb01c6cff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "55c1d1ca-c841-43ee-8b0d-6cf8ed979fc0", "comment": "Malware payload (Mirai)", "value": "f9a9f81ba9c5129dfaf77ffa9739e644f0b6279d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "faf73cf8-3f52-4332-820c-e7556949cb54", "comment": "Malware payload (Mirai)", "value": "b2c50c0663d07add6054af83eec9c4dfcc9a32e599134b22b694a5221e2a360091ba04c660f4420866fc8a8695a333fe", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901443, "uuid": "747846e5-312d-456f-b7ed-7f2e0703d7b6", "value": "T12A041A05BF150EFBD89BCC3B45F9270529CC581A22EA6B36B934C858B54B25F1AE3D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901443, "uuid": "5666be61-28cc-4220-a2f7-1b070cd11b08", "value": "3072:J60NEpL/RdBtJN9xFZ9hkOmG5RdelJgtTwn2APPMOEzvQ6WJ9G2/7ZiYlTBVmJT2:J3CTRdrD5GFnrPUtsNzZt0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901443, "uuid": "48f64c35-5310-4dae-914b-b3bbf410c110", "value": 179916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901443, "uuid": "89aa0eb5-1e0f-492f-90f2-19993344b174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901443, "uuid": "385b9361-fb8f-44d9-aa3f-a9822d49090b", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94b566a6-9910-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786843191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843191, "uuid": "9a4f45c7-0b00-474c-887a-010b4e50ae1d", "comment": "Malware payload", "value": "e496c36f3f7b9fb577fd06a1f62b105c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843191, "uuid": "1080f538-dfd7-45c4-9a2a-aca7e6636a20", "comment": "Malware payload", "value": "cb1e15a47e40e7e1886531b829f4061c60b73ba4937e9161b4fc1fef846dfddb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843191, "uuid": "d29f119a-759b-4e43-ac59-8bd33db04eb3", "comment": "Malware payload", "value": "bc154cf904b1d48ea12b805c56edd1d753981f0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843191, "uuid": "4f828f65-d7cf-4a50-85e6-f428a158fadd", "comment": "Malware payload", "value": "7f58e4cc460c5c5213a9027deddd3cce541246841e2ddf6ca6b44eb8baaab5c77ba34995017146f03afc49ade7581a4f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843191, "uuid": "22f8fcba-cdbf-4235-b938-06e3f8c39f3a", "value": "T136B55A07BE8041A5D49AE736C9B64251B270BC4C873137D72F91AAB42F727D2AE76F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843191, "uuid": "0d8c530a-253f-434e-a149-21cbcc1dcd15", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843191, "uuid": "05f13371-aed7-4d2a-995f-4318e3d58d56", "value": "24576:B5D5y2VJW6p2O8Em/ATZiX6WBYOu4S4t690ttnlqaUY80yY7:vE2VJW6pmEu+4XbYODhtNfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786843191, "uuid": "392de28f-4d27-4250-9fd2-3a0f7ab0e042", "value": 2424336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786843191, "uuid": "28bc2a4d-4c3c-4778-9579-c7d7c5afe6b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843191, "uuid": "5818d70c-de83-4e41-bcca-a0ea96e1e784", "value": "dollar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de45bd8-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901377, "uuid": "fa8e0fb9-3b66-48d4-aed5-55de9cf96dfd", "comment": "Malware payload (Mirai)", "value": "4cd6e8537f529752f575a2a4761270cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901377, "uuid": "813872ae-f30f-4c33-928c-3beca2bcc619", "comment": "Malware payload (Mirai)", "value": "cc03f416b87e3cc41ac861b56838f14dfd50ab569f086df6b18c30b7d9d7b1ac", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901377, "uuid": "23876d3b-118e-46ff-8ef2-02463f936574", "comment": "Malware payload (Mirai)", "value": "e172a344f20e9a7e78440c5e6aba7e170856f120", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901377, "uuid": "9e821b68-138b-461c-b89a-8c505dbc863f", "comment": "Malware payload (Mirai)", "value": "c1f2ccd6e02a73d3ff022f4fb0cd295a29d0fbc5024136ad4e92609343d49612b6f336440a87b4929c31a9dc30d2a72c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901377, "uuid": "d11ea3c2-6fc8-4ccc-96ca-8bc7de717048", "value": "T19FB31863ED269F5AD216A0F072F28E781F93BD265D471A9AA472EAF44043CCCF505378", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901377, "uuid": "9feb8413-5561-41a0-bc81-e33004633e76", "value": "1536:Il6gTWu+VkVCqDKFNTI7y/xv/bP2zUcT+WWH3z2J/YJ9Q:ZgTMkVgFyGv/b+ocT+WyyJQJ9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901377, "uuid": "be8e147a-6236-495b-8dd8-1b64a651b1d3", "value": 111000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901377, "uuid": "8f3a1ce4-434e-4868-82b7-9ed11fcfa04b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901377, "uuid": "f18736bb-81ed-4afb-9002-8645822f6856", "value": "eclipse.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cab4c3-99b1-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786912094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786912094, "uuid": "76cf21c4-8a34-4e03-87e7-95591bf911d0", "comment": "Malware payload", "value": "e6bb48a80f90bd193abce14af82b5804", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786912094, "uuid": "999f539f-f65c-4c63-9688-2b17b5ed77fa", "comment": "Malware payload", "value": "cdd3196e256f78a2ef83434e0eaa69a258ea4a1b3bb8ef2a7b22a4bd6fab9c55", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786912094, "uuid": "75b89053-fbb2-4334-a99e-d7635c6750da", "comment": "Malware payload", "value": "60f1ba33262cb61097a3b2cbe20aaaa028261b8f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786912094, "uuid": "d0fda11d-ca6a-4739-b224-6b748da9c1ce", "comment": "Malware payload", "value": "9adda9d4a5fde20ab92951e98a5429b1aaf876939685a3f647cca43dafb39885facd018a396468ea78a767a997829d2f", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786912094, "uuid": "73a14c3e-c163-470a-a7aa-75bd943cde67", "value": "T136C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786912094, "uuid": "df268dab-6e28-4142-9da5-df3faf451ea0", "value": "768:g8vCB+25j6es8Ra9FYpMSUpi+20qUpi+20YQX:g8l25JMd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786912094, "uuid": "d511fd57-c38c-4d19-92bc-da9113612417", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786912094, "uuid": "310221e6-b387-4552-b4bb-42d0aed72d81", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786912094, "uuid": "89c6c988-dd17-48a8-9b06-274c8907e462", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac2eaa21-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786870289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870289, "uuid": "35dc8e04-6c86-42c2-b9ff-3f0b2b719e30", "comment": "Malware payload", "value": "c426b9aa1da1872a310c32f1ac363724", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870289, "uuid": "51bd0c57-92e3-470a-b6d2-86f1a19dee13", "comment": "Malware payload", "value": "cef4899970ac738bd9e22f7f77b21843bbfd34e91e0f1cc59c04a27be936ba76", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870289, "uuid": "5bafb840-fcad-424a-a182-9f988554abb9", "comment": "Malware payload", "value": "7f37aa1ddeada52009dcd921a1a42a6e0683829b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870289, "uuid": "b8e07f6e-a1b9-4490-81e2-2e207d35c798", "comment": "Malware payload", "value": "a6e139662cd15b14c6466be68ca7f3d3c3b23624c141d95d90ae8755886058d13353d0993a74003f72bc7173c076f35b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870289, "uuid": "d2bc34aa-90b0-4dcb-b00b-39fa3d23af4a", "value": "T140B2D60F776748EDC549D43881FB9636AA72BC0888B12B3E4324EB711E95B652D3EB44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870289, "uuid": "d26ddc0a-2eb8-402f-873c-c582eb86e4b6", "value": "5bcfd99140b04a4b24c742176fff15d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870289, "uuid": "82b3ab71-117e-4cdf-9856-41172b75923a", "value": "384:KIgGz9Cih6snSgGcHTlh9RHBx4ykNPNsDGn0R5WVUh:KIFzVXSzSx5jkmRk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870289, "uuid": "b3dadcbd-bab2-45b2-a1bd-da73b697472c", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870289, "uuid": "b0fb61b7-d890-4fb1-91a8-9bbb90820f9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870289, "uuid": "ae295f7f-8ad6-4220-bcc6-305c18136532", "value": "18cb7441f57b1a78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ba6edd-991a-11f1-bd95-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1786847406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847406, "uuid": "bb3e5b4e-dff0-4a46-a0cc-180d1f3f7aa9", "comment": "Malware payload (QuasarRAT)", "value": "1e1f1336dd0fd523d8bea4dad1c963a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847406, "uuid": "eb8fc09c-6214-4f20-be67-594bba95fd84", "comment": "Malware payload (QuasarRAT)", "value": "cf074b9eaad872281fca4a15ff70507bcf1b8cd904b8175bba9f352021495b33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847406, "uuid": "df3c2d77-ee41-4c45-9a4e-08dfc1814444", "comment": "Malware payload (QuasarRAT)", "value": "12bdaeec1a59e079a0d6ddca94bda3078c862875", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847406, "uuid": "eb219875-4577-47f8-8993-cfa19fd414d8", "comment": "Malware payload (QuasarRAT)", "value": "c12f7fcc9132ed3f41d21a714ad1d3de65e104c776bd1206fc4eae8fdd9b5466453eeb6e5cc7ab097f91d19b027b0158", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786847406, "uuid": "ee612bb6-d33a-45da-b29f-83ecca9076fd", "value": "T1ACB5F045A3F884A8F1B7AA389DB24B41DA32BC859A31DB4F1258755F1F33680DD35B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786847406, "uuid": "f93fbd0f-7c6d-4695-9f19-84bb3d8a5b04", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786847406, "uuid": "b005a27d-dcda-45dd-abdc-5b0175dd75ae", "value": "49152:YKA5/fB6UeT+uXEkjNERBHLuyd6a2UXd33Rz4+:YKApa+uUkjiBHLuysOnz4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786847406, "uuid": "0337b33d-d6cc-428b-8126-a0c17c84208c", "value": 2404936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786847406, "uuid": "c8719103-2671-4705-81c3-6a8f71ee69b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786847406, "uuid": "b4ba8fb2-0a3c-4d65-950c-927695b601da", "value": "1e1f1336dd0fd523d8bea4dad1c963a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9980765c-997d-11f1-bd95-42010a9c0009", "comment": "Malware payload (ValleyRAT)", "timestamp": 1786890015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890015, "uuid": "e8380ed3-111e-4be1-be19-e609d3bfa66c", "comment": "Malware payload (ValleyRAT)", "value": "dcffe51f75ffd93882f1a4b31613ba28", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890015, "uuid": "0c2773eb-3395-4dc8-8752-47769e78dcfc", "comment": "Malware payload (ValleyRAT)", "value": "cf0fd4fc3bfc0aeeec5af236454c02c30faf264980e930397c3ef669487f6479", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890015, "uuid": "355e68fe-ca3a-4771-a6ab-b434fb85d0ee", "comment": "Malware payload (ValleyRAT)", "value": "af06d4b5899c83c4290432468cc045dc9c59ed6a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786890015, "uuid": "1b51e8a1-15ae-4c15-b04b-4f8b92085e1e", "comment": "Malware payload (ValleyRAT)", "value": "10fe23038144395f32ea46d7e822f57ea5cc611e7fc628b026bb2f3c63a316d5261cc9ae574508b73995df60635d0112", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890015, "uuid": "257ee0f1-9bd6-4456-97bf-f73a6886927f", "value": "T15346CF173E5C00A6E05A1133CEA9B6E8F1AEBDF83B76019715A0BB1DFD32741CA1456B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890015, "uuid": "a3c623b7-9b9e-47a5-9286-1937ac4e150d", "value": "015ade0acc2769b31f99b52582ac5d1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890015, "uuid": "69845217-a8d0-403c-b017-123cba6428ce", "value": "98304:HZ450y5i1sSv66fjpSBRzPTq0FLToBoa+A7Z4OiZrq1DfPHNADtV6v+zM+rwroDH:HaT8iRzPTq0FQBFt7Z4O7NADtV6v+zZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786890015, "uuid": "d52e36b2-c660-4d74-844c-316a4ae7910f", "value": 5762560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786890015, "uuid": "c40a4f35-78f9-4122-9b00-bb1e3055103c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786890015, "uuid": "bed6dd8a-70e2-45bd-a08a-0ba89bbed569", "value": "DCFFE51F75FFD93882F1A4B31613BA28.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8ccc536-9942-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786864754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786864754, "uuid": "0a779607-6dfc-4c9f-8c0f-d29d18574ef8", "comment": "Malware payload", "value": "ce8a3dfa1b4ee9aabf8fdcb4d7004a18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786864754, "uuid": "f5cca446-3826-4be1-b24f-423693c0aecc", "comment": "Malware payload", "value": "cfd9cae80e8601eb4db1d0fb045292d92d9f8904a7987838f8e2182fd78d5a8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786864754, "uuid": "ecfd39a6-fd00-4304-a457-5ea53d56abc9", "comment": "Malware payload", "value": "077f20f93408d7019cd78f15bfd4e8ef457fcd2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786864754, "uuid": "63a9f58d-0781-475f-ab0f-9364526becab", "comment": "Malware payload", "value": "3272992ae22c12cc2701bc4e3a3efacc8ed86466b4b2b97429e59f592b68858a72050805ba183ca914531a6acfbbc5b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786864754, "uuid": "e4ebcd22-d0af-4a06-bbca-4f507023777d", "value": "T118647E0BEF4361E8C1BAC5756397A232E561BC41C3726CEB1390EB657D76BC06A38706", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786864754, "uuid": "c7d728e5-e134-4b60-987e-0ac1d8dc1df2", "value": "1c23f4b23223bc7029e93c1f7a85c67f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786864754, "uuid": "c5b4e9ab-a441-4ffa-9fcb-17b8418a67ba", "value": "6144:6OVLVUEZ2kk3cnq1Zgw+2Z5UnwSSroNdEtGZtr2cuY:1VUz0n5o5Ul3NdEI2cuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786864754, "uuid": "c1c57347-64f8-4b5d-85e0-cf7023992d40", "value": 310272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786864754, "uuid": "f31eb174-6b85-4bef-aa23-864ba2a1e985", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786864754, "uuid": "4ba79585-04bf-4ec7-867d-0a11a1d10e64", "value": "cdns-daemon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d00447-9935-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786859185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859185, "uuid": "60e6294a-177b-47cd-8d8f-f4a716611170", "comment": "Malware payload (ConnectWise)", "value": "b6e9a73504c62a3ee0c15cc2a3cbe9e7", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859185, "uuid": "af31be1c-0ece-4f44-837e-9c4cec245601", "comment": "Malware payload (ConnectWise)", "value": "d02990ae4b71c88a47d16a431de9f01b8259269faba3f79ddfd7b4e70e4bb70b", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859185, "uuid": "cdd39d09-39b4-404f-ba56-7295b0119f3e", "comment": "Malware payload (ConnectWise)", "value": "ebd86f78196fcd174dcc6a45ca14570d6b982025", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859185, "uuid": "3ec62b20-a108-4933-ad6a-aba9e35becf1", "comment": "Malware payload (ConnectWise)", "value": "6c1ace657228db720a8c93045608b0c5f29d1a977c5304db560358ffb2c673676f5eff82b06da2e387179c94b89003aa", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859185, "uuid": "c4731a9b-cfe5-4fac-9b2c-73ee7df47316", "value": "T1E446E101B3E695B6D1BF1638D87A52656774BC049312CBBF5394BD392E32BC04E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859185, "uuid": "cf9692d8-c02f-461a-b086-7d3d61986f60", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859185, "uuid": "1ae218dc-f5da-40b9-bf37-7932618adc17", "value": "98304:GzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:GhfefPtHxcp9ym3nltDUJV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786859185, "uuid": "62c1c72d-66d8-4662-96b1-e2c3d1a03506", "value": 5656832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786859185, "uuid": "e997bb94-d82b-4558-b086-57012aaa81c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859185, "uuid": "309338fa-9292-4f6e-b4b7-031d8d0d402a", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2637ee-99a8-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786908299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786908299, "uuid": "f15d222f-5011-4049-9787-944a937f459b", "comment": "Malware payload", "value": "e1951384227d9b867a6d7428ed4a78d2", "object_relation": "md5", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786908299, "uuid": "62e5dfd6-e23a-4e8e-a392-ce734f9388c9", "comment": "Malware payload", "value": "d05692ebb1f84d83309f642d6d6f9e57c557437160eb55884d9c8ec84bd36ef6", "object_relation": "sha256", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786908299, "uuid": "146bc8ce-a687-4c8d-8ebc-019b101253b3", "comment": "Malware payload", "value": "205a5452b2d7111f73acb81fabaaab4653cdd9cd", "object_relation": "sha1", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786908299, "uuid": "2c779d6d-67eb-4c80-abcb-23f5c8701e06", "comment": "Malware payload", "value": "86fe3fa4bee6b2e297e85996a12c82bd7be234419a7a4eba123c42131f4db98cb6e2cb195644c490451239ba6b42ed91", "object_relation": "sha3-384", "Tag": [ { "name": "9d2ca3", "colour": "#57992A", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786908299, "uuid": "2eb5d6ea-33b2-4b8c-a05b-a39e8d446d31", "value": "T167764903EC5919E9C1ADA63189B39253BB717C491B3223D72B90F2383E76BD4AD78354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786908299, "uuid": "163d6ad4-fd64-4020-91ba-46c66253753c", "value": "4e2bd2c481372f7ab13b83b63b424e97", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786908299, "uuid": "01ec904a-e3e1-457d-89dc-73195102d52b", "value": "49152:rfUUn8tWezw/a77G2dJwDms6UWyaMJhuTw+Njjv+M4QZ8mgA0rXIlI1yjlU9UM8B:rfP8wzyE0T+IGR9v0uvREz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786908299, "uuid": "df44c482-85e8-4c87-b042-110f21b5c62e", "value": 7407616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786908299, "uuid": "5463c492-dcf0-4d40-9981-8d4e732f3606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786908299, "uuid": "d34709a1-0a92-49ce-92cb-b00f5306de2c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d0e9c8-9962-11f1-bd95-42010a9c0009", "comment": "Malware payload (RedLineStealer)", "timestamp": 1786878306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786878306, "uuid": "434a6756-51d6-4e95-b46e-df0d495777ec", "comment": "Malware payload (RedLineStealer)", "value": "77419b9de019b422054b6560b7114441", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786878306, "uuid": "d274ba77-3411-4734-b7c6-bdce1d46b6aa", "comment": "Malware payload (RedLineStealer)", "value": "d05986e4e8a5d6818ae373894b7af0e78fddd99c57d1b3b76357dfcafefc0cbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786878306, "uuid": "28471392-7117-4c05-985a-9fa0b805ab22", "comment": "Malware payload (RedLineStealer)", "value": "d134cef036d35cdf137f08c7f8e838cedba7825c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786878306, "uuid": "0676654d-0d1e-4f7e-8e71-48086c7a3467", "comment": "Malware payload (RedLineStealer)", "value": "0d1900edb470c89da6bc5909c29e407c268d8bc94f673d16b450fb71694a3f23722977f9d4ff28addc1231306409cb37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786878306, "uuid": "a97db977-dd5a-42b5-912d-850bcfc249d2", "value": "T1A815E0701A04D981D5525BBBD921E3F837B46DB8D831D2138EEBBDBB783674018E52B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786878306, "uuid": "bfc95014-a16c-4a2c-a440-5fd7423f6721", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786878306, "uuid": "5f43c64f-a170-42a2-ba99-3634add3dfa0", "value": "12288:JPhRpqGkf4UfZNMywMadCJPzLes3t1fxSGWo31V/nbqRyoifTyrirJ1Pf:bR0wUfZbPGW/buuOIJ1Pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786878306, "uuid": "192808eb-656c-4f50-b1aa-28dea3662325", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786878306, "uuid": "74cae77e-c8d7-4b87-bd5e-b4971adbe684", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786878306, "uuid": "94b7d6cb-4b1a-45d7-97c2-e384a7538094", "value": "77419B9DE019B422054B6560B7114441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a82850-99a0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786905197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905197, "uuid": "ded4aef0-5b0b-4df8-8aa8-dfca540cff8a", "comment": "Malware payload (Vidar)", "value": "ea2ccec3920883a600fc91c069126ab6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905197, "uuid": "89aa667a-e6c5-4dc5-be49-c6a98db8a99f", "comment": "Malware payload (Vidar)", "value": "d12486debd5e3ffe019d3afd7f7bec3d10920366c6888d9a7a7b37c50844c861", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905197, "uuid": "a744762d-822c-4b19-af48-c55921659191", "comment": "Malware payload (Vidar)", "value": "55383e54570a5b9a1a8403a3c29f235cbe6c9066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786905197, "uuid": "85ae6992-39b6-468a-bc82-891073da68b4", "comment": "Malware payload (Vidar)", "value": "8815505966fde93cea51af1e71e6c40b6a1b6f16321b22b65ff0cd5bb832210fef4f3d3581268af91d0011652d19ac6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905197, "uuid": "c2cf0efa-ed9b-4810-8a8e-8c9b4ab4b620", "value": "T134269E47BCD16864C49EA3368D7242513728BC4B5B3A73E72EA0E6352F637C28E74B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905197, "uuid": "992089cd-7255-4c83-a464-655ced2ac031", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905197, "uuid": "c5c6462f-a44b-4164-b909-79693670b29c", "value": "49152:scQakA5hqOMPsOhzRQRm0L0/ZSl+QfWLFquJjZRpMcClGrKg48XuBCdqni0VCDBi:scmPdF2dgYtkbFP9Qc4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786905197, "uuid": "bf96f8ea-969d-484e-992f-b4540d223df7", "value": 4590288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786905197, "uuid": "b9fe52c1-f231-4e29-b2b5-4b0fa0c69760", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786905197, "uuid": "29623ef6-d7a3-4196-ab1f-f83c1f16dcc1", "value": "d12486debd5e3ffe019d3afd7f7bec3d10920366c6888d9a7a7b37c50844c861.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d77c528-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "2af59b38-8752-4f37-9f87-63c827f07120", "comment": "Malware payload (Mirai)", "value": "cc9346060a403b16d71612373212da6d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "6ea95ca2-e2f8-45db-bbfb-1c158c4656d3", "comment": "Malware payload (Mirai)", "value": "d1e86d0d56ab3c89f296f108c87849cb54cd29e89442768a056e060e77375559", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "94f556be-d056-4e45-89d0-c58f702e78e7", "comment": "Malware payload (Mirai)", "value": "a046ee45515c3c32dd2744c8b560480f27420015", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901376, "uuid": "d3a8e001-47c4-47db-903d-ead9cbd3dee0", "comment": "Malware payload (Mirai)", "value": "8af4905c21005ae9dcb398a8fca84e7f15fd2d79fd19139581f2f96b135944997e0f9d16a89996c3052bcf46f6bcb1af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901376, "uuid": "90de2e72-1212-48df-9200-1e656d15631c", "value": "T10004C406AF519EF7C86FDC3306F98A0124CCF4572564377A3274DA6CB91A58B49E3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901376, "uuid": "3f935a2f-6a65-4729-b001-11d7394a67d0", "value": "1536:rV0hvbEqnJ/gpKQtm/5hLDjOKDQQmNlm1GEw+3Zu+tXPvMIYMlJel6v2iO3bnWKT:rAvbNYq11ZDcaElPiebnWKHWhjPU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901376, "uuid": "b12a595a-9e96-4670-ba69-c9846e576a78", "value": 189368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901376, "uuid": "74c2ac3a-12ec-4467-9448-06a0b814e1f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901376, "uuid": "5174bd1b-2996-4e83-bfc6-ae61cfdce711", "value": "eclipse.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631d647b-9937-11f1-bd95-42010a9c0009", "comment": "Malware payload (ConnectWise)", "timestamp": 1786859859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859859, "uuid": "fc6ed3e5-2301-43a9-8ea8-d4abfdda58e7", "comment": "Malware payload (ConnectWise)", "value": "b98589017bd2e0ef83b4fe7dc963a784", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859859, "uuid": "1f3f49ed-6644-4691-889b-a9e996b00481", "comment": "Malware payload (ConnectWise)", "value": "d30c9d87c66d715810f77ca6db1e85b394b048a57cdd11d116a47c4536b3be18", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859859, "uuid": "e3ddc9d2-c65d-4b88-9de1-d3d12d05d5ba", "comment": "Malware payload (ConnectWise)", "value": "d215290cd61bbe0feadb98a5c23168591f56512b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786859859, "uuid": "50e116ed-8616-4a8c-a944-5e331756102e", "comment": "Malware payload (ConnectWise)", "value": "21af4f5e9df891e3fadc78c2155c4dbcb499ab27ffc0b43963c9a4bf72bed0d42225f4f2cf26601df67a43b1b1f0e9f9", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859859, "uuid": "47976337-1274-4b62-b692-86d52ac69b80", "value": "T16A46E002B3D695B6D4BF063CD87A42A96674BC044712C7BF57D4BD692D32BC08E323A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859859, "uuid": "29762734-0d4d-4f61-ae34-6db5aa250ba1", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859859, "uuid": "bf9b4bf5-d7fb-4b3d-adb6-f7576165bbec", "value": "98304:Izs6efPhFFNUhJFF3s+BoiGg1Gc977zbt:gfefPCFF3bBR1H9773", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786859859, "uuid": "99f3127c-c07b-48df-b293-7f54bd28b7ab", "value": 5642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786859859, "uuid": "acf2ef63-d48b-42cb-92a2-c8a0ce4e39c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786859859, "uuid": "7a54b6e4-e3cc-42f6-a028-db2d4fb765e0", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339bcf30-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901440, "uuid": "1e3618f3-4aae-47ed-b489-3abf6cab6a08", "comment": "Malware payload (Mirai)", "value": "3501c235b6e6ebf9a42ccb3f4cab03d3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901440, "uuid": "32e9b19f-f13c-4e48-b0fb-28a7196b05cc", "comment": "Malware payload (Mirai)", "value": "d335f4e78a5622c11efc213ad8aa577b2d76f12b6bf44c9d645f423f315eb694", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901440, "uuid": "181ef411-3fbf-4b86-b755-c094bca9bd13", "comment": "Malware payload (Mirai)", "value": "1557faaa77c2ea47b23a681b76b7dbad73d049ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901440, "uuid": "58872cef-c289-4647-aafa-5519e0e3e7d2", "comment": "Malware payload (Mirai)", "value": "b71921745a76d0733ecc35a35cdd887fad482485cb52e7cf83db348e6604173928c644f8534bc0fdecec41d6444407d1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901440, "uuid": "48886433-4066-4ce0-9954-bdd87296810e", "value": "T1B7D33851B8829A27C5E523BFFA6E028D331563E4D2DE72178C215F217BC691F0DB7A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901440, "uuid": "49aca309-5697-4f3a-b140-98ab29e05ef8", "value": "3072:JuVeGJFWOgt9ctajH1I7s741o+YLyXzXgvh:JuVwt9cUH1I7s7MeLmLgvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901440, "uuid": "b6916b28-f5d7-47ed-bb93-9d682daa6fb4", "value": 140756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901440, "uuid": "ba4a7576-7316-4c7a-85b4-1ab984384f99", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901440, "uuid": "f19c309e-0df4-4ec2-ab43-35d037153791", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4008505-9988-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786894864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786894864, "uuid": "94e30868-3094-4938-a44e-76b964877aa8", "comment": "Malware payload", "value": "76c5dc08ceb375c1a33617375d02ed95", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786894864, "uuid": "8f10b526-3678-4d85-9d1f-f683a6f20b08", "comment": "Malware payload", "value": "d35c9c1c33255b080c78801a74ac5ceee00644ba3a8950739a3607291611d174", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786894864, "uuid": "59676794-1c42-4d91-954f-6fbdead38822", "comment": "Malware payload", "value": "0272bad50a88bc8d3d7b8c6e4e894a2c6a99140d", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786894864, "uuid": "ccd6e610-bb1e-403e-9411-e6cfc6c1a281", "comment": "Malware payload", "value": "4d586539980acbc6e42c1c23a728459cc4ea7f7f8f118766eddd5915b4edbe4860474c4bfc811f16ec53615c7f462e2a", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786894864, "uuid": "c24c2067-81f3-42f5-a0ab-daf807be0781", "value": "T18145BF1AA39511E5E53BC13D8DA69A52FEB1B84A07309BC703D446A92F23FF45B3E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786894864, "uuid": "e89027d0-dce5-4551-a07e-bafe9506bf16", "value": "84bfecb6d94378cbca4bbc69ce9d9882", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786894864, "uuid": "e8e83e63-72af-4d4d-9b46-f9fad8ec4844", "value": "24576:exwz9PDC5/WD+qQGGLQqFfPxf7mdlWDSJggE6:exwx+qQRQqFhfbSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786894864, "uuid": "613fe94a-e101-4590-9b49-8f1236a8b3cb", "value": 1233920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786894864, "uuid": "d0f2561d-564c-4ad9-9f4e-6fb0bf3cb4de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786894864, "uuid": "a03b11e7-6391-4dec-8df5-8791fd7e9c1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb990eca-99aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786909506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909506, "uuid": "6ce901b2-dc10-4e26-a5b8-ef5bda446a5a", "comment": "Malware payload (AsyncRAT)", "value": "901e3a08ef749329668b94cb09691d06", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909506, "uuid": "3f480222-4751-431a-b955-afd19a9e8977", "comment": "Malware payload (AsyncRAT)", "value": "d38299b943c1817179a82bcde7bca8e613781c8fc00689c8abf29282b2c02309", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909506, "uuid": "581ef9d5-5208-417c-ac52-b5e29e187197", "comment": "Malware payload (AsyncRAT)", "value": "610c72729712f693d7990e717bdb7b1cd9548b6c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909506, "uuid": "52fedf25-ac72-4652-b82a-3a373e6476fe", "comment": "Malware payload (AsyncRAT)", "value": "261162b8b655044a82e276f9070b87f112f9fcb223a42f567dbf8c7f5fa76218f99f53f610a507a54e29980cacf2c904", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909506, "uuid": "071709dc-67b0-4b65-8e0c-a778189328c0", "value": "T147247C16776951FDD1A7C9B4C9434942EA32388A4B60BEDF07904BB77E226E89F3C701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909506, "uuid": "bb1364a7-06ae-47c4-ad1c-a9a6e4ff9943", "value": "183388b096f04db8679b00d085f87f72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909506, "uuid": "83127f06-fea4-4a0b-b8fa-6a69920d06d9", "value": "3072:zkY8yckIfPJWifvyA3yP+ITv57bbOb6Wt1dNYVO9YHhi331erlfEs9Hb:fcVp/3yrTNbbObbfme31erdP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909506, "uuid": "3321c2cb-a2d3-4be7-8985-78390e2e1944", "value": 225831, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909506, "uuid": "0fbe94f5-a098-4c81-ab28-b54ea3d39122", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909506, "uuid": "60b43edd-9f09-4914-8195-8f6a1bdde6f8", "value": "d38299b943c1817179a82bcde7bca8e613781c8fc00689c8abf29282b2c02309.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe4f5a0-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900843, "uuid": "afeb643c-6eaa-470c-873f-55b324ad4936", "comment": "Malware payload (Mirai)", "value": "d347a35fbdf2d78ae94a0b07ea5073ea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900843, "uuid": "6091c25d-e6ab-4df0-9334-3709e32f9fca", "comment": "Malware payload (Mirai)", "value": "d4e4506b27a27100eb18c3f28ca9fae9a63a6b59c5054b29f197497e49836c3e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900843, "uuid": "1c8cae2b-c2d4-4715-ae4f-8a16fa5928be", "comment": "Malware payload (Mirai)", "value": "8e6485829a1cf4c63830ed53a712ca810ced58bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900843, "uuid": "251dd23e-5a3c-4dac-a2a1-77e88ccb86ee", "comment": "Malware payload (Mirai)", "value": "8eab0b6527cd407db916c7097f8cc7595679f4afaf297e928ea331f483e00525cfc407bf6a0f92ef609b6a1989c53b51", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900843, "uuid": "0c573cc1-98d2-42cd-8b75-2eb6b0f0d396", "value": "T100A3AD9BB2475850D89687F04BE78BDE3A2773009F5B88FB3C1D5A3A98751DF0A11790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900843, "uuid": "c698a76d-273d-4f75-bfef-17ecbf007bed", "value": "1536:GiVOCn/JeHGEgtNeftc8Ga5DKY9XlRBNYgzH/LW3:/EKx4rPftc89dK0RBNYgrq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900843, "uuid": "62a61762-55d1-4155-982b-6f0090c1e378", "value": 99916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900843, "uuid": "e5cd7f58-cf9a-4d8d-821d-1ca78df26155", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900843, "uuid": "341e0409-215b-4c3f-8d86-7156c8e0fd3c", "value": "miron.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309a48ba-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901005, "uuid": "903e023a-ac42-4d3a-9ca8-cd72f5b115b7", "comment": "Malware payload (Mirai)", "value": "5080be36f08a3e9d6d15a7b1c4cd6338", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901005, "uuid": "62f5127d-3d4d-4707-a744-02d864a0f486", "comment": "Malware payload (Mirai)", "value": "d5c7ca1a23c1f09a7789b0962bc19c2103a5dbd18b9f4df6b6d68eb22f44d261", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901005, "uuid": "1ccf751e-a997-4746-8083-f240363ae3e1", "comment": "Malware payload (Mirai)", "value": "10453318e3c0ab5285cf31b7403324a7586e1633", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901005, "uuid": "0993b0b8-2d9b-49f4-a101-fd1f8ed2e2e3", "comment": "Malware payload (Mirai)", "value": "9f4126af4d2ec64926be4cc562ec0bd74b71c263309e63283186af844db668b5a5da10c47e8807ccbaf26b85dfd25f07", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901005, "uuid": "a320f65b-b2e3-4bbc-9ef9-cade7a20f3c2", "value": "T1BC13F27D37E00BE9E9B2E07662E053503E6317A8E542E9C221EBFD1989675B630CDDD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901005, "uuid": "990781ed-e53d-4b42-9a41-6fecada83b78", "value": "768:H++dzasEtotsUNdjLpOfHiG6S1pvsm0bd1isVDgeW9mvFeZOAz1pgdoJgGlzDpbn:emaptWRPsKz2snd1jvWA9W1pfVJu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901005, "uuid": "3568c53f-12e1-4907-b96b-1b221a5bf76c", "value": 43320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901005, "uuid": "4a284e0c-ff87-4e83-ab7f-b01778751d2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901005, "uuid": "f021e9cb-1123-48e1-8de1-97f51a127e66", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30eed84e-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901006, "uuid": "526094f9-50b8-4942-8e92-718cd2948148", "comment": "Malware payload (Mirai)", "value": "05b91374b367a83c9fb010b116a30ea6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901006, "uuid": "afcf3ebb-292f-4be5-bebf-3e0f0915c059", "comment": "Malware payload (Mirai)", "value": "d62838bc45d01ed751d1b6662de8a60511dbe60431f4aac8155643b77bc81c10", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901006, "uuid": "9b0cbb28-168d-4c12-8f6a-7c18554a89b8", "comment": "Malware payload (Mirai)", "value": "507658103483907a1a8a89baf632fa3de33eb979", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901006, "uuid": "1fca6796-88c5-40fb-83d7-0ff05672d391", "comment": "Malware payload (Mirai)", "value": "6ec9f5cc3d2ec57920d2f176a22ba13f112ed1ac2ef11da794325c7c75b7c291dfe2859ae8fec0f3a6865b2fd6b78c0f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901006, "uuid": "b9f4eba3-59a8-44b7-bc6b-75cc516b1e35", "value": "T1DA03E148F6232CA8ED5F0ED01D31D7D59FF26FD626A20DA447A5B70635192B0E7222A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901006, "uuid": "e495dbec-cce1-4bc5-b6f2-955e86135d0c", "value": "768:UdhYas0TbuknKGiUMIuIZFiavADRBHm5wq5W3C4OJHeDolpn4uVcqgw09A:kKaslkK9UMw/ADe5W3C4q+MD4u+qgw0q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901006, "uuid": "9ddf2e29-de4b-4bfd-83bc-9f4eb55190d8", "value": 40156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901006, "uuid": "4fc569c9-bbfd-473a-9ea0-e6fb48317e9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901006, "uuid": "42068a3f-0ef7-4c78-a062-c5d6e027705c", "value": "nz.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fac390-999c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786903373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903373, "uuid": "17449cdf-a762-4f63-aba1-bee30a0deda8", "comment": "Malware payload (Vidar)", "value": "1cbddfaa90c467261c05ae0c34664300", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903373, "uuid": "4d57028e-3558-4392-a0bd-8f07e447923b", "comment": "Malware payload (Vidar)", "value": "d6b5a6f9a6fc0867bfed928af2c4b7f512bae70ca9956f6f0c2c3f802efa1e9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903373, "uuid": "8af14557-1a9b-4fe4-b965-8c199e67b68c", "comment": "Malware payload (Vidar)", "value": "4b4803e75df4d0b860594bb9000922f892625831", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903373, "uuid": "7e61a0d6-2192-479d-9fd4-fc0cc8971985", "comment": "Malware payload (Vidar)", "value": "032d0f4efce9ad5fea19d8f8c673f83d36055d16f686cb2dcdd5958ad3b053b26a7510ccb3fd6849dcff3267039b40fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903373, "uuid": "ebe81c50-075c-40d6-832b-3222998a48fc", "value": "T13C465B03B9A55869C0D9F73284B68395F625B80C973927D32F70AE782F727C25E36B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903373, "uuid": "d8ab2950-596c-432a-8897-7a33a4be5f15", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903373, "uuid": "30564100-b5c8-4662-8853-62da8ab3e95b", "value": "49152:UwThhyx5WXqRrlBQjwelpINQJebsbO5kHMQAgXNqtBc6w7urJovEDl/vRV:UNtSnl+aU/gB6waaMJ3RV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786903373, "uuid": "f8efa464-6f73-4620-b3fb-4c989a4e2390", "value": 5699720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786903373, "uuid": "21283bd9-c5d4-4bbc-817b-c54a4c5b36e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903373, "uuid": "96a3944a-8894-4649-9812-ac7b1154ba96", "value": "d6b5a6f9a6fc0867bfed928af2c4b7f512bae70ca9956f6f0c2c3f802efa1e9b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7fa24c9-9925-11f1-bd95-42010a9c0009", "comment": "Malware payload (Efimer)", "timestamp": 1786852350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852350, "uuid": "f09f43bf-6dc9-42a2-8c5d-ddbf8dbb1d94", "comment": "Malware payload (Efimer)", "value": "a078c68a3dc025682f8133e5a268b7bc", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852350, "uuid": "e509c46a-f265-48d6-94ff-6e2be2d604c6", "comment": "Malware payload (Efimer)", "value": "d6c4adba4d4d63cb2f9a28bde034851d9f66709748f9bf6b2f3fa3d9d057a054", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852350, "uuid": "f95dcc88-3df2-4d20-bc28-ead2976b1c58", "comment": "Malware payload (Efimer)", "value": "f0e6e6d64aa7a2745fea4d70ccae1bee245f2254", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852350, "uuid": "795ae29a-e334-48a5-8f98-ba1254f45e6f", "comment": "Malware payload (Efimer)", "value": "e66cf2ccdfdee5a7849382d8d08e6ad87a87de7d87eabdb85157483c504eb2cf3c9ca996eb19fd81423ed7f3c5f114f8", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852350, "uuid": "c71ae598-2c90-410f-9c12-771f2555cd8d", "value": "T1F1E633589AD021D9F3A3113CEFE243A9F67474354372CAE767684369AF572E0887B603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852350, "uuid": "2629adc1-95fe-4d55-93f2-93e0154ed211", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852350, "uuid": "76372523-133e-4957-857b-bde241836180", "value": "393216:eoFbPFry59x+4zxu8hWwQ0LTXMCHWUjQcuI3/PGTAI:eo1PFyk4zcsrQ0/XMb8FH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786852350, "uuid": "1922a385-f280-4862-824e-5c00ba937410", "value": 14062014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786852350, "uuid": "98d1e655-19fc-488c-a159-0ae5f29f5b54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852350, "uuid": "83ec5450-ca06-43cb-b739-62c48239b749", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8142a4-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900942, "uuid": "d76b7866-b0cd-4ad8-84fb-2122cee273f1", "comment": "Malware payload (Mirai)", "value": "4afc98b0cda9a438c2e4b1a4ed993f61", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900942, "uuid": "715991f6-c724-40da-8d15-1e061181c973", "comment": "Malware payload (Mirai)", "value": "d735f77709afd027e2a057300e8a3ebe3e46cecfd4c300691d32f13a85cd67df", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900942, "uuid": "2cd94fe7-354b-43f6-a55d-17bc223fa26f", "comment": "Malware payload (Mirai)", "value": "12cdd7c525a06a923fd5bacf1a66d270f4ef7367", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900942, "uuid": "080f099a-ac27-4e48-b053-5aa1a9df3bf6", "comment": "Malware payload (Mirai)", "value": "e7451570176692b84f2b73bb7b6f0bff9a2a2d76d3f5a24e43a55587916ef303682df59efbb203fcc0cb203285faa596", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900942, "uuid": "e159fd1d-b2f5-4caf-b694-86f4457c58a0", "value": "T16004084AF8428E51F5C012F9FB5D83D83F1313EBD2FA74029D195BB42B9765A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900942, "uuid": "9813af88-79d4-46b3-b2de-aa6e1125ed35", "value": "3072:vGk82g/D68bFD3Bj7faNpseIRk+EMh3fRs1aISoYPfeJk0U8S/wjUqd8Nl:vGk82g/DZFD3Bj7SNCaaISRfeRU8QwjA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900942, "uuid": "d1cb7762-b4a5-4d64-8812-643102db080c", "value": 185992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900942, "uuid": "8d281165-14d1-4346-98d9-82f1cdb956ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900942, "uuid": "9ee1fab4-eea6-44cc-86d3-66cb560d2f07", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cadbd076-9957-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786873776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873776, "uuid": "ddcaf9ef-7eed-4406-9a0d-0cb163333ada", "comment": "Malware payload", "value": "bac197e7d250d7303c47a81164949a80", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873776, "uuid": "25c78f31-a098-4b1c-a8e0-c7ef2d4045b1", "comment": "Malware payload", "value": "d76fca7428f6d436ab7859b9e29ad06e0571e6f36ec5007f4ac1c0d165183484", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873776, "uuid": "25b0d7eb-e95b-4a11-bfe9-90257a63592a", "comment": "Malware payload", "value": "d63aa84720cce80ac5f98701596846354da12d73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786873776, "uuid": "f73444b7-bb1e-4972-a855-e8dc78a2fb38", "comment": "Malware payload", "value": "e99232fa1af3a48383dff5b43473945666a3d6496a6d86e18c86ddd2644f6710f1c60bfa5481073ddc957ca094ae74da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873776, "uuid": "24dfc68f-584b-4f92-8b50-082ad7a15517", "value": "T1BFF5AE076E8088B9E8ABA73545BB52A5B771BC5C9B3273D32E6075343E723C65D39B00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873776, "uuid": "11612817-8058-49d6-b572-bd3ac6d90ef1", "value": "42efe1abd8d48a3188e7e7b82e17c631", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873776, "uuid": "32cc3c17-6552-4ff5-846a-b776ca1db36b", "value": "49152:woFU4fWOcAy79QeExwAwNIAgdAanNrQkdHjhc/4WSMsPF7Rv/1Jh8NbBh4:bcYF4SWa1m+xnmN1h4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786873776, "uuid": "58a0e5ef-f894-4186-9028-74b1374ceb7a", "value": 3553400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786873776, "uuid": "416d352e-24de-43c1-81e2-9165ada68b32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786873776, "uuid": "2aa0cac4-4a65-430a-b4ea-b889333747b5", "value": "d76fca7428f6d436ab7859b9e29ad06e0571e6f36ec5007f4ac1c0d165183484.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13465e8c-99b5-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786913841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913841, "uuid": "7b77bd5d-0861-46ff-b215-a7573fd85e28", "comment": "Malware payload (Mirai)", "value": "7f46bb5840afc202244225f3b59538fb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913841, "uuid": "4debac2b-b3bb-43f6-84e9-7cd1f2b66079", "comment": "Malware payload (Mirai)", "value": "d777c3b2ec0c4c4f1baf0de5c9dc6d936225d063f596d643968e944d2a2b80bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913841, "uuid": "f5de3e3b-dfd2-4c92-a1d2-50bf0a69bb7e", "comment": "Malware payload (Mirai)", "value": "75e3d6f1baa04f5730c1655ea09b2a37736f73b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913841, "uuid": "d93946f0-df07-4f02-8180-d097c24d71fb", "comment": "Malware payload (Mirai)", "value": "c338096498b112b73b1e53a2445c3a84e1498ee228919d7e5bd464ffb244d9d93630b478c61d9ae4155c6279c2919252", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786913841, "uuid": "199434ee-edec-44c3-9b7a-bf1e04b6d8a7", "value": "T137F31855FC819B16CAD366BBFB4E428C772A1768D3EE72038D255F20379B85A0E3B141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786913841, "uuid": "40dcf2c2-0ec0-46df-9542-81612d4f03dc", "value": "3072:meInYszgO3t3u7AGms9Kb1Y6v561O0gwym2mMEm7bmp+DRJyewUEHwB:meInYszgOt3u7AG79cNRGO0gwn2mMp7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786913841, "uuid": "ab61288f-8698-46e5-ba95-17bdff1546b5", "value": 162456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786913841, "uuid": "aa472a4b-7eff-4bfa-bc64-30820cdb0bdb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786913841, "uuid": "c230c137-d35c-4e17-bf21-be452e2925c5", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81914b94-990e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786842300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842300, "uuid": "e7215b63-3dc0-4a88-889e-e77240cc3e63", "comment": "Malware payload", "value": "3e2676e41e31466e37dd9a5d307c43dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842300, "uuid": "d35fdcf6-9b76-4875-80df-0ae0efed5767", "comment": "Malware payload", "value": "d82decfc37200dbb03a77293bbd47df17e9f1bcd7ff51febdcadcf818b45b1a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842300, "uuid": "6b68d841-8c4d-4bde-a4d5-cb62f2a267ea", "comment": "Malware payload", "value": "e3dac7fdf399610b39cb33ca9e922d5fa5d1be90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786842300, "uuid": "8d01dd37-a1b9-41cf-ba75-23ee484001bd", "comment": "Malware payload", "value": "2e64b2411a5562d1127f23053a860d29318dd371267f9d7aae1b58c620abcfbe95ea413e95df73b9db0325fd327b76e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "unluckytool-com", "colour": "#60B613", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842300, "uuid": "b295c5b7-7490-4a02-9648-82167b52029b", "value": "T14A957D077C9045B6E49A933A89F61A81BB35B8180F3223CB3E90B67C3F72BD55A71754", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842300, "uuid": "f522c363-e0db-4708-a9b4-bc70cd0e2bf3", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842300, "uuid": "a82e79fc-9366-4464-92bb-71e61258731d", "value": "49152:Y7YiSfJDrw3rpxKjq1nBdCTCgdFGX9WUg4Ai+v8/r+iBAzonF2Vbpa3wtESudv9c:hJDUroJND", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786842300, "uuid": "fc8f159e-3932-4010-a8fb-21c513b28802", "value": 1908744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786842300, "uuid": "c31868bc-a2d5-44ec-94e1-edad25ccc51e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786842300, "uuid": "cef90012-d67f-42ec-9ad7-ead7fa8e55f4", "value": "xqAAE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93632079-998b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786896017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896017, "uuid": "44167c1b-d6a8-4714-9a03-aab118f8a644", "comment": "Malware payload", "value": "a968f3d38be96aabe017ef1770279d27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896017, "uuid": "c710b5b1-e914-4673-a4f1-189254df55d5", "comment": "Malware payload", "value": "d83c4639077653ef4d78d757087b5d6968644b11388009195f918c32ca9b87ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896017, "uuid": "b5d4b822-975d-448e-aa2c-56ead16228ce", "comment": "Malware payload", "value": "06c43d5a6c9dda413864cf8fa4a1f94c4325980f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896017, "uuid": "a3ade72f-5bdf-49b8-86fb-62ddcf70170d", "comment": "Malware payload", "value": "ffa980810f5ec7d13647063fd62e3c8de0706f558ca05c78e63179544cfe516f6568bdd81c6354ed83185c0968fbda3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896017, "uuid": "b4e17a9d-8bec-45b7-8080-c4b87c1e378c", "value": "T109D52399BCB127B1DC72D7B58E81E47E712837958B708E8B36CDB1008E639291C3577A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896017, "uuid": "92626353-0de1-4c7a-9626-652a1e03610d", "value": "f5bec796b7b3c2932293afa8281cdeed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896017, "uuid": "61affdf5-d123-4f42-a8e9-7648f9ad299a", "value": "49152:7AolSHKfOqfTpdZNMEBFHwQq29QjyD+p1cwMHn00O3xWIkrZ:AHK2+TnZCEjQQL9QjyCp1dMHnJr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786896017, "uuid": "3c018661-a70a-4173-b89e-09efd1b8be12", "value": 2991104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786896017, "uuid": "9ff98453-76bb-485e-94e3-fb383525c5d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896017, "uuid": "8184fc1e-f852-437d-828d-c223d7eefbcd", "value": "d83c4639077653ef4d78d757087b5d6968644b11388009195f918c32ca9b87ee.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f9fa3a-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901441, "uuid": "5d893d31-e48a-462d-8c0a-7e4543ae9310", "comment": "Malware payload (Mirai)", "value": "2baa3d0f46d09c9cbbfe725438c8c90e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901441, "uuid": "8ec717c2-afd1-45b2-a717-ef5e974f2eef", "comment": "Malware payload (Mirai)", "value": "d8af3f2541124c25bd8bca1970eea9283229fb67adbed45a2bb9e368c30ea45f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901441, "uuid": "d4bf969d-eba5-4ba8-a05a-b672faa722bf", "comment": "Malware payload (Mirai)", "value": "8b69fbdc82a500979316e70a35e6119d1a1f6288", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901441, "uuid": "e941f1d8-c301-4a07-969f-cdb04e506976", "comment": "Malware payload (Mirai)", "value": "faa9536c82953901bacc7c3c46ae566b1bc8aacbd414db36c3ec5e81acd7b920bb9da649e2fbf07928c709d34129cac9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901441, "uuid": "35db4746-0b4d-4988-95df-32c5765ad130", "value": "T19993E551BC82562BC5E023BAA67E668D336477E4C2CF722BC8214B257BC561F0C63F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901441, "uuid": "117fcd3e-5d0f-445d-8fb0-b2f82e536f09", "value": "1536:Cd+t0rbCuNhS7CVha4m2WiLMBZO+WC27nVDuw8GSr8wn:8+tsCurVDN+ouw8L5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901441, "uuid": "3a9301c1-5fa1-4eea-af2d-b6bc3426a214", "value": 95720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901441, "uuid": "5d47a877-a011-4e2a-b205-3ee9bbc193a2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901441, "uuid": "dfcebec1-dfc1-4d35-b04c-84b7db59a476", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9302bc-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901375, "uuid": "e241906e-fb28-4190-a6d4-6afaa7032b84", "comment": "Malware payload (Mirai)", "value": "2cf8a252f87711a5f9ae801d34342f55", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901375, "uuid": "29f4923f-016b-462a-bd87-9941c5ca4ccb", "comment": "Malware payload (Mirai)", "value": "d8cfbd61ca459d1728897235be3faa0b29367c71bd405231310febcd5ce7dd81", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901375, "uuid": "837256a4-b8df-41fc-a4f5-823c101e9f9b", "comment": "Malware payload (Mirai)", "value": "698f9b5dca5ba182cd42e132252a3cba5e8497fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901375, "uuid": "fb3c5d31-7cc5-487e-912d-55370c603d57", "comment": "Malware payload (Mirai)", "value": "1e1c2c09195585b75d308ffed7b898d873c79994285c0875b9188cf9ccff2cbe9c489231327f4746dcfcd86aada15518", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901375, "uuid": "5be36085-f342-4c4f-bb52-9c9db1a8c02b", "value": "T17DB30886BB83DEB3E58314F112F74B214A32FD3E5826DA91D3797CA59A520C0A61737C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901375, "uuid": "f4ccb276-0e18-401a-8d60-83b606d1b758", "value": "1536:TocPExFfMnJphyefUdaqNNeUK9KD5DLbIhJBBvOJmm:TocCfMnPYefkbNLKeV2lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901375, "uuid": "189f240f-3ba8-45ed-92b7-6cfd139d5a94", "value": 110168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901375, "uuid": "a5d38f08-bb91-478c-8fe3-5acf5f409e40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901375, "uuid": "a16a3219-2a54-41f5-8332-0ebb6ad95f14", "value": "eclipse.i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0683bcf-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900844, "uuid": "a02964b2-2b19-4828-8376-3efe40774274", "comment": "Malware payload (Mirai)", "value": "14a3654acc4dcf8e5ce1b4bc98a34d83", "object_relation": "md5", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900844, "uuid": "11cca599-44b5-4dc4-b5e4-99b23c3d20ae", "comment": "Malware payload (Mirai)", "value": "d9388cf80b2a67d092e8f57eac895247c227f3875ef8da1b871a50b6b61900bb", "object_relation": "sha256", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900844, "uuid": "64869c90-bbd1-4522-bc9e-c2aa4846c2f7", "comment": "Malware payload (Mirai)", "value": "abc925b2458c3d6ca57d1a5b5d068cdd2ced0e8e", "object_relation": "sha1", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900844, "uuid": "7d603684-cb82-4fc8-b47b-d267cfe4d450", "comment": "Malware payload (Mirai)", "value": "a155aaf897ec5673c10e728aa55fa10f7e205a00f0cab8024b5447dcf9761dd2ba2fde9ae5d9c2d7e7feede6cf66d4d9", "object_relation": "sha3-384", "Tag": [ { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900844, "uuid": "d34b75d5-cfcd-42d4-938c-287482662d1b", "value": "T1EBE2E141B4A94620C3FAE177A4AF3E0BD9A1586FF5A582F3D88C60127427EFD1D0479B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900844, "uuid": "c3f4d8b3-2151-4a3a-8f52-e09040e22b9c", "value": "768:40ijVxyf2rt0BFRZBVjl10+Xg2TfroiPeZNnmznbcuyD7UkWykkAe:4bjKf2Z0BFRbVjX0+bHoiPebmznouy8m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900844, "uuid": "89261714-3645-43c2-9cc1-0bdbb92c7d4a", "value": 32068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900844, "uuid": "bb5f49cb-b4fe-4643-9298-b473d08f7ff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900844, "uuid": "251b84c4-fde6-49dd-9f17-00ed5b778aa9", "value": "miron.i486", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406dad8f-999b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786902750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902750, "uuid": "eedea2af-c5d5-4f43-b1ad-2c33be47ba19", "comment": "Malware payload", "value": "889cb793ad5a710a0e71cb7075cb0408", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902750, "uuid": "786200a6-3fd6-4749-ba2b-27879d65312f", "comment": "Malware payload", "value": "d95415e90ca246726f5b989974bf1b66582eafa821c5475490ee0872bfb6d74b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902750, "uuid": "f878613e-651f-4613-906c-8853c14d55cc", "comment": "Malware payload", "value": "9dcdb9c0e45bace4d83acdd1b14b603d43bc706b", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902750, "uuid": "347461d6-a759-4f4c-b033-677874faec19", "comment": "Malware payload", "value": "38b4d5157b028391d4c9f4fc485db8754426a41cd1986b0f90d1fb9e546e1e91b34f769c47ac62a8172633b94e3f5761", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902750, "uuid": "aeb95cef-5a29-4df6-b162-c12301cde576", "value": "T1AAE6334967D500F6E963413CCBA18199DA76B9664732C9C793E8C3A64EE72F00D3E723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902750, "uuid": "d87c2144-7a08-47ff-a70a-43813e7317f2", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902750, "uuid": "66a615fb-855f-40de-a81b-c065b294d3e2", "value": "393216:aN1L0CSGLYxuaTrS9em0iGtXMCHWUjgrcuI3/PGTAI:204YfSgm0/tXMb8gIH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786902750, "uuid": "0f9bf86b-fffd-471f-b758-24613d209a0d", "value": 14099857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786902750, "uuid": "7e148035-e869-4f9e-8802-e794d8a4b434", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902750, "uuid": "d2ce48fb-3591-41d1-92cc-bc104ca899dd", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc0ebdf-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901133, "uuid": "80c532f5-d817-4021-af99-8029f76d7ce4", "comment": "Malware payload (Mirai)", "value": "f37de572e56a4d3a8a38d245f9df989f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901133, "uuid": "03eee7b1-ab26-4411-aa24-89ee02559d53", "comment": "Malware payload (Mirai)", "value": "da3c9786eedc25ed27de02933b072180dc1bee832b1c29d9ccc2116cb5ed64de", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901133, "uuid": "639ebd25-b3ad-4096-8844-52523572dc0f", "comment": "Malware payload (Mirai)", "value": "3713d3b4a49bd25a6b82a5b8cee9811f0970f9db", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901133, "uuid": "606465fd-bbf0-4f46-bcc5-d5f8c9f093d8", "comment": "Malware payload (Mirai)", "value": "e08d0c4e4f663ecaf4c44ff06df184b70961e7993de8174a48b01e65a709ec9c3cbc1bbb4abd5422ece3d6ff605a13e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901133, "uuid": "50c2b547-dae3-4013-8896-0d2c471ac79b", "value": "T186B3E84E6F318F7DFBA8C23447B3AA21975923D227E2C685D19CD6011E7028E645FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901133, "uuid": "2ce481af-452a-4ff5-be16-70232a9d19d5", "value": "1536:eEkWi8LiZECcpHOWWJDmun5Pd1Oe4nYLxlrwTH+E7+TeVedVPneQBZN0xKUC:M4i50po9WYNlrwr7+Te0dVPZ0xKUC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901133, "uuid": "2de44d98-9eb1-48a2-b988-d1768e644627", "value": 117968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901133, "uuid": "5e336dc5-3088-47cd-987d-cdc2b201c87a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901133, "uuid": "ccb614a5-03dc-4075-a561-2880f67ac52f", "value": "nz.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86b3009-9991-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786898710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786898710, "uuid": "8013a2ea-e977-4fc8-b3ab-9d108a3dc30e", "comment": "Malware payload (Mirai)", "value": "9fd275296db7db72e7fd6612c383e19e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786898710, "uuid": "bce8f658-139b-4bcf-a443-25cdf41395dc", "comment": "Malware payload (Mirai)", "value": "db9f2c39a1efea5beade053bc0843fa105ed70983c1fbee6b875bb467e33e3e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786898710, "uuid": "072216c0-b50b-4bc6-b244-c3b746f0b859", "comment": "Malware payload (Mirai)", "value": "ba69443e2ebbee50ad9e690f317300d7cebb2d20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786898710, "uuid": "3f91bcd2-de47-4994-a334-92fd5972bd3b", "comment": "Malware payload (Mirai)", "value": "4ff10870bd0081ed5745700d4a33f9bafb627e88d941996c41f520f4475b0dea8eed03b9c928f01659405b88197ec714", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786898710, "uuid": "ea1c9d0e-f713-46b8-b60e-254719de378b", "value": "T194B33B45BC819A12C5C727BBFB5E518D332723A8D3DA32079E155F21338B99B0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786898710, "uuid": "96a95434-f4a9-4762-bc14-18c3fbcc8072", "value": "1536:W057UIvXUCy5O8tNSX0bxUvriAZyus/h0kO6dh2Xv8zE/FD2AO+S8SlKp7Hlf9:Wk7UIvHiNvMixus/TT2f8zE/N0slf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786898710, "uuid": "8ea10bdd-53d0-4008-83a6-e1c2a88b2073", "value": 113452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786898710, "uuid": "fdffdd36-52ef-46db-ad20-c310324fcf10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786898710, "uuid": "f9d46928-0a00-408b-a2f7-106f50d9914e", "value": "db9f2c39a1efea5beade053bc0843fa105ed70983c1fbee6b875bb467e33e3e8.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "327b1868-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901009, "uuid": "6a91156f-aec7-4dee-a379-d97387a969f7", "comment": "Malware payload (Mirai)", "value": "ceed113496336e8a345c4157cd0515fb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901009, "uuid": "bf6dcae6-77f1-4b42-9056-986247b15446", "comment": "Malware payload (Mirai)", "value": "dbdacdc6e8a16692a3933e743a2b81fad289e06ada415585eaf551f3d228b28b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901009, "uuid": "a6729edc-d90c-4b21-9197-1d3b7cfde652", "comment": "Malware payload (Mirai)", "value": "c4e119a442dc19415d77f56f60f786842d41d88f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901009, "uuid": "5dc95366-7d16-4094-bfe1-35c1fa714690", "comment": "Malware payload (Mirai)", "value": "139835623061eba58043d7b52e71f96872b4d266b5e413168d394feadd34a13906ab298df5ff1b84e55d93344ae0a6b9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901009, "uuid": "8d323ee5-5ca3-4e5c-9516-68a9df78db90", "value": "T18FB2D07202446874C2B84032F73DD69277130AB4E2E7266B5AE682B8FDD4E173F74297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901009, "uuid": "ca6a0421-367c-459d-9d4e-929126337c39", "value": "768:UQF9rjqARyRGKbrjpH53EBe/Tis3UozMgS:196zQu3pZsKfzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901009, "uuid": "7058a9dd-756b-4f52-8b9e-1690181e4e55", "value": 25120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901009, "uuid": "afa4fe84-f293-4ca7-9b29-8ba7843baa7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901009, "uuid": "8a7a0a24-8b29-4779-ba0c-2af8baa6c1bc", "value": "nz.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416aa5cb-9965-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786879559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786879559, "uuid": "1d41ac20-8e5d-4fda-8cf0-15e3406a09ce", "comment": "Malware payload (Mirai)", "value": "240f44bff7e40aaf74d162ef72be166a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786879559, "uuid": "32db5df2-a826-4880-83a9-057ea81e8e69", "comment": "Malware payload (Mirai)", "value": "dc21415b728962e3cedec30adb95ce0c5f174663ed01e6bcb5b1901445ad4e34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786879559, "uuid": "a7ebe6a0-57b2-4b43-babe-88a470a1ac81", "comment": "Malware payload (Mirai)", "value": "bf9443ee721034433ce32a9b3b45730d09a03e36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786879559, "uuid": "1ffb2bba-915e-43bb-b390-ec8d981d8807", "comment": "Malware payload (Mirai)", "value": "e02b4024a8c98d8ff76a3e4b89dbea9fdf6ccd35738db428fb4e85fa7717964a84f5e30f21f5e3b470d85d062303e458", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786879559, "uuid": "ac07243f-8ce1-4a96-9355-efccd34210f1", "value": "T1252422EB36809E63DC8F2F582DCF67D5EF1EF9789305E9440A5AF02426E471346C512A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786879559, "uuid": "e9ff69f9-cfd2-4c4b-b018-4feff3849970", "value": "6144:NSpvbQ6SLzGFG8JSN70qGhSVQnwOuXSc08QRhmk:AO6Az67aX+Ssvj8bk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786879559, "uuid": "6ebe1759-8882-4557-99e1-570cde58928b", "value": 209540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786879559, "uuid": "531ea6f0-356d-4d75-ae18-e030b8b15583", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786879559, "uuid": "64a02288-7889-4fa0-ab15-5c9f27b5506a", "value": "dc21415b728962e3cedec30adb95ce0c5f174663ed01e6bcb5b1901445ad4e34.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3eabc9b-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900850, "uuid": "0f522c2c-7c0c-4eeb-b702-06da13f590f5", "comment": "Malware payload (Mirai)", "value": "c87f8bf5594231f216d6f549af4e6df0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900850, "uuid": "ce7cc981-4edd-4449-ac63-a4a126904686", "comment": "Malware payload (Mirai)", "value": "dc42d433baaeac6aa5b9a953a16e0e05409fd9e6b89d1ff80024ebfcd5c16add", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900850, "uuid": "c9f92f02-f753-4a40-bb8e-979dfcc5a16a", "comment": "Malware payload (Mirai)", "value": "e49e7d21033d366e7c742be6d1193a08b9b0565e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900850, "uuid": "35b93ad5-2a8f-45dd-a8bd-2cafdb3dbc5f", "comment": "Malware payload (Mirai)", "value": "ad051b18506934fe99ec43885fe35891520d154b8605dd89dff9b5b8a47e04854faff3283b26d426756cc658f4632dbd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900850, "uuid": "7fbc0e80-436d-4d31-83c8-fb0c8647bd79", "value": "T15903FA06DE786E27C1D0323258D74661F5B263A91A78AA4F7EA72C0DDD05320317FADE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900850, "uuid": "bc6b9292-c037-41bb-9a6c-82492f8170af", "value": "768:0v+LVLfkKPGfKH6+4SCpzOaFu6zkiMit4Mx:0vWVkKuia+4TIaFu63MiiW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900850, "uuid": "4eaba342-7e28-4707-ae19-91df2c89877d", "value": 40592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900850, "uuid": "898e8000-c9c2-4dcb-91b1-ea7d92e7c1a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900850, "uuid": "41a527e5-1051-4f55-9bf7-4678e0e4743a", "value": "miron.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d33ae73e-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900849, "uuid": "95117958-d13d-4072-b45e-9f45ea8af12b", "comment": "Malware payload (Mirai)", "value": "aa63ae33f367ff24db49da1dbb16044d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900849, "uuid": "a88f26f5-14e4-4fab-8a47-0038fa31bab9", "comment": "Malware payload (Mirai)", "value": "dc9ff58f9d5a12d90e23ccd29049d8b417f37ab07bb5c9c6157329f259df2a25", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900849, "uuid": "91a2c3c9-b921-43d6-b957-0373c367d7af", "comment": "Malware payload (Mirai)", "value": "cf902e210a5d646712f42a79db73f473a6553f04", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900849, "uuid": "c5768413-303f-4ea0-9270-571e3a10db0c", "comment": "Malware payload (Mirai)", "value": "b80359a9184983818917986ee2f9507387284daa1c0f41f788344bece43bc6df33722acd83ac567fe35d5d2f5d7bb86f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900849, "uuid": "a466edd7-f9dd-418e-a3b9-ecbfff50bf30", "value": "T16A23F1F1E9D24D2DCD9619B1A9B852D821F01CEB138D9DA2B1DD3340575F247262ACCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900849, "uuid": "f19c96e6-63bc-4239-854d-4ed8f2d43fa6", "value": "1536:uMdpGmAC39yyYYLgAMk6CDmzzO74EwzE90h98jjt4u+qgw09p:lumADyY1EYzMbMaeajjt4u+qgw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900849, "uuid": "e791fe93-7b34-45d8-bd8f-a1a579a3b0b7", "value": 49688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900849, "uuid": "31260fb6-ed7f-4483-acbd-72bc4280a037", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900849, "uuid": "5f27d82c-4dee-4d6e-8d23-fb65b47d8ce2", "value": "miron.powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e8f548-9984-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786893151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893151, "uuid": "5e791d15-7b1d-4d94-ad23-673b36e3e8bd", "comment": "Malware payload (Mirai)", "value": "692f2f784b34e31c9692e2c5379c8a07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893151, "uuid": "b85b785b-5790-47d8-b654-887de24866cd", "comment": "Malware payload (Mirai)", "value": "dd026537700c4d942d05e51d0d6192714d29fa517e7ef7ccc566838befa45364", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893151, "uuid": "cfe76c6a-5252-4f4d-8b88-274b55e868e8", "comment": "Malware payload (Mirai)", "value": "4dc749b531008afb435d4ed9b120d3ec0c4af446", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893151, "uuid": "eba58aa5-7af9-4302-bb6f-d7f4fa2ac816", "comment": "Malware payload (Mirai)", "value": "621f53efc43e8db33462441e305921f6ef73126fe51a47943d84f58d6a25d89e3cc9469f2986ee8c93bcd67db51e956f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893151, "uuid": "b3cf9922-36d4-4e90-90a5-2d7ae3cd3233", "value": "T13EF37C07B5C098FDC8D9C2B84BAEA236D972F5195134B11F23C4AF362E9DE206B6D750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893151, "uuid": "30ffd8d8-38a2-41cd-9589-3d74f9fdb067", "value": "3072:9e6PflmbizNDjpW+7v1J3DioLKCIaT4AUpg7a7YRVgyc:/lvLHRBYCB0FSc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786893151, "uuid": "f2d8d89f-4e18-406c-8a8b-5da6b59554d4", "value": 172200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786893151, "uuid": "cd2b116f-cf07-497d-864b-792c78ee8c0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893151, "uuid": "92ff3cf3-ad0b-4f6c-b8d8-4e1096eac82a", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9117a697-99be-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786917918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786917918, "uuid": "7fa31783-5a96-4556-9ac2-b92592f24d65", "comment": "Malware payload", "value": "68deafe1fdad2e79c7d1618610d47d4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786917918, "uuid": "c2a8fdf5-b6e0-4e03-aebb-94e22c4c5512", "comment": "Malware payload", "value": "dddc309f33164aa90670eac7acb6e2e88f4e927bbab5249c8f2ac3e5f97b889e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786917918, "uuid": "e2dbd9d0-620c-4d57-9f78-43f66153e86c", "comment": "Malware payload", "value": "2abce118b8d51a63f8aee969ccdbe25575ca65ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786917918, "uuid": "8fc40bf0-8cf5-447b-8df5-2c275e16e8a8", "comment": "Malware payload", "value": "9e0a0a5535a6409d781d12334ad4cbef4aa6a46daded6ec2802ceba443a64bfb818b7fe4a46ad5df83a27516b8b55b7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786917918, "uuid": "d1b1b95c-bb9f-4fc0-912a-65d0e289e291", "value": "T126D52299FDA211B1E436C7F7478374ADB1AE739486E44C9B71CD5B106C22A102C7BB3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786917918, "uuid": "a1ecec3a-c4b0-4176-96ac-eaf99fe846ef", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786917918, "uuid": "9afdebd1-34fb-4f3a-aa8a-8ceb6d87c7be", "value": "49152:uYCXMGJP2tZEryjN/THlxVc+qPFlbTzDLlTd0eJ5yiadH2mRVQxPfQUWOL6vzJHc:VCXpuOMbHW+ufpCeJ5y3dH2VY5JH+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786917918, "uuid": "c88750f2-5086-457c-bd89-437b90e5d2d4", "value": 2984448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786917918, "uuid": "bb7a0bc2-98d2-46da-b2cd-e6dfdb27272f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786917918, "uuid": "d2de0010-77a8-41e1-8523-9510229c509b", "value": "dddc309f33164aa90670eac7acb6e2e88f4e927bbab5249c8f2ac3e5f97b889e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36a40e5d-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901445, "uuid": "e8ae2624-206e-4e3f-a8d2-bb7c683d73e7", "comment": "Malware payload (Mirai)", "value": "4baa0e45edef25c887c27f34f6cfe1cb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901445, "uuid": "b5d55771-7bd9-4678-a245-bfd2cff78aaa", "comment": "Malware payload (Mirai)", "value": "de5e52a010cb1a88b64c410dda44d56d03cfed8aded705cbb3b305ee7b9245a8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901445, "uuid": "2360ab9b-d78f-47c5-94fe-5472ec1843f5", "comment": "Malware payload (Mirai)", "value": "b45f06731ff219c725b6efb880e906fe30a7549f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901445, "uuid": "d8c2a8bd-9d73-4a79-9aaa-7c69fcc3c222", "comment": "Malware payload (Mirai)", "value": "387e6ded4f432a8b8c392e2c75fc8771d423771c0be470370f5eebd0174c47ffe355a4ab9d3f37baaaa1d973ed62f2af", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901445, "uuid": "f814efb3-368e-4c71-babd-8a6ccfc67357", "value": "T128B339C0EA47D4F5DD1642302277F73B9A32F17A1139DA83E3A89F327C52A41D90A29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901445, "uuid": "148d73fb-2fce-40ea-a856-d01e2ba3d08b", "value": "3072:XFmzGpEWmXBLFkpzjYS3Z/5+JcDEhsohHw0pJbL+:XFmzY5mXBypzjYYZ/5+JplHL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901445, "uuid": "69912bfe-375b-4997-8f2d-de77955835d6", "value": 107824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901445, "uuid": "b7a4b758-ab1a-4cb3-9f6f-209279e85bf1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901445, "uuid": "d4a773f0-4220-4a03-879c-c15fc82ab35b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81ead23b-9913-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786844448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786844448, "uuid": "99129525-cf89-48cd-aaf4-43f250eb1dfe", "comment": "Malware payload", "value": "13b22c3a614aa0e11831113db9f80655", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786844448, "uuid": "90ce4767-3e71-4af5-81c8-f3d9ab210b8f", "comment": "Malware payload", "value": "de6beb87a188da7e565de2fa4a49bbb24a6e3723cb893b8812c5deb0375a722c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786844448, "uuid": "afd9d9e1-6f26-4b4f-80c3-fc579c842213", "comment": "Malware payload", "value": "99ddad36b7e844731cde1712c923850ec0081433", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786844448, "uuid": "f8d549d4-640a-404c-acd7-94a4a9c29b6d", "comment": "Malware payload", "value": "d2d697a5916f35cd47ea80741a1ca5fdffc53b4edf7e36822aefef72002649b5dfc797abf9a9ea1081b921f79bd04aee", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786844448, "uuid": "2baa4ce7-5130-4d09-9dbf-474cf9878367", "value": "T162C28D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786844448, "uuid": "3c563ff6-6010-4b81-bd25-e4b21214d123", "value": "768:58vCB+25j6es8Rgn9FYpMSUpi+20qUpi+20YQX:58l25Jud2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786844448, "uuid": "d9ab79d9-2239-4a88-a539-0c4ed360c00b", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786844448, "uuid": "d82532d1-dbdf-4e1d-af9d-a70fa3fcbb15", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786844448, "uuid": "115ab4eb-fa6c-4bce-8369-74c05b740342", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7521135-99bc-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786917150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786917150, "uuid": "b0685624-a665-4b60-99ad-2027e4e86ae1", "comment": "Malware payload", "value": "745e520d4614c3b61af4a8c51087f50a", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786917150, "uuid": "cd9cbadb-d82e-48d8-8c8e-11108e9f9454", "comment": "Malware payload", "value": "de921fe84fad8b20d12675d3fe2c710a97b205604342ab9d49d6bae50b84ad1b", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786917150, "uuid": "9b25b76d-10ff-4425-8a92-df105291550c", "comment": "Malware payload", "value": "bf2d2663b73f27aff4d6145df015eb7835096edc", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786917150, "uuid": "55330c14-942f-4e4d-a941-ab2a6f43352b", "comment": "Malware payload", "value": "65b9fc4dea6feedf31496be97e6ee778be3bbc1ede67b9a1a163ceac076867acf66eba3b1f5dda64d6765ad1fc3a9792", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786917150, "uuid": "f19698ee-2ac6-460b-b6e0-e058a3a6e2f9", "value": "T12EE63388E9C016F6FD63813CD6D25491E479B43167B8C8C797F4CBA26D232E05C3A79A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786917150, "uuid": "47600f51-6343-4c51-8e2f-abd9f74e6109", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786917150, "uuid": "ce42a205-b2b7-4438-a4d0-327bfc6c47be", "value": "393216:ZEvc0Nv33bPw4Dd0GIXMCHWUj+KcuI3/PGTAI:av3zDDd0GIXMb8+nH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786917150, "uuid": "56a345df-c87d-451c-be7d-7b2bc7a88d8c", "value": 14109739, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786917150, "uuid": "f8725c26-aa57-4f16-b127-c622142917a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786917150, "uuid": "f412e205-1cc4-4fbd-93c2-ed95c5c2317a", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1c3fd6-9995-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786900089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900089, "uuid": "952b471a-85d0-4e26-b916-58da433ca758", "comment": "Malware payload (Vidar)", "value": "eb25b759bcc5d8fce2485ecb124c27d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900089, "uuid": "c59e71a3-4747-4350-a732-f225196e27e8", "comment": "Malware payload (Vidar)", "value": "de968750fe8ad20ed2c45e673d4d33f703a8215cdc066662f5d4d3899f848019", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900089, "uuid": "b6742e92-73f5-401c-8767-a717dcf2dea2", "comment": "Malware payload (Vidar)", "value": "8e668b443d669e69de47ff960eade0b4720797c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900089, "uuid": "ecddc911-5900-45bf-8c1b-cc3c45028e9b", "comment": "Malware payload (Vidar)", "value": "1da07d7487d4659e7cc02c96c9b2642d3ee6d8a7bc71c9d8e2673c097f01bb40303f185bfb8f291126517ca23acf174b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900089, "uuid": "650ac53e-9a05-4b24-b6cd-5ec2901b0214", "value": "T114D59D0B7CD049FCE4AAA73298B26192BB35BC091F3627D31E80B7782E766D15D35790", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900089, "uuid": "62d685a4-1e51-427b-834f-296879fae404", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900089, "uuid": "ff870873-010f-402d-8caa-0851219e94f9", "value": "49152:aeEQE1SgqtgFfeJqDxP4B+DytBRC9z2xOmgq:aewHfeJCxC+etBRqsOmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900089, "uuid": "9f1faf10-6720-4821-86f3-e0943e917bc5", "value": 3017072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900089, "uuid": "01eef719-50ef-423e-946c-f1a3f7612c2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900089, "uuid": "f0203165-ad22-427f-af5e-a6d4d2e11838", "value": "de968750fe8ad20ed2c45e673d4d33f703a8215cdc066662f5d4d3899f848019.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20ba270-99a3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786906350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906350, "uuid": "46c468bb-ebdd-41bd-bf64-326ce5200829", "comment": "Malware payload", "value": "a0f2d270fd63ac52b4c93f731693c2b0", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906350, "uuid": "7d6670ac-9695-4036-87a7-de7d5be54880", "comment": "Malware payload", "value": "e22cef0e55c951d15d8f63c2ade5dd0c29fd1f10ae3483eb38fd7875b334d88c", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906350, "uuid": "21910765-a91a-4079-8410-ed1eb944a5f9", "comment": "Malware payload", "value": "275c193c5aa8044eba6a7b78a52857e3ff77ffb1", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906350, "uuid": "7aa84f2e-80c5-47ab-bca4-784513f8861c", "comment": "Malware payload", "value": "b75dff88ae74a5d00037808fd034075f68f3045bb4bc0c2b3a3387780baa70c66421dd24d28b3b993c664af4f82dd83d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906350, "uuid": "36cf9dd6-457e-45e2-a321-045a62165656", "value": "T1DFE6334876E012FFE9A3A038EDE10291EA75FC751771C6DB876857626E632F02C75A03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906350, "uuid": "5539d210-fd40-4803-85ea-8dd518cbe607", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906350, "uuid": "da438f25-7907-4dce-afab-07bdff7f0c43", "value": "393216:pk6mbC+suu+2em05XMCHWUjE0cuI3/PGTAI:pjKC+swm05XMb8EhH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786906350, "uuid": "c40cccab-ef83-496d-b5ed-fa6e7ae50a62", "value": 14056635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786906350, "uuid": "805689a5-0ee6-412d-9c87-8ca934376481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906350, "uuid": "7d31fb53-c779-4ee4-a834-2ea9f14dc932", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3908414-99a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786906057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906057, "uuid": "ed05fe3d-e8e1-4e47-a7d1-b5639ced7ba9", "comment": "Malware payload (Vidar)", "value": "69a75333b21474742175a26860b93785", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906057, "uuid": "04e628d9-b4d6-4ac7-b608-bf6333ef087f", "comment": "Malware payload (Vidar)", "value": "e2644bb0fb3cffe0b745aaa88fd309363e99d6e7ceab5e86f89bfb15096bb9ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906057, "uuid": "c215ce13-d3f1-4686-b364-5cc2d6a4bcce", "comment": "Malware payload (Vidar)", "value": "1e5bb13a0f5d7655214930fd153076997a05ac0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906057, "uuid": "a83aad04-bcf3-4738-9009-826b9653018e", "comment": "Malware payload (Vidar)", "value": "fd579a68de9fbf3c261ae65e9e83523fbb832b37edd35cd03edd35d1248164b9ebbc24ad996aff5f15960c0d5034bf20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906057, "uuid": "8e4584bb-ed26-4a08-bda8-0ee644991a36", "value": "T1E3268E1BBCA25865C45EA335CD7213507768BC474B3A33E71D60A2742F63BC28EB5BA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906057, "uuid": "7c6f58a2-8306-4acb-9f9e-5ed0355c3394", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906057, "uuid": "b5379fd9-29b6-498d-92fb-fe154b868cc3", "value": "98304:0zgc/VoxiGPBCRLtdbP4eyblh9vUH4JX0K0:0zg4LGPBCRDxZH4Jo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786906057, "uuid": "a8bc5e2f-6126-49c5-b8df-f2bece1cd744", "value": 4583608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786906057, "uuid": "50716c9f-0e39-41b4-bf38-dd927dd26803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906057, "uuid": "1e02d881-4a2b-4c0a-9762-61fb5ff60fa2", "value": "e2644bb0fb3cffe0b745aaa88fd309363e99d6e7ceab5e86f89bfb15096bb9ec.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd75f9ab-99a6-11f1-bd95-42010a9c0009", "comment": "Malware payload (DCRat)", "timestamp": 1786907711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907711, "uuid": "cfd47c57-724b-4b4d-a748-05fd62b23548", "comment": "Malware payload (DCRat)", "value": "127447f106be5f670639649db4c97921", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907711, "uuid": "21fa383f-b6b0-4ddd-b150-84a914e43da4", "comment": "Malware payload (DCRat)", "value": "e28234c87eb635fb36035cc77f95a28eb9327e4161ac10c65501cb335249c7e3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907711, "uuid": "72aab231-5f39-4d99-b809-d0d04bc67ea3", "comment": "Malware payload (DCRat)", "value": "a94390ce5737291856798a6ca475daf63ca68e7c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786907711, "uuid": "79a71e45-b420-4b26-a019-1529a32654d6", "comment": "Malware payload (DCRat)", "value": "d33a40c2d72f5db9a2897c0cc790bf7f1e99b003a16500071517cd899ac887a9b54850c13dd437a39ff4e66470342fa7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907711, "uuid": "5b94d2ac-6101-4179-a46e-23a9798a3001", "value": "T1EB05F7067E44CE12F0191633C2EF4A4847B49951A6A6E32B7DFA377E55123A73C0DACB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907711, "uuid": "0febc167-3870-46a6-bf09-c79fd959c72b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907711, "uuid": "63a54390-dd3f-479f-9f33-72fb49724d73", "value": "24576:/cl+qUNC9iIg8tHdUMoTOjE0imVdiZbddEv:/o+K99wqipU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786907711, "uuid": "cf206ee4-80af-4d31-ac82-5359a23137db", "value": 847872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786907711, "uuid": "25d51c36-6299-4088-a816-a717f6f47e5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786907711, "uuid": "8149b91b-f1f6-404d-9561-ccf9693fdeb0", "value": "127447f106be5f670639649db4c97921.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0412fcac-99ac-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786909950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909950, "uuid": "6067474e-d327-49d5-962d-6826e5737a42", "comment": "Malware payload", "value": "e04fdeab47e2b4cd704b6d3b50745661", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909950, "uuid": "cc987630-f415-4f5d-806d-6115d3dea996", "comment": "Malware payload", "value": "e2d04a0936036353f0349af41577e450ae2772c132ca1141a3fb6994c9dec430", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909950, "uuid": "009181fa-1911-4ebe-88f1-f197d718dd26", "comment": "Malware payload", "value": "bc50fa029a9dee0b9e58965f3b6a100bab3c8d18", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909950, "uuid": "c03367c2-8482-4dda-85d9-8e3a278bb558", "comment": "Malware payload", "value": "e2ffabb405007cb662c63d1f5027d5735e36c03734b6ed6afb2d8516eae20b70fead547c80c15aab46accd40cbaa0be0", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909950, "uuid": "e6f2862d-7da0-40dd-8a80-af7bce6d255a", "value": "T1ABE6330C6BD000E9DDB3423DEAD016A5E67AB8760B31C9DB67A847E56E132F04D39637", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909950, "uuid": "2065b43c-d0d6-4f7a-bc27-d4d5fd343704", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909950, "uuid": "a6b327fe-861f-4cca-8139-2ff540d12b97", "value": "393216:/dQpKj00pbc6+l5Me0d2MtXMCHWUjhcuI3/PGTAI:/doKBbI5Me0d2KXMb82H/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909950, "uuid": "6fc7033f-3100-47a7-82e5-f594022ec585", "value": 14081970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909950, "uuid": "7c50517b-5b3c-4cdd-a5d9-ef8d2d069bc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909950, "uuid": "9036d1c0-1efc-4c49-96ad-3a33b6fc27a0", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5229dc2-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900852, "uuid": "865fc8fd-f5ae-47b6-a197-0dfbe9a82c1e", "comment": "Malware payload (Mirai)", "value": "c49cec577ceffdd5efaa4891fa56b0d6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900852, "uuid": "8faaba04-7ab4-44d2-95a6-d6dbf1950522", "comment": "Malware payload (Mirai)", "value": "e3d67c1d2972aa9118b539114288a446cdb66e5b30e29e08600bd4308f15d292", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900852, "uuid": "a0c844c5-9c8e-4f0c-867f-5cd31fe91b30", "comment": "Malware payload (Mirai)", "value": "5b83bf3e359b5b5ce8e7e3f6b0f9c6bfaaf2f26d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900852, "uuid": "66234bc4-4380-4756-a4c3-6f99f074be76", "comment": "Malware payload (Mirai)", "value": "91cfd699ca84b6d8209bdbdec4b85cf95c793f9f901f889b2227ed4acc0a72b4f5ad7f176b0d10037cdab6fc6f1b3f45", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900852, "uuid": "c56101dc-7e66-477c-8179-3363346d48bf", "value": "T17733F1E292EAFB74C9E49535090D4324EABC7DA1F0060BB75E1260BEDC7B4A17CD1392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900852, "uuid": "41160b9f-953f-49ba-ba68-d4843a95be48", "value": "1536:jtqkAiZ2foS0JKg7TdsgYYpW3AfqVqV6qcBR:3/ZlS0JBXdsXYowfqVDPBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900852, "uuid": "594ce364-5486-4ad4-8527-689dbcf16495", "value": 53540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900852, "uuid": "0b6e1d71-9c71-44b1-8199-7422c5859df0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900852, "uuid": "7111b25f-5377-43e2-915f-0aaa1d4460c0", "value": "miron.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b1ea26-991a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786847374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847374, "uuid": "42c1590b-1f2d-4cca-ae57-122d45b4ccf9", "comment": "Malware payload", "value": "ea27014f6ed1d83e3294c6d11ecfe0c7", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847374, "uuid": "5d2d2d97-188c-4fea-9d84-4a865f3c6208", "comment": "Malware payload", "value": "e5fa297d6ad6db8d44ecf767ce77ffc91147400c14f7c944699666f0157c653c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847374, "uuid": "7e4f0a7e-35c9-41e5-a429-cf2419f0d603", "comment": "Malware payload", "value": "17aac7a7dbd83060fd72df8c8368369eabcf31f9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847374, "uuid": "736ae2d2-cf87-40b5-8712-b2c2c40c479a", "comment": "Malware payload", "value": "9fbaec05a157eeb5292bfc5de0d39320d47e7a66a8160b0bd8a956954d9f1cb23fdca7ab63693ffa44cc1850bd8dcd85", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786847374, "uuid": "c7e9f7d1-a8fa-483c-8898-b66b910bfb92", "value": "T1FC46EF8BFB48A86AC4F753B24576532245474D268B43D7C76958323C28BB6D07F8EBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786847374, "uuid": "ab85270c-1243-4410-957b-85834ee2ce3f", "value": "98304:oAojgf3Xj/sIlIsIWbijKj60Jy92MLBo/KrrYC5npivsTLlJYUmol9v:dAgfzsIKI20J02MLJjiETLlJYUnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786847374, "uuid": "6fca39d2-2b40-419f-8e70-78969b92f0ac", "value": 5540721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786847374, "uuid": "e476c26c-9adf-4635-ad62-4b4b0bd5fa61", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786847374, "uuid": "0dbf4ddf-3947-4477-8bc6-d89e13167e7a", "value": "payload.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0a1c79-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786870287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870287, "uuid": "f0f4047e-243c-4e35-b8bd-0ec1523a8f82", "comment": "Malware payload", "value": "2afc1fd868c68bd06b3512795150c2bb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870287, "uuid": "ece96066-c85d-4a82-973e-c36d020cdfa3", "comment": "Malware payload", "value": "e60821e92e144bcff0c29d45caa93afa06cb8e6df789e7251ad161dc88e3dd6f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870287, "uuid": "01b548b9-8d93-49f4-b0e8-58301950b832", "comment": "Malware payload", "value": "8ce1bee215b8cd6bb1adeaa349720196d7c3c433", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870287, "uuid": "1285425f-7ee7-4a39-b56e-b2da4dfb6b63", "comment": "Malware payload", "value": "1cb8722aee76909cea3933421eb96004672b48741bfdd6bf5411587181c12f0582deebdfc3e9161f56a8d8afcdb44b75", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870287, "uuid": "1c440a95-df19-4468-a845-afe29b3c3b77", "value": "T161B2E70EB32744EDC549D47885FB9635AA72BC0848712B3E8324EF710EA5B652D7DF84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870287, "uuid": "0ec84405-1990-4c85-a663-2cb3f160b734", "value": "5bcfd99140b04a4b24c742176fff15d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870287, "uuid": "31cc2ccb-d8ea-4897-a3d8-dc847e4f3be4", "value": "384:keGyGz9eqQFDnJJjfT6lz+2RHBx4yitPNMFdnKqBVUh:ke8zf2JQRz5jirq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870287, "uuid": "ee8f369c-2224-4878-8cae-b2bdeb202a4e", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870287, "uuid": "f54d6279-9da4-48fa-9132-f9151e8f8035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870287, "uuid": "7687fc4d-fe12-4184-9137-43b868f8c194", "value": "18cb9c2f86cabdb2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef83811a-9984-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786893165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893165, "uuid": "cf624455-7dd0-47d0-95c7-9398c859c6dd", "comment": "Malware payload (Mirai)", "value": "b90b5c40815b044fee8fd8c63c3a53c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893165, "uuid": "261abaab-e62a-4ce8-b758-3c5528c1db86", "comment": "Malware payload (Mirai)", "value": "e62d79d42b2ac4a77052beabcf78994ccbb40a18a290d05660630f65f2c78266", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893165, "uuid": "ddb420da-da3f-4176-9cb0-e235e0630f9c", "comment": "Malware payload (Mirai)", "value": "983c8d8fe8e96fc90593f6de10033920d86587f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786893165, "uuid": "6ed578ac-f354-4e9b-a9cd-9a79616981a5", "comment": "Malware payload (Mirai)", "value": "97fbdfc7841adb3ef8fba8234d5e08e7d1f2eae4b133f08f9f2d3e31dafef411c7b9d3f18c5357a4795c947351dc6766", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893165, "uuid": "2cf987b8-2801-4c0f-9f03-8dc100f7ee5b", "value": "T10C7339DBB401CD7DF85BEB4B8413480AB131E7620A835F3622ABBC67AC751984D27F46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893165, "uuid": "b65ee99b-0d89-4c9b-ae7b-6c0d85a42d9a", "value": "1536:BLEQA6EQjHBH9DFn7JOIbqQ4njvESo6T8n3CnHqbmQLjJ33ApP26KDT7y10Ykv:BHN9Zn7Jp5+j8So6FkLV33AP2ZDokv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786893165, "uuid": "fdf58400-a621-414d-81e0-a6f398627765", "value": 75032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786893165, "uuid": "7a6d8a78-ae6c-4e76-b5b6-cad217b97cb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786893165, "uuid": "653f0311-2edd-4d40-bcd8-0437436d4cd8", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22c0032-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900847, "uuid": "73888b41-0854-4cb8-a7b6-90cf93971b4d", "comment": "Malware payload (Mirai)", "value": "e6b5a8d8aa04a8b23d45d8c9b5ccbab2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900847, "uuid": "5f9df456-a434-42b8-b761-b921b9aff255", "comment": "Malware payload (Mirai)", "value": "e6e7a7a95958ef7949afc2ab832a6c9c10fa233a1100a5c5839b736bcd961fbf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900847, "uuid": "541b976e-e25b-44ed-985f-a35ab3319edb", "comment": "Malware payload (Mirai)", "value": "30eea457b1495fc3dde77577e00962f067e6c3ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900847, "uuid": "00bbca8b-f45c-4861-8917-f9f3ec1299c8", "comment": "Malware payload (Mirai)", "value": "a11b64fec830892e9299391cb183898f0478f8442cf673b21d744545cb9f0f38ef579a2c97188b5e1b93c84911f3f8db", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900847, "uuid": "250a6f44-a334-4f8a-aa4c-93b7edec2a6d", "value": "T11503F1117427A6B1CD327D71DD390B856FA08FFED0FA70E90B590B1CA9A29122BD42C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900847, "uuid": "d5292163-8189-408d-907a-adef71d5ba53", "value": "768:NtW0Hv2Pn4SDXOQ4v8gRvS1xGLEkdgOAZsmDmee9q3UELAe:RHvTSjI8gRc75OADLAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900847, "uuid": "2d373ff9-7e3d-4796-a3ce-fe53cfbc5543", "value": 39340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900847, "uuid": "fdeae768-302a-4d8f-9369-7374803b612b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900847, "uuid": "c34350e7-c018-4f5e-8098-e743951dd040", "value": "miron.armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ae02c4-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920214, "uuid": "46e31451-0ac4-4e4d-a3c2-ece10411e556", "comment": "Malware payload (Mirai)", "value": "a7eecd8490931d8795320b12a08f92d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920214, "uuid": "37e75ced-6ea7-4b17-9e77-9422bdb378fb", "comment": "Malware payload (Mirai)", "value": "e8353b0438f14cdf38feeca4ec9ccbfde355173a0b5cf608e85a56b1f52e2ddd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920214, "uuid": "fc4fafbf-efe7-41df-8ed7-e5dc8bb15234", "comment": "Malware payload (Mirai)", "value": "ed422671250e61dae5dd2dd2a3cbcb8b52208514", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920214, "uuid": "782a871b-ca66-4198-bd9b-755cde954c8c", "comment": "Malware payload (Mirai)", "value": "d510a584dbc4e847117a7e788120d5efed6c39ca45324cb0a1e27d2e0eb928ebcc49537b88d0a049d5a43590dbecd7e6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920214, "uuid": "e516321b-e82c-4190-ad69-35eb8ab89686", "value": "T13B04F101FF081867C4D35DB55EBB1B6AA7390A1604BAE6086B19FFC21A3367D4B873D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920214, "uuid": "d752943c-df54-472d-8bc0-8c85c2bcab42", "value": "3072:ozdurayQy5HEcMf3o89uafmD3RTJcomNn1LKg6Th7J:ozdurafekcMw0uMAcomNxKg6lt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920214, "uuid": "77ab7574-ffe4-48ec-96b6-41709c56e5d5", "value": 186166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920214, "uuid": "23fc7d57-32d7-4f1c-88e2-5d47d5c69597", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920214, "uuid": "15800c3f-f3a6-45e7-a683-1e26fc2516db", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "821b22ac-999e-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786904149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786904149, "uuid": "e783c68f-2ed3-490f-aac0-814e0973eee9", "comment": "Malware payload", "value": "8b0a5115d72cdd178563b7b2bbd31d74", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786904149, "uuid": "405eab48-a1dd-4124-9ff7-2ea9f7ee9941", "comment": "Malware payload", "value": "e86d16a6a148b7985f653627275550523b578305b6eeb12c8989d0b14fe2aea3", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786904149, "uuid": "72e9546e-aa0c-4f7e-94d6-670a3335f225", "comment": "Malware payload", "value": "9944e2d88133db642c025870cf5bb013d683595e", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786904149, "uuid": "aed602b1-1e22-463c-9d8d-d652c73ddd89", "comment": "Malware payload", "value": "d07933a122fcd0bd023ea365e0532a9a89c1dca519ab148882f06f4990093f38824ad952e06677d6771d0c7757a3b944", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786904149, "uuid": "eca20bc5-2621-4b23-8a86-83d1a8fd3069", "value": "T1FF762803EC5515E9C1AD923189A39253BF717C891B3263D72BA0F6342F76BD0AEB9350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786904149, "uuid": "233981c7-2210-4ce6-b460-d262b95064d5", "value": "ed8b780a3ce7ca4aba78a21f6bc3d4e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786904149, "uuid": "22d2fe55-52f4-492a-924e-8cc08af4a1f5", "value": "49152:IQ/pq2VLzqHGyVf05EKUzYO9+JI/414sCbhtI7p6lpuo5I5uOVVN49Uy50KQK1KH:IQhtVBTyIN4QxTY7W2EP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786904149, "uuid": "01c44f8b-69cc-4ddd-9f6e-ecc8e8601bbd", "value": 7390720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786904149, "uuid": "867a3496-ffd8-4399-860d-9fbfe6f3b5d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786904149, "uuid": "a5ee2223-0655-49ad-bd0b-0a239a78db8e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c20132c6-9915-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786845415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845415, "uuid": "b8f126f8-4ffa-421d-af7b-2469a37a5edf", "comment": "Malware payload", "value": "0b11e8d1afe0fe766c3e67e3379bd7ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845415, "uuid": "2cb23685-771f-4dac-ad95-421c00aa55a6", "comment": "Malware payload", "value": "e89c6c8b23135345834621ae2d7ac0b8e29757219d08fcc9f4e47ded0b91c3e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845415, "uuid": "920b8b2a-d94c-4e29-8dbb-c3ccb0e2adbb", "comment": "Malware payload", "value": "4707928c5aefbc45a2d5bb7c0c2ec2dd9d12b3ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786845415, "uuid": "027b5e7f-daa4-4c54-8df3-1cb20cb54d7a", "comment": "Malware payload", "value": "c32bc69320cf606a0e3dbe00e26517530a05a4a980009f123b911462c665331b844c519f1788e0e08e1ef9d759f80a66", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "windowsof-com", "colour": "#EEE832", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845415, "uuid": "a145e033-db32-4a41-9db3-fa11105ecf97", "value": "T157B539076D5081B6D4AAA73694B752A1BB31BC5CCB3233D32FA1A6743F723D25876B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845415, "uuid": "0cdc6b06-dff8-430f-a8cd-5470dec5c39c", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845415, "uuid": "25d9fb20-7379-4537-92c3-7fb9a73f3244", "value": "24576:kjPBOdGfXaId994bBSb28OMw9rkeBgaxJSd1UOL2D0CxJgPfJgXhwULD:Y5OdGfXzdv4b0z2D0fJNi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786845415, "uuid": "79170a10-3c7c-4763-b258-f34d5a913361", "value": 2301464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786845415, "uuid": "58708c32-f2f3-4af6-9e73-e59abadb311f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786845415, "uuid": "00db0e65-62ec-454d-8100-d65798721c15", "value": "Download_Movie_Maker_2.6_For_Windows_7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac434163-99aa-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786909373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909373, "uuid": "edb5e4d1-cb4b-4f96-b5ee-c8ae0ae2c08b", "comment": "Malware payload", "value": "b3c1a5cfae45e992817f1383471e1083", "object_relation": "md5", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909373, "uuid": "3c80045b-e8b8-4126-b3e3-3ab292048892", "comment": "Malware payload", "value": "e8b52a16883f144fd6c5961ba1b7bf41ec1a4d352c4d4c8e0b9f4695aa9af54d", "object_relation": "sha256", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909373, "uuid": "8baceb65-fae6-43a0-b16e-fe2c1ab49c26", "comment": "Malware payload", "value": "ced50a6cded340cf5f4c53728da224a36498cb1d", "object_relation": "sha1", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909373, "uuid": "13d11eb6-aa4a-4c49-9659-e3dfc5f21b06", "comment": "Malware payload", "value": "de63aceebbcb52e265864e1498c8eef606e1a1e3d53f27505e6c20e9102f9abccb70fc3ecd6f1acce73528067c547a3f", "object_relation": "sha3-384", "Tag": [ { "name": "c", "colour": "#6BCAA6", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MIX5.file", "colour": "#573901", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909373, "uuid": "4cd6da5d-4940-41a4-8378-0807a1333639", "value": "T1B8771256E2FD00E8D5BAC0BCC6575517EBB23459173097EB52A48A692F33BE0AE3D310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909373, "uuid": "998dee11-a0c0-4be8-8e91-dfeb3572d613", "value": "70d2e884fa127843c5bcbb53da86b6c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909373, "uuid": "e6c0977b-518f-4ba0-898f-5340532247cc", "value": "786432:+uMLbIXoeOvHiwB3sn+h1hW25F+wX0ff6yajCs6+4S3Nftc:+5ioeeCwDrhWG+tf6fj4ulc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909373, "uuid": "93039e26-4870-4d77-8d0a-b3107fd9fb74", "value": 35533268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909373, "uuid": "991bd677-223c-450c-a18f-955d210d9596", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909373, "uuid": "8e213929-7b51-48a2-b188-b2bd43879816", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed50bad0-99b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786913777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913777, "uuid": "e4401f34-6a22-4175-963c-1e52b4deb297", "comment": "Malware payload (Mirai)", "value": "27c1dc5bac07bb33d508318464d3fd5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913777, "uuid": "5c2ed2cc-e7a9-4987-ac4e-3d6e3de13f26", "comment": "Malware payload (Mirai)", "value": "e8e3c86f618c9b3b21f2243d9488a087b5a4ee1cc8c3d71429b7f5ee74dc02fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913777, "uuid": "c4753319-65a6-46b1-bc55-620a8e62b547", "comment": "Malware payload (Mirai)", "value": "cd230fece77eac3be7feed05a34c5eb66db33ded", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913777, "uuid": "cbd8c67c-aafd-4827-9a8d-2ef42aad1247", "comment": "Malware payload (Mirai)", "value": "b37417e1a819434e169eb009cad3133b2ada5a32556176d8d36cd533144c7c382d1e80e7e4c8f24607e91364ded49c22", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786913777, "uuid": "d8bafb1b-90dd-4cf0-8215-e6c71e0d625f", "value": "T1A7530291504442FC8220723C59ADD68775EB7FBCDBF76976D232E22692E5482EF3060B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786913777, "uuid": "98771360-f987-4fa6-b4d0-7f7705e5b96c", "value": "1536:i7St8UXcX55A5nSDp523q0RmKGQpk+akqOLfN0NAlKFXiihKpz2:iO8jXDAq+GQp1J1KyihGK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786913777, "uuid": "727945b2-df4b-47a1-9efc-dbf7591ee565", "value": 64044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786913777, "uuid": "28c82119-e282-4c08-ac91-7392dad77c01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786913777, "uuid": "cc393443-f348-49e5-af02-1135b224cc6c", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf0f871-999a-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786902259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902259, "uuid": "14522300-4980-41eb-8314-6b9e247a7501", "comment": "Malware payload (Vidar)", "value": "07d471e92a65437e8c894ea5d0b80d05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902259, "uuid": "caca8eee-2149-4c2f-845e-4d8dd0a734b2", "comment": "Malware payload (Vidar)", "value": "e9bd3ee12eaf2a5734e7ec15cd81a37a49828a846f1db39dd9787296892f8cae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902259, "uuid": "60675e7f-d7d2-48d3-b6da-ec3150462124", "comment": "Malware payload (Vidar)", "value": "16da6c921a59eabd851fb0b51f5b6b720c62b4f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786902259, "uuid": "4a50e0a8-8712-430f-b358-7d85c2ef0afa", "comment": "Malware payload (Vidar)", "value": "ef7e35a8e1d2a6a0b7ed65e5471a6ec6ec4d5436f5156f36a93530daab8d82be59260103fafe689c63b324a6235dd5ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902259, "uuid": "01714ea1-24da-4f41-afef-295d2eabebb3", "value": "T12C168C07BD914CB5C49AA2328CB65242377CB88A5B3633D32E51BBBA3E723D15D79704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902259, "uuid": "f485891d-a8e4-41fa-befd-2a1d5477fe62", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902259, "uuid": "3d97cf73-b554-4c95-92aa-86e81ad238fd", "value": "49152:1hJCxSNd5Rtix+J+pn1p067DtcpYKdnONKyQrtyDwXEH1whl7m7u:1hszasF7EtOUy00HuW7u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786902259, "uuid": "68d673f7-748d-43c1-bc29-a22a91de6fe1", "value": 4342032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786902259, "uuid": "cd637212-11b3-49bc-a20c-6fff14970541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786902259, "uuid": "54fad2b0-aaf1-4d25-b7b1-e21f03d51d73", "value": "e9bd3ee12eaf2a5734e7ec15cd81a37a49828a846f1db39dd9787296892f8cae.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33053a4c-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901439, "uuid": "f0c54219-a523-4615-8481-6498be4a1cdf", "comment": "Malware payload (Mirai)", "value": "566f92a54330ccda16c05cc9a09794d8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901439, "uuid": "3bbf7760-1d73-438c-a275-c84be8bee33b", "comment": "Malware payload (Mirai)", "value": "ea12483a63740d36605fd21c42ce7aae67b19c90e4fcfbf7ecea9f36492be5ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901439, "uuid": "fb07f1d3-f011-47c9-97ab-77641f63aed9", "comment": "Malware payload (Mirai)", "value": "8816aef5a1d625210c1b8f1c6a453c2f48bd34fb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901439, "uuid": "075d4030-e4eb-46e2-9ece-6a13d55c7f6d", "comment": "Malware payload (Mirai)", "value": "dabacdabe0f1cd893789be4c6d854672ecd4c51795c3d04d26f5b9a9b00384f2fe425f9bbe5761b1a423d9c7b3eb0515", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901439, "uuid": "615cdecf-c38c-4cfb-8109-8688ed24be30", "value": "T1023184E4B3616E713D4E8F2CBE6411E946872D95A49F34E8D4C39DC4289E21CBA19A32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901439, "uuid": "3ee950c5-f219-4b3a-90a6-0b56bdefc227", "value": "48:6Wdx+pxCSxCLpxvWRx6IxGDxuixsUxuHxYzFxcQxyAx9M:r+rCkCLruD6CG9u0seuRYzXcayeM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901439, "uuid": "417a824f-41b8-4ca7-abab-708a715dca7f", "value": 1817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901439, "uuid": "4dde7a78-c82f-4098-a954-63327eec6241", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901439, "uuid": "e31f825a-fe9f-4104-87e8-27c808214a52", "value": "w.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b48d16b-99b0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786911761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911761, "uuid": "ecf9d5f8-1d14-410b-ba78-1907bc42c8cc", "comment": "Malware payload (Mirai)", "value": "d90399b3ef5bd38fdff0823861d72ba5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911761, "uuid": "b8cd771b-9d08-4e0b-a333-75ee6735c7fa", "comment": "Malware payload (Mirai)", "value": "ea9e18bb2004bc64a57dba5e810d9592ca35bc5a29ed3913442dba79044c433f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911761, "uuid": "188a2209-e5c5-411b-8ea6-56ee64c740c8", "comment": "Malware payload (Mirai)", "value": "3c9c33ec0e1576eef3a092eb9330aab78848b5dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911761, "uuid": "55f9861b-2ece-43cd-8312-9c925067cce8", "comment": "Malware payload (Mirai)", "value": "a84542006c400afdd5966b43a160f71dcacb3d77b4d0dfdf55dd76af219c2307876f6ed21042e51f37aceb806896be0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911761, "uuid": "5c30010c-31e7-4fce-96de-5760cb498264", "value": "T1F9C33C99FC90DE12C6D52636F95E428C332357B8C3DA7206CD249F34B7E795A0E3A942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911761, "uuid": "2c6f093d-cc34-490c-840b-88dfa0efcf1c", "value": "3072:NJDArV8pyX0M1FzoMitH1RUQ4g8OFCVeU/0/AAVpHNsCQf1Dl4:NJSbFw1RUQ4g8OgVeUOVpHnQ95", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911761, "uuid": "0c9b96bf-edb7-42f9-86ee-b92f98195208", "value": 120276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911761, "uuid": "fbb27cb2-5e6b-4172-8c07-4ec27535ace6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911761, "uuid": "a4540dd2-3655-4013-80c8-9a2dc1e17133", "value": "putita.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e49db80-99b4-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786913484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913484, "uuid": "85652d65-7547-4b82-8740-f0344ea1483e", "comment": "Malware payload (Vidar)", "value": "784d33db0d801a184647030b89cd31bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913484, "uuid": "1d345615-cfa9-4381-9295-531dd53fe026", "comment": "Malware payload (Vidar)", "value": "ead799be2622dc833d3b851c6abb6b5fb7b13d0399aa6cdb87354a4ec134e5a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913484, "uuid": "334bd042-562e-4f61-9dfe-7aa4e5c7e657", "comment": "Malware payload (Vidar)", "value": "5636580037f8323417adeee3021541be27a0bf03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786913484, "uuid": "717bda49-3f9d-4ba2-a287-c48842678f1e", "comment": "Malware payload (Vidar)", "value": "3b64612d9d46ba0adff899cb6313d258a5a6f7387d21d573b62777aba210f38ba9b913e289991e695abf856c29d9dea6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786913484, "uuid": "60a2d34d-2475-4aee-bb11-34ab9d576ab4", "value": "T1F8F58C077CA149F9C0AA973189B712A27B75BC094B3277D72E60B6383E727C1AC75B44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786913484, "uuid": "860b081f-a28b-4a89-974d-da597a994542", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786913484, "uuid": "bbd8cd98-1e4c-48b0-abf6-3450782023fe", "value": "49152:L1gnr7TPujd2Ju10zTdUXiM/hum9p/1We0sm4eMtGU:L1+rwSCSM/f7M4lUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786913484, "uuid": "aa17fd92-8975-4272-87be-1238cf7941b3", "value": 3374416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786913484, "uuid": "c08b8981-c051-44f7-9002-e30800dee7b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786913484, "uuid": "8c9f9f98-7144-4591-93de-45f018939372", "value": "ead799be2622dc833d3b851c6abb6b5fb7b13d0399aa6cdb87354a4ec134e5a0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d213fe-998b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786896013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896013, "uuid": "68a9c361-46d8-490a-b47b-d7252492b3c5", "comment": "Malware payload", "value": "93bbe4f469d008520f6919162dc13c56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896013, "uuid": "54fe4e9e-baf2-42a9-9a39-6d127c27bb0e", "comment": "Malware payload", "value": "eadfacfabe8f284811d6fa90fb7e293666e3bbf3b15ebdec3dfafcae907f89fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896013, "uuid": "0d512977-b774-4322-9da2-35c7375df12c", "comment": "Malware payload", "value": "5f92afda06b82c03d449302b43d821befec8e78e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786896013, "uuid": "03f5dfb4-761b-4d1f-80fa-49364f07948a", "comment": "Malware payload", "value": "35b69e5e7e97989d7d94ab13ee713c0fbe259247fac769198b459ee314cb3dc81d39d24277f582127730049f0e3ea4a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896013, "uuid": "a491be6c-ba11-40d3-991b-7e63d775e833", "value": "T192D522A5FCF21B70E033C7B78293B19EB06D378186648C5736C96B145E639A86C79339", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896013, "uuid": "247f0c1d-4d9d-4c75-9833-3de1fc3d699c", "value": "1799eb3c1092391ae174afa4eee4cba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896013, "uuid": "c3128d9b-2f1c-4b6c-b644-335cc774f786", "value": "49152:+pFBKA3Le4v+Yn+MJyaOAg7ts0AVL/DEZ2jORVQQnQIIMzGmgESpO1eigB:M9vt+MJyaUtshVLYsjO79IMzGrg1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786896013, "uuid": "c4b35be5-0e8e-4b9d-9bae-30bd7a9a9410", "value": 2964992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786896013, "uuid": "a42bc93f-66cf-4e9d-8663-931dc80b570b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786896013, "uuid": "658882ac-f3bd-460b-9c09-cafa1159cbcd", "value": "eadfacfabe8f284811d6fa90fb7e293666e3bbf3b15ebdec3dfafcae907f89fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23c40b8e-9945-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786865765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865765, "uuid": "3ca57311-1645-44b7-bd50-351284d1ccdc", "comment": "Malware payload", "value": "814bc0d3ba70d8bd8151ac2e980bc499", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Poison", "colour": "#A57E37", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865765, "uuid": "c906b04f-17c9-4ce5-8599-ec6dc17cad50", "comment": "Malware payload", "value": "eb08773feb11c93dd434ea098159c24820579a21021d019d89bc980c99c51e5c", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Poison", "colour": "#A57E37", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865765, "uuid": "c9ca23eb-a932-47f2-9c42-91f777a25d20", "comment": "Malware payload", "value": "00431afba133cc961ce5760e806a115efe8e02c3", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Poison", "colour": "#A57E37", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786865765, "uuid": "c2062397-8d46-4ad9-b64e-9b0607c48502", "comment": "Malware payload", "value": "6e150a8bbeb1a94bc902d16bac35d1f54898701364ac0aa1605941f5a2765238110db877cb1d5d20643ff7b7b07055f1", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "injector", "colour": "#F39A69", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Poison", "colour": "#A57E37", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865765, "uuid": "2430dbc1-f401-463a-849d-2b7886df371d", "value": "T1286733A233AD65A9B7C093370C15715D819FB597EC28D99417EA1383CA6C023E4F72AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865765, "uuid": "1977ed1c-c83e-4f23-aee8-775d0ed5bc90", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865765, "uuid": "c8cea76c-4232-46f5-b33d-6105978432b2", "value": "786432:8VGr51Q3O0a5kRKIq7OJXu/KTA20P3ixkoPdgX:uGI3naOAGq20axdlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786865765, "uuid": "ced80d7b-3c4e-4256-9864-aac18e839dab", "value": 31036416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786865765, "uuid": "eb4e5257-2be0-446e-84ec-2ab740e3aaf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786865765, "uuid": "64eff14e-38c9-41ea-881e-89e69a3498ab", "value": "NerestCrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73771ce9-99b0-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786911855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911855, "uuid": "4f6031f3-6a89-43f9-bbf3-0b8acc71c5aa", "comment": "Malware payload (Mirai)", "value": "9823e935a8e876d51c23c2fa1fb0cb68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911855, "uuid": "a0742005-cd99-4371-b07f-ee24a05112bf", "comment": "Malware payload (Mirai)", "value": "eb3360040c576834ebd59f66b794a95d8a29a26ae403fec281a95499301cbf81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911855, "uuid": "61330dd3-9877-4a8f-9352-2ded2b23ed80", "comment": "Malware payload (Mirai)", "value": "48a423e8cc1d81774e5a5d8e767faf547a23f6b7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786911855, "uuid": "65a9d520-11f1-49ad-8cdf-3ab16b3ca9b6", "comment": "Malware payload (Mirai)", "value": "7438acca8bae0f1d93623844a83c9d88b94cf500f87a9944b5afdb383fdfc628e0f223f675be31875ba6990d9a25b66b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911855, "uuid": "5ff3896c-1640-4220-be7f-a6192d51a71c", "value": "T12153022E878D5ECAEAA1E1BE5CFCE2DD05D732FE7224CCC543C25B005299E5466584CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911855, "uuid": "f3573aaa-fe3f-441e-8550-afa79be17b63", "value": "1536:4iZf1Ru3FAlspY65lB5yrrYzXB01gEhxhMQVKTciGT0WHLop4u+qgw0rb:4me3FmGxyHYzXrE57KXQK4u+qgw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786911855, "uuid": "30660c3a-e6f3-4aa2-9416-d4377c532155", "value": 64388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786911855, "uuid": "72527369-e7da-44ff-a202-870fe5a5fafd", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786911855, "uuid": "9013430c-6e86-41a2-a4fa-3da841355df8", "value": "putita.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002b31d4-9978-11f1-bd95-42010a9c0009", "comment": "Malware payload (QuasarRAT)", "timestamp": 1786887610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786887610, "uuid": "15a29eb7-3135-4177-bbe4-10e0d16ae51e", "comment": "Malware payload (QuasarRAT)", "value": "1cc72f0e339f0b0e604c6ca8bc879085", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786887610, "uuid": "2cc45612-d61a-4579-a62e-b6dbdbcf0e05", "comment": "Malware payload (QuasarRAT)", "value": "ececcb435fbbc457e047b8fd9301430158883837894cff1e843b1a375307318b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786887610, "uuid": "e2023688-c72a-430b-b0cd-26f6c09c54c2", "comment": "Malware payload (QuasarRAT)", "value": "eb985a8d61bbf41219337af58a0b78edfff9b633", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786887610, "uuid": "5f5fb581-bd49-4ffd-a406-64d6b4f1446d", "comment": "Malware payload (QuasarRAT)", "value": "885a528b170d15a380177c403a412035e00b911d72b9c83aed9fb51901940193e20ce7170e2c1b3f233d9f5ad106c351", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786887610, "uuid": "16f277df-c7cb-480e-b02b-db631c11ca40", "value": "T17EE54A1437F85E23E1ABE373D5B0041767F1F82AB3A3EB0B6191677A5C53B504842AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786887610, "uuid": "735a0e4a-bfc4-4310-9dd9-9caebfa031ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786887610, "uuid": "ffe9a017-fdf2-4419-959f-45de3499c34e", "value": "49152:evht62XlaSFNWPjljiFa2RoUYIgKm3/ar7DoGdCVTHHB72eh2NT:evL62XlaSFNWPjljiFXRoUYIU3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786887610, "uuid": "05c79191-35d6-4045-8884-8a0a2068704e", "value": 3265536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786887610, "uuid": "23f520bd-1d88-41b0-88e9-77e8555adde5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786887610, "uuid": "3219de6d-b607-42e6-8506-b558e5d09a3e", "value": "1cc72f0e339f0b0e604c6ca8bc879085.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bd413e-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920207, "uuid": "b9ba77a7-02e9-4b7d-ad23-643e420a0c39", "comment": "Malware payload (Mirai)", "value": "32a56f0a9649ad6ff4d984cf9b31b59c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920207, "uuid": "e88577c9-f78f-4a09-8a46-40f7af01462b", "comment": "Malware payload (Mirai)", "value": "ed2add9aaf0b3b354331bb952975c5648f185b88743ca5c1af943c7675159695", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920207, "uuid": "12b748ef-3e73-4dc0-bf45-518a3ad11888", "comment": "Malware payload (Mirai)", "value": "02a06cf466717d9c0a8cb3bd27b0ea6921894366", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920207, "uuid": "1bbfec86-6e9f-42f7-aaa9-97ea125309b1", "comment": "Malware payload (Mirai)", "value": "31b64df157c5ad113f623999ff7bf311117ed7088e5e6227041c988c303638a0fdaf27cf8050685c056caeb9c5792d70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920207, "uuid": "f7ce9ee6-27a1-479a-85d8-952aceab5137", "value": "T12CB3F1836180707AD0BBC2B58FAFE617EB76B5842618379A5B04F6722F03F512739356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920207, "uuid": "9bd21016-7482-47fd-91de-505a1925f056", "value": "3072:Nov4QV8UY5MIo4Z4QjD79HLS/+b3D/NG3Hs:Nov3OUYDoQ17lemrA3Hs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920207, "uuid": "4d3446a9-c9b9-4c4d-b0b3-5c11e6673d3a", "value": 115446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920207, "uuid": "cb847c63-5b9d-4c3e-9fcb-75f39a9e5ae0", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920207, "uuid": "199c814c-f5b5-4a0f-971b-06911f4d8912", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25387822-995e-11f1-bd95-42010a9c0009", "comment": "Malware payload (AgentTesla)", "timestamp": 1786876505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786876505, "uuid": "86c0e8e6-5113-40f7-ab5c-8a65f4a9d528", "comment": "Malware payload (AgentTesla)", "value": "dca6afeddc135645ec068160a47c9510", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786876505, "uuid": "6dd56d48-0bdb-48c4-a7dc-74faf7d7a51f", "comment": "Malware payload (AgentTesla)", "value": "edc4460d3dd2fc1fcae6c617c8d2728ce311e8cd47f2d6a37d719b924c2ac868", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786876505, "uuid": "620e153d-8b35-4bdc-9523-340e7ad3fbc2", "comment": "Malware payload (AgentTesla)", "value": "54c5c2659e3af3aca44fa046fb366cd32f5ed387", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786876505, "uuid": "0f08a497-7f4e-4590-934b-8c5e664fa82d", "comment": "Malware payload (AgentTesla)", "value": "6018b9d9ca2dbed389af17c9b5409d0a0d271faa2ff75eae263db01d45f01701b61c8a10d751045aa94ec3a9c2f7455e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786876505, "uuid": "0f0ce148-392f-48a5-aa69-df796763eb2f", "value": "T185668D2F611403ECC86DC63984CF2199F56035685338AFEFB2905B211FB6AE46FB9647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786876505, "uuid": "24cce4d8-b989-4416-a28f-27ed10115e16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786876505, "uuid": "899bdbb3-1934-4249-ae6e-ba24a08a39d5", "value": "98304:Fa7im/aOxHSGYKOKaPuWn0yMxnTq0dKtxaEe+5HX9iOEtYsJw:Fa7fauH/NOKaP30dlTps28XQD+si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786876505, "uuid": "c2d6bc9c-2907-4b97-85f5-2bdbde4ea122", "value": 6972928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786876505, "uuid": "3bff0caf-2f25-44e8-82ec-8db5484965c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786876505, "uuid": "099311ee-ad9f-477a-a6e7-12e1e4310026", "value": "edc4460d3dd2fc1fcae6c617c8d2728ce311e8cd47f2d6a37d719b924c2ac868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "021ccc6f-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786900498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900498, "uuid": "d6f69426-8346-4e40-91e3-ce98e9b1fc7d", "comment": "Malware payload", "value": "6d6454984415c7b5069a185153172443", "object_relation": "md5", "Tag": [ { "name": "aggressive", "colour": "#94504D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hulk", "colour": "#CD961F", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "InjectorNet", "colour": "#62EA5D", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Obfuscator", "colour": "#4DF2CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900498, "uuid": "45930f51-cf02-40df-8cd8-a0649ef1e59d", "comment": "Malware payload", "value": "ee0f9dfaaa11a770fa0543be2ebe9be3f6ab38c1bdd642d778c15b644a0b5278", "object_relation": "sha256", "Tag": [ { "name": "aggressive", "colour": "#94504D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hulk", "colour": "#CD961F", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "InjectorNet", "colour": "#62EA5D", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Obfuscator", "colour": "#4DF2CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900498, "uuid": "45449776-6ea9-44b4-8979-049d977d55c9", "comment": "Malware payload", "value": "ba68d0743688f080b888c53df2108687845b7d5f", "object_relation": "sha1", "Tag": [ { "name": "aggressive", "colour": "#94504D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hulk", "colour": "#CD961F", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "InjectorNet", "colour": "#62EA5D", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Obfuscator", "colour": "#4DF2CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900498, "uuid": "de647d73-3a6f-4f10-bb6b-e443a28d124c", "comment": "Malware payload", "value": "60f9a9a7f3994c75829fcf50b7a599830e8b0fc0d859d17ac3a531fc8e855d77bb5ab0f64db417b7e24aacc888e41e58", "object_relation": "sha3-384", "Tag": [ { "name": "aggressive", "colour": "#94504D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hulk", "colour": "#CD961F", "exportable": true, "hide_tag": false }, { "name": "Inject", "colour": "#1D21CD", "exportable": true, "hide_tag": false }, { "name": "InjectorNet", "colour": "#62EA5D", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "Obfuscator", "colour": "#4DF2CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900498, "uuid": "3aba8486-020e-4ece-a594-ab75e2d342be", "value": "T1CAF63318AB5071A5F8729270CEF7C5E1EB323807076095EF6BD46A5B1EB71D0DA27322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900498, "uuid": "c548f72d-1a03-47e4-80f3-52fa5c788a65", "value": "2057790ae7855765d51bdc4142e62f9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900498, "uuid": "fd9a5b1d-5356-4809-bb83-2a5c62fe977e", "value": "393216:jCE7fbkVf5xyPMJ3g/IOsL99FvZk0gOY2boRE2:lbkVTykg+HrgOY4Gr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900498, "uuid": "ead1df3e-0e00-49a9-bda2-2bda35355005", "value": 15524293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900498, "uuid": "b19cffa3-bc22-468b-a1c0-dbe853e13a4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900498, "uuid": "37ba1fc0-de02-4bc6-bfa3-2d56044738d4", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93fd2de-9960-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786877666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786877666, "uuid": "6fda8304-0bc8-45f4-8933-c30ffe6d70b9", "comment": "Malware payload", "value": "6ed9437e3d794d1231001a9e3721b49a", "object_relation": "md5", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786877666, "uuid": "5c4ae13e-836c-4a7b-bb1a-5d66749136f3", "comment": "Malware payload", "value": "ef51b0d8b0b27c00efea02e7fc789818094be9990911aedbd231df163a2cef2a", "object_relation": "sha256", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786877666, "uuid": "f8dd4968-eac4-4c52-a28c-bc419b3fb533", "comment": "Malware payload", "value": "88ee5620c424f2f2f0f2ddf9c7380e98072a3fc9", "object_relation": "sha1", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786877666, "uuid": "27eb1e82-54b3-493e-a22b-b9f1b2e991e3", "comment": "Malware payload", "value": "7b86b9a9649e7992c699b1a2f6da1c74f9163c6a9863188856e0e12b6108d9cde377888d83650ebc58a78ea67b315f32", "object_relation": "sha3-384", "Tag": [ { "name": "a", "colour": "#6A08FC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-gcleaner", "colour": "#0F0C07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PMIX0.file", "colour": "#C01A69", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786877666, "uuid": "f5c2c351-4515-4b7c-a82d-b84fd36d811e", "value": "T17AE5AD07BC9005BAC0AA633D85A65A5176B5FC088F3633DB7F10B6742F31BC56A39B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786877666, "uuid": "b79afd84-a5bf-4bd4-be3d-6428e3440855", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786877666, "uuid": "7f0e4450-9885-4431-8273-179625629734", "value": "49152:z1d5w/dg5DAnqCouaDIAyqroUDJrAbgUmWdIPm:95DAqAw3VFRBPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786877666, "uuid": "178e34c4-a75c-4f31-b7e5-ca7b3c19d9c0", "value": 3273744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786877666, "uuid": "d7e72306-d986-45fd-9d09-7ec44b84717e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786877666, "uuid": "dffaa0d7-7cbf-4a61-a8a2-fccdfc67b78f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12753bf0-9995-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786900096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900096, "uuid": "f59f225f-5fbc-4ee8-903e-cb2780ce5c02", "comment": "Malware payload (Vidar)", "value": "bcf0b4c77dfce58f8e560c87eca69759", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900096, "uuid": "e1a4f41b-6295-49af-bb3f-212081edc8b0", "comment": "Malware payload (Vidar)", "value": "efb464694383fd009379754fd41bdefe736ddf139327c1038d848c35b84547fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900096, "uuid": "d44c264e-02ef-4169-8937-881ac76d9bd4", "comment": "Malware payload (Vidar)", "value": "ce33f25a81157d22043d84be8a541ce8cbfd30a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900096, "uuid": "cd8696e8-24f8-4923-b158-a5330a3935ef", "comment": "Malware payload (Vidar)", "value": "09ded4ce60c720847acd9c131e51ca98283c07e292bb75903a197521a0bd7a1af7f8aca58b656a423cb293460f93247b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900096, "uuid": "133ceed0-7335-4423-9adc-dd9c1e78f118", "value": "T13D167D1BBE941AA8C0DED33199B6116A3A7CBC4E4F3363E72E5172762E327D04934B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900096, "uuid": "4bb3322e-b26d-4689-b8ac-f1082324f27f", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900096, "uuid": "3a076985-890c-488e-8983-eea27d39ee48", "value": "98304:tUPBWGkeljv7el4sdkm+Fu1ERs924nLgLE5IsfQEo1:tUJbv7elKJ4MwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900096, "uuid": "3554f837-84dc-4fec-abcc-960891b19d16", "value": 4405520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900096, "uuid": "1b750698-5e5d-4ccc-91f1-fd257b1b09e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900096, "uuid": "5194427c-a377-423b-8858-673273dec650", "value": "efb464694383fd009379754fd41bdefe736ddf139327c1038d848c35b84547fd.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2a892a-997b-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786889083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889083, "uuid": "6d46501f-3489-47f6-a1dd-f84dc728c962", "comment": "Malware payload (Mirai)", "value": "17b96d3ef4621697946a0da26226cc53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889083, "uuid": "22f69a2c-e954-4218-9623-21ca575cb7ee", "comment": "Malware payload (Mirai)", "value": "efe3c1b7669ac80e25d0faf8969281499371e6733da81f908c524eb63e031583", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889083, "uuid": "5fd3201e-254e-49ce-a2f1-f9087e62cb3c", "comment": "Malware payload (Mirai)", "value": "1cf010cfb8d148d80e5cb91d1e978809e30af07c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889083, "uuid": "77984bf0-0284-4bdf-a414-ef17c4f40e2d", "comment": "Malware payload (Mirai)", "value": "904c26d3084bc491b9ca7f6b465a6ed29ef5213ea3e5d71dceafc0564a509e8b59f6dfe2b1bbab0d9c9cc8131a662bff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889083, "uuid": "54531268-373f-4063-8d72-d04b5b375f25", "value": "T1F8631231B6109C3AFE317EBAF0088E63E1CDA3FDE8A7269A74990CF5E4D21506517395", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889083, "uuid": "42ef8857-1181-4caf-80b5-e067023183d3", "value": "1536:meQGkyeW3fMnTVVOHAszrcJSZCKI4czKCxMLe:mcOTLOHAmcJPKI4czKCxMLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786889083, "uuid": "0d8bf69b-3194-43a1-bdd6-d614166b9f74", "value": 67884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786889083, "uuid": "94796c49-5d0d-4d04-a4f9-a58c1136f55a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889083, "uuid": "12c4df2a-b421-49cb-80e4-8755e191a230", "value": "armv7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00cf2d91-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900925, "uuid": "67128fa9-b777-44bb-8eb5-7b67b9b98ae1", "comment": "Malware payload (Mirai)", "value": "b6e6de7d0f096296bed8a4ede422e042", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900925, "uuid": "5a814c84-8c4a-43bb-8a91-6430da97d2d1", "comment": "Malware payload (Mirai)", "value": "efebf14856d569d0d3eb294d8614cb63e1c51b70ceb0e139a86f4c68a604b1fa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900925, "uuid": "5fc59d76-fdb8-498c-aa38-ca08414efa9e", "comment": "Malware payload (Mirai)", "value": "e36b6e9c77d288b281f41af6743ea6521eb851c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900925, "uuid": "b33fe755-1860-4cb9-8c88-33746592d040", "comment": "Malware payload (Mirai)", "value": "ee441951cde7729cc8a9e2133287b9130dde22312e81907a74eb10adfcb88d3eabe107f36d61e9816d6d989f5ebadf4c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900925, "uuid": "91f84fd4-2cfd-48f6-afb6-b3e8a6bd46b5", "value": "T11804E81A9FA11FBBD8BFDD3302E9070539DC544B22A53B753674D928F50AA0B4AD3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900925, "uuid": "c389c455-7866-4161-974e-35edbd689bc5", "value": "3072:xjsgi03uc98saQ6Qs2NyH6LZSPpVCHjT:xjsgi03u+kQ66yaLMpo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900925, "uuid": "eaecea45-d6c9-40e0-8f40-71fd31b0e6aa", "value": 179056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900925, "uuid": "6fda38ea-7b50-4432-871c-b0551dcfb44c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900925, "uuid": "5b3573c6-9407-46ff-a7e0-5f6a30918919", "value": "miron.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a68f3a-9996-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786900772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900772, "uuid": "5dec902c-39b4-4e00-83f0-cf05c85dc449", "comment": "Malware payload (Mirai)", "value": "52368c6b4940c018fb26cd0b9d66a4ff", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900772, "uuid": "c7fe8d9c-e83c-4d90-8f11-76d089cfec19", "comment": "Malware payload (Mirai)", "value": "f020e5e9674b3170ffb1b4459c4aca7b958b65ca5a572fcfbf9b507acc69a1d5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900772, "uuid": "ad04d0c2-7721-418b-937d-0a09711b287d", "comment": "Malware payload (Mirai)", "value": "483eebf38cdbd0b3a1d8df44707fe6e9e5505b30", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786900772, "uuid": "3ddbc51b-1bcf-4152-b800-79509421f8b4", "comment": "Malware payload (Mirai)", "value": "0453b1fb53f8e52de6fcc95966ce544364801033f0b10978c2926a661cc4154af72682675a5c98d0449f3c89c5973b8b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900772, "uuid": "3152b391-1fb0-4358-b241-ae7eedf6cab1", "value": "T1F3E31A45FC509F26C6D622BBFF4E428D372A1768D3EE720389255F24378A95B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900772, "uuid": "d921638a-85a1-40b9-a69b-74e4317efaae", "value": "1536:yclHTSLO2Jfd0KxgkhyPvaonDIj7rfPEKEWADrkWTDL2gEfVOY8tWWxNCl9Nwyw9:LTr2JfdQIIBK7bVAsWD2H+YKmVRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786900772, "uuid": "2a361203-06f1-4719-a507-02a48179b0a5", "value": 154272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786900772, "uuid": "313c4253-43a8-4e39-9d3e-ac441db750da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786900772, "uuid": "93146419-a3c4-43a8-894e-df829ded8552", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a3c3b9-9965-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786879599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786879599, "uuid": "2adde876-30dc-4868-9620-9a1fb8910d1d", "comment": "Malware payload (Mirai)", "value": "c8848d8ad3cbb82c37f37c30d6416615", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786879599, "uuid": "6f47f8f2-4204-48c3-9b95-59cc847a827f", "comment": "Malware payload (Mirai)", "value": "f1426db66370ea778c97951adb19f328cfd79f4eec66307048b24b9a280581b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786879599, "uuid": "56e9a306-c74c-4285-8aa1-5629a2267c31", "comment": "Malware payload (Mirai)", "value": "e2604d0fd5d82eabb18fe27277e677bf954b174c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786879599, "uuid": "c21f5b1e-cfc8-4e05-b889-299b26334592", "comment": "Malware payload (Mirai)", "value": "d8d784c88c20dadcac946152345741c9d646a343da629db80241dcb37126ac3593bcd3f8faf621607432375454b52d43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786879599, "uuid": "c6d2a149-9072-4431-8038-a244063e8872", "value": "T103E4C70B6E228F7DF674873147F70A24ABAD33D617E1D581D1ADC1142F2128E592FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786879599, "uuid": "08db13ba-4b00-4afd-9eb8-bb32c057a734", "value": "6144:5HHIS7Tjc7ufMeBqjGR3ElVtN2bl0lfgCH1fVtbypM2RsrMkhLAFmuQIeJC4fQIG:xH6q/EjGvbljg+/MnXvsEw+qnOW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786879599, "uuid": "f4a4bfb5-f0ae-4ad3-b256-eecf2347b0e7", "value": 657428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786879599, "uuid": "663bacdf-7ce6-49cb-b71f-e281e86ebd7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786879599, "uuid": "2e3b0e60-0168-4315-968e-25b6cdfd34da", "value": "dc21415b728962e3cedec30adb95ce0c5f174663ed01e6bcb5b1901445ad4e34.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adfc48a4-9910-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786843234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843234, "uuid": "6911a880-e936-4047-a61f-a6e86efcad0c", "comment": "Malware payload", "value": "22626e54bb117db096409e662c477349", "object_relation": "md5", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843234, "uuid": "cb9a4618-fd5b-49c4-a124-eedbe06dff1a", "comment": "Malware payload", "value": "f1476ee614a2db779a721a7b19281c7e86248311119898d5cca2ea4f813c43a6", "object_relation": "sha256", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843234, "uuid": "6d86f2c0-0680-45f0-9e87-4e9ad94151fe", "comment": "Malware payload", "value": "242e3ff26bda3b4201c4d6c23f7b080df100536d", "object_relation": "sha1", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786843234, "uuid": "41159913-1304-43ed-ada2-154519721f15", "comment": "Malware payload", "value": "8cad67421ab604bd2c07fe1db530e5f7598cb33f2cdfe6b51dfe438cd734a4f2bde3835800d4a1e740d7da0c524c51b5", "object_relation": "sha3-384", "Tag": [ { "name": "AsgardProtector", "colour": "#D727A4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemusStealer", "colour": "#709A45", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843234, "uuid": "0526e283-3ac9-445d-a323-09780b06d7a8", "value": "T12085231526E280A5E06763718CFB8A270631BDB1DF6D8ADF35489A4F2E738C57636313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843234, "uuid": "3a0fd26e-117a-4dc9-8924-0b848778ddb2", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843234, "uuid": "35b89307-e84d-4edf-a157-08aa04fa9c2d", "value": "24576:4DcQEnrtL3oy0m0DPXqJsENV1mk1tQ1Fh+zUbqqg/+Kj5hXF3ez4lomSaFq48YYc:eNIdMDPg7RT1SszUOqg/+MyOnSG38YY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786843234, "uuid": "60f0ed07-ae3e-4ac3-ba2b-9baada140fd7", "value": 1749504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786843234, "uuid": "2d7cac9d-0484-462e-9e8d-0b2c211278b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786843234, "uuid": "2419dd4a-8a25-47da-b738-d7c2d3ed8272", "value": "dollar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b71bef-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920209, "uuid": "caf866d1-a8c5-42c5-b884-839688c81ad2", "comment": "Malware payload (Mirai)", "value": "57c420d3087f0d3cf9b0e376a4d2a2ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920209, "uuid": "4a6f113c-6049-48c9-a254-737726a5d3b2", "comment": "Malware payload (Mirai)", "value": "f1535de595a347a7d23b51a10cae0de73df37d8324a2200651ad36da8ff4d736", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920209, "uuid": "4a1dcbf6-7934-4069-8be4-f2d5c3016a3b", "comment": "Malware payload (Mirai)", "value": "5e65cbed57b00e330c9fb7e644038bec92486dc2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920209, "uuid": "d4b87d23-69f6-4deb-8a6c-e6b22495787b", "comment": "Malware payload (Mirai)", "value": "b483784d3cd16ab6ba683b557a1257415793f0eb17145f0e01ed56499c7975de8e05c4269a8c318863d91444f56a3f5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920209, "uuid": "3af0347a-3aac-49fd-a655-aa56d9857f19", "value": "T1DDC3019DEAD3E1F2F497463104ABDBABBB60BE059161C587D3847728F4B4B82040E66C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920209, "uuid": "1456d1cb-52ac-4985-8607-1bd0fc273fde", "value": "3072:qa3z5a9yc6Dek8iu/kIWrJbDFwr6oMwqUO5u5wo164wSfo:qqm10V8jMISzvXwqUm665Sfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920209, "uuid": "85a94501-ea93-449d-9433-815ede3a1ddd", "value": 127027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920209, "uuid": "998cf1f1-a661-4ad7-9782-75dc25506af6", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920209, "uuid": "deab3e99-2dc8-4430-94c5-3cb187ffd48b", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9a9db7-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920219, "uuid": "c483e3b4-ec3b-4f2a-bcca-52be06615440", "comment": "Malware payload (Mirai)", "value": "36ea7b979d6ce61e20d7533e1afbb5d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920219, "uuid": "46e9c535-fcc2-49c5-b2a8-7dfca4312cef", "comment": "Malware payload (Mirai)", "value": "f296e02a0dfe36bcd6170fb1840bbba13c8d4de61fa7140f228cc46e5c7c8287", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920219, "uuid": "01f4f364-39a4-480a-8abf-dd4f66822044", "comment": "Malware payload (Mirai)", "value": "d185750a75d53402400d773be3ed85e68bb1bbc3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920219, "uuid": "dd8347a1-b77b-4326-a0ee-86c3a93e40e1", "comment": "Malware payload (Mirai)", "value": "492e341b88b379e6641333a662ed7cc55f2513b7e3ea78ec6a36609c4d783a624a3bb98e6e6b8ab4eb6944d141931f34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920219, "uuid": "2c5ea56a-5551-47ba-90b5-1ad297908dd6", "value": "T184D3E128F490CB35C7D52B7EF69F15483313077593CE73068E20AF39639AA578E2A946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920219, "uuid": "0fe2024c-97ac-4833-a10a-da93f752ae8e", "value": "3072:7D0ownSrawBDN6BvJusmcLtdVTRnbI0kqT00Nj6WpLy2ECpAn:7xwSuwBDMvJQ6bVTdAw9NGWpLy2ECm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920219, "uuid": "4684c917-9f8b-4472-87cc-80e646dec174", "value": 142049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920219, "uuid": "7fd1802e-bbac-4741-ba0c-e4f636dc6f9f", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920219, "uuid": "56b5b97a-9318-4446-9cc1-eaf9c99c79bb", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b581fa04-997b-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786889203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889203, "uuid": "447c0091-dd08-4004-813c-45062ba8de52", "comment": "Malware payload", "value": "d8677b550a10f5b800e327c7b7041ae5", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889203, "uuid": "695b635c-9c66-45b1-bfd6-be9d85a707d5", "comment": "Malware payload", "value": "f2b7407364787ca98f50ee3b8ab3b25e88544bba416868ea5e32c0e72a6f387e", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889203, "uuid": "196fa6fc-35ba-4e0a-863b-e5f0543413b5", "comment": "Malware payload", "value": "e0c51752b5991f7b7c3c6e96750cf0afd6feb69b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889203, "uuid": "0bb36654-bd19-4e32-ace4-d8219501fb5c", "comment": "Malware payload", "value": "3a2dbe6271fb183514cf394a303f5a3a24cb513daf673da4e1c50d02d9623f2af3c2fe92962dd471650530a199218b3a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889203, "uuid": "83941b2e-bf92-481b-aff1-7b495a445d18", "value": "T12A236C6516857C14AA98C4375C7E2F0CBDAD43E6324492EE7FCB3CF28C4AA9D920875D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889203, "uuid": "262a36d7-4257-4baa-9214-567b2ecc48e1", "value": "768:Y9NyXsZztCX9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:YHusZJcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786889203, "uuid": "679ecb14-e8c0-4c62-8def-704afba50a2f", "value": 50067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786889203, "uuid": "5b832a55-ba45-4cbf-994e-d4568ac69ebe", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889203, "uuid": "0cacf62b-200d-446a-a955-af68c2ac8208", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8153488c-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901141, "uuid": "70583ff4-83c2-4204-b244-ada9511e0c6b", "comment": "Malware payload (Mirai)", "value": "45ad7f3dba266b4419bbc6b520c1f6ff", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901141, "uuid": "407b13ba-bc0f-4439-8d8c-bcb68b057a57", "comment": "Malware payload (Mirai)", "value": "f3d0782a39ee28ddb743a20695b14e8e8ab8801d95fdb534fdd2d87b2c8b202b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901141, "uuid": "d9c92395-2a35-45cb-af6b-249e656e0dba", "comment": "Malware payload (Mirai)", "value": "e0b046a34354247b8cb19d8bbcabec1294564b55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901141, "uuid": "fb23c11f-44b4-41a6-b177-e6b409d6d112", "comment": "Malware payload (Mirai)", "value": "613e8f76093b9959e886d07772ad10cba2be2421d3bcd95fa78b24e967e6709d1ad1c1ea065683be8ac3cf0f7b00b831", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901141, "uuid": "6c7c3db2-ba70-4537-bc8b-565e847b7040", "value": "T1EE8329C1FA8BC0F1D91B89304067F63FDB31E9295061D75DEF9A9E36DA33581A212389", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901141, "uuid": "a8d5f66d-d3a8-418f-9d63-e0b9e4267e7c", "value": "1536:/InlZzkj+0cO4xoPEw6HMAK0Ie80WJi+Kj/Osv4gv9l7ED:/IlySh9is7HMAZIzo+Kj/Oc4HD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901141, "uuid": "88162469-95bb-4c41-ae78-67394add28e0", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901141, "uuid": "08c506a9-55a2-4174-aec5-a5afeabaa35c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901141, "uuid": "571e498f-60bd-4ccc-838a-a2d36167c711", "value": "nz.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4281662d-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786901465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901465, "uuid": "2ae7648e-13f8-41a6-8684-32835c2b4bc7", "comment": "Malware payload (Vidar)", "value": "3cdfc01e9e60239ac1751624898e57d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901465, "uuid": "bc866b11-eb21-43de-bd1e-60e00f319b98", "comment": "Malware payload (Vidar)", "value": "f4152af65ff5dbc93552784bb6b7e2207c8f22ad7c66521c96d73b1818fb4a08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901465, "uuid": "6290ddc2-7d56-4a69-b0d0-bbc4880b1a16", "comment": "Malware payload (Vidar)", "value": "7eb26c92f82dd929768a355692bd8f9d07065827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901465, "uuid": "20638fc4-b2f2-4330-b3e0-860b2a92b701", "comment": "Malware payload (Vidar)", "value": "acc214cd6f478aac78a2545fa1dedb212d1b59dcfc6f06772b9c5d4a8df25b78612cd4d7a5dc31e4759d16479dd5eb4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901465, "uuid": "b65fda9f-6356-4290-a8a4-dd60f2e8bc12", "value": "T1E8F58D06BCA15DFBC0A9773195B26282BB25BC041B3A77D72E90B7382E367D05C39B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901465, "uuid": "6940c835-b5db-4ad1-b245-14ea95f2f2d0", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901465, "uuid": "33b4d655-901b-411f-837d-74d1199db62a", "value": "49152:u1RuxtOqg7TzKYOVR48Agr2d2SE728N7ldEOzG5yTUKhQ7S:u1WtDk/G2UF2e7ldPzpTBQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901465, "uuid": "012f53ce-74e9-4e85-8b5e-438dc6155ab5", "value": 3438592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901465, "uuid": "6b629cf6-51d5-4cd4-833e-56fbedb36ddf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901465, "uuid": "b7f2e495-666d-4788-9e25-52a93d84c57d", "value": "f4152af65ff5dbc93552784bb6b7e2207c8f22ad7c66521c96d73b1818fb4a08.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89b7105-9942-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786864780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786864780, "uuid": "314474af-65fa-4b13-b72e-f69d4c94b24c", "comment": "Malware payload", "value": "80a88507a40e8f47d1fddb2b03c54470", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786864780, "uuid": "52e8a613-7492-4ea4-9e44-1371263f69ac", "comment": "Malware payload", "value": "f42dccbace8956a71b0cd1635f72d137d6c200f31ffb0f8a705d2844a56e9e77", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786864780, "uuid": "6ad7bd71-822e-449c-833a-de46ba491e44", "comment": "Malware payload", "value": "9d6a2847c0dafa1d5b6d00c6b0bc716f32a4f0b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786864780, "uuid": "38d96ba8-eb6c-425d-9052-354fbf4923aa", "comment": "Malware payload", "value": "7764a30a90e9b2359c1a9b45e646da1aad75a80aee61440ac65b86716b2e11f25f31ac1ebd8067bfae5d5aec553aee91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Psw", "colour": "#7ADB48", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786864780, "uuid": "949731b1-005e-444d-b392-5228abd556b1", "value": "T174143907EE8661ECD47BD57456AA9233B5727C41C7216AEF07A0EA352E31FC0B639B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786864780, "uuid": "4a323b37-8e2a-4dce-94ab-64c3bf391aff", "value": "1c23f4b23223bc7029e93c1f7a85c67f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786864780, "uuid": "af8a33e3-738f-4887-8577-01026f573cc4", "value": "6144:Eq79h6/aWIKRkM2jL7rEnNdEtGZt/7cuzy:l7z6/wKRk1qNdEs7py", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786864780, "uuid": "eb6335be-d391-4b34-bf3e-446e15ee1d36", "value": 201728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786864780, "uuid": "7f543deb-4970-4c1b-86ce-20789f9da0d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786864780, "uuid": "cea00c0a-81ec-4e94-83e4-ff0a4c6dd2e0", "value": "cdns-filter.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d72894-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901008, "uuid": "3e94064c-afb8-4ccb-ba93-a0ade0587ae1", "comment": "Malware payload (Mirai)", "value": "d247e05eca9386a2882a7bcacc1265ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901008, "uuid": "ce121383-59bd-4157-b2ef-dcf53a7586a5", "comment": "Malware payload (Mirai)", "value": "f46e36db293f62f037e5442b11868018c2d82ee028b8c8b63cbf4bcad977fea3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901008, "uuid": "c5d733b7-5e0c-4be7-96c2-b64ca9b965cc", "comment": "Malware payload (Mirai)", "value": "03b8200afcdf1daee8e0ce0cb7b74b5f3f2d7b63", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901008, "uuid": "a4a867ae-2467-496d-a4f3-ae984540fbf4", "comment": "Malware payload (Mirai)", "value": "0619b8d26aee7413cb10700058a33eee16ff9584e84af718722669f146546e2abbcbee84ac3a35639ae0feeebfccde1a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901008, "uuid": "c68d10ae-94ef-4a72-839c-38410ae65748", "value": "T19D13F176F5AB9B88F58ED03E88CE700D0806EF49A70A1D6A5ED597B1DC54B34B40CBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901008, "uuid": "1e0055e5-4689-4ac5-ae86-77e87817f321", "value": "768:vNxWle2mmbYB2Bue7CP0XsjAzhF5WoQcKZjlep8TnbcuyD7UHQRjm:leeGUhP0Xsm3pQcKlTnouy8HyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901008, "uuid": "b85864b0-2b0d-47e6-b08c-c320359035b9", "value": 41832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901008, "uuid": "c3971f64-af17-43b5-aff0-6938a01ad6a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901008, "uuid": "c5c47343-047d-46d4-a763-4a99a60eb24f", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75a80d25-996e-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1786883512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786883512, "uuid": "46544ff3-1544-4a8d-a88f-cbdc8e6864ca", "comment": "Malware payload (RustyStealer)", "value": "0008d8b7ceb7b1cd9fa3cd596fe8ab3b", "object_relation": "md5", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786883512, "uuid": "dc33aae2-3140-43ee-a50a-0dcd699919df", "comment": "Malware payload (RustyStealer)", "value": "f480f04bac2f0438424e1f3386812680488ddfa009fb98b0ec8cb647e292f09d", "object_relation": "sha256", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786883512, "uuid": "697df9bb-e9c2-439e-82d7-37a94a27b325", "comment": "Malware payload (RustyStealer)", "value": "c4976287d062159050b2dbad9e2268c538386690", "object_relation": "sha1", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786883512, "uuid": "fa54da30-8830-42ff-8abe-029df00e4655", "comment": "Malware payload (RustyStealer)", "value": "d9eeaa8f5bf0da13330d44e58150caf3f77823b10a6fb66c5c4d17a63e39ceab2ca7cc6a9c627b2bb37c911b36cbdcab", "object_relation": "sha3-384", "Tag": [ { "name": "54e64e", "colour": "#4FAAEC", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786883512, "uuid": "4966af7a-59a2-42b6-ba2e-b3afd3e8a674", "value": "T123564B55BA6B94ACD197C47483468A639E2130DF0B36BAFF418485383F6ABF11B3D724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786883512, "uuid": "4e7b001d-43b3-4753-85dd-b63bcb25975e", "value": "736029744d6e019a39ea152cdcd00c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786883512, "uuid": "171fcd1b-77b5-4ad1-be67-d700ed001cae", "value": "49152:m0iEPoOCAqwy12sMy5j9XQ2thQy/Z0ymc4ggu6a0WaBUFqxPvMNsg6/bHLDM/DHx:y7/7xxtx0JFxUscR5vmEqkbeeoIgOQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786883512, "uuid": "86688fc3-de69-47e4-b7ce-01e21549ebfa", "value": 6115840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786883512, "uuid": "ee52ad18-27a6-4b99-abac-2d436771a976", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786883512, "uuid": "744379a6-13c6-4117-b24a-b0d7d1e987fa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ee7bd0-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786920203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920203, "uuid": "907b54e9-bfa9-46af-889e-178787f3ede2", "comment": "Malware payload", "value": "fb36915b5170d0f1f48e6b55cd0ca70d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920203, "uuid": "c1b8d0f7-90a8-4bfa-b606-1c0b35e00409", "comment": "Malware payload", "value": "f555bb5cd1f6e651339cc5f408c12c20ce441eb5640b37aef8b46a891c8d8835", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920203, "uuid": "5a2b04db-cd26-495b-aa64-a075ca13d8c9", "comment": "Malware payload", "value": "f2c3b87a8560107171fcd0d087a9e9a40f254f54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920203, "uuid": "edf6280a-3411-4da5-ba3c-a043bdf7f154", "comment": "Malware payload", "value": "d21d563d906059254fe58d436a023617635c7b71076d6cef97908e63b58ca344446adfdfc55f4aaff678f665e61aba59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920203, "uuid": "f3837634-6f7c-45a5-affc-2b2dff1fdd29", "value": "T1C904F18772018F51C235417209F3C792EBE723E61BC26247A77DD9009B9AB1C991FEE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920203, "uuid": "c07140f9-f6a5-4630-937c-7c2f1825f3e4", "value": "3072:kgfKVeEOH4lcgjfAtq2DsleM3p7W8woHHNl3TI1P6/iOUFJi95PrfuJKd8:kbNR1kq2DWbwonXsqi76wId8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920203, "uuid": "54f5c9d8-8c9e-44ce-94de-a4a1413b926f", "value": 180676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920203, "uuid": "15f800db-d869-4905-9d00-fb2d884ebf8b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920203, "uuid": "e9a6b3ae-c481-4efe-9b55-cf2ee065358d", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd6f49b-99ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786909858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909858, "uuid": "7eb4f67f-1686-438f-99b6-fe9f4d25aaaa", "comment": "Malware payload (Mirai)", "value": "3b51cc8d07564a4c3f92b18fb2538ee6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909858, "uuid": "44db7eb4-7735-4aaa-8077-c1f479f449a0", "comment": "Malware payload (Mirai)", "value": "f59cd518e07922afb75ebb4b31ea688a5500264546e723792c427e1928b8d803", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909858, "uuid": "67270175-cff8-4468-b262-c474cf005660", "comment": "Malware payload (Mirai)", "value": "0ed6d61dcb876d343047186675e8861109d1acb1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909858, "uuid": "9341c26c-51c1-4d28-808c-5be1c71b3e08", "comment": "Malware payload (Mirai)", "value": "e35dcaa937b42598d464440ef4cce86b4ee18c0255cf7dbd91c2aaa0025de5e9d9352a4048ea76f21d71f219a6c23d76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909858, "uuid": "f5a107ff-b3cd-4d01-b7ef-bd663d57c6d8", "value": "T1CA24D71AAF610EFBE8AFDD3702E90B4625CC650722A43F793674D914F50A94B49E3C78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909858, "uuid": "a7b6a6f5-749a-4672-a5fc-f2c1466fd8ab", "value": "3072:b5FH0q/GQatlmi01caetI79u+8zQRH8z3y4B6uRRawHun:Vl0q7c0u+8zQRH8zn9Re", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909858, "uuid": "0696b27b-9982-40f0-8f0c-13b8289d71ee", "value": 226384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909858, "uuid": "1acff1a9-700f-4a28-99b1-6873dc7daee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909858, "uuid": "8f0e762f-977c-4faa-b613-52661e7eb322", "value": "3f9f5987c3fd5e439f221faf0ef80009853e3ff4b366494b228de56f78e89cf1.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b0000ce-9926-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786852597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852597, "uuid": "5d70d1eb-4e59-4958-bc83-8820ac40b051", "comment": "Malware payload (Mirai)", "value": "962144cec7d72cce3d9d60ee2310a191", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852597, "uuid": "79e3355a-0728-4e88-9230-4927a718b149", "comment": "Malware payload (Mirai)", "value": "f5defc2b40d799df927dc219f2f2fa67a95b238f6ecd69375e5fd839353fbca7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852597, "uuid": "c60ea984-852c-4f0f-8e3d-c69ec2b4c1c4", "comment": "Malware payload (Mirai)", "value": "00b300000ba006b24e50e75221262ccce27a2202", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786852597, "uuid": "15d12553-3930-47b6-bf7e-e51fe737eb26", "comment": "Malware payload (Mirai)", "value": "367ece4de700f5105b75ff081570f2764cb7d34d1c86d86c0144ad900f13246e281a95442c6b980e44c9af206b783423", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852597, "uuid": "b7e015a9-8049-4d5c-b2ff-86e80f263dbc", "value": "T1FCE4C80B6E228F7DF674873147F70A24ABAD33D617E1D581D2ADC1142F2128E591FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852597, "uuid": "37de9712-2bda-401f-8509-de2174f4f941", "value": "6144:VhgrS635Ty1MnKqo2NLA1V894V8VLydLbxv8/Wakm8CRB4Pzihg3n3BgpJcISJf3:zgDWwBo2iV10ocsndSNuhqnzb2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786852597, "uuid": "70fd5b0a-d890-4d68-b7ea-dcb4b43a0f3f", "value": 657300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786852597, "uuid": "525c3f62-6451-487d-abb7-e1446602bca6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786852597, "uuid": "91c504a0-0fb0-4a4b-ad37-6015b050db82", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77eb501-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920210, "uuid": "2a4c16b1-b937-400f-8853-91b9803fa28c", "comment": "Malware payload (Mirai)", "value": "c7dc0662d15a332367f2ba1546749d6d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920210, "uuid": "9870f6da-15f4-4aad-9bbe-779e089901de", "comment": "Malware payload (Mirai)", "value": "f7912f131a404a0339630246ba5070594d5271e3153f3dc9afe6a8a685c9020e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920210, "uuid": "c987da82-6c45-4d44-b57d-ff42f7cbd3d7", "comment": "Malware payload (Mirai)", "value": "c06387b07a3e67896448ed1a4c681dd569f7d715", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920210, "uuid": "c3875037-8696-4d5d-9802-737a1e1a96f7", "comment": "Malware payload (Mirai)", "value": "7be3ea94d862a92efe53c56c7a2cfc476403c0d2cd71aee39ac4c59ef6a88c61c1a6626960b1f79e8a586173c42ff5dc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920210, "uuid": "4ef26b50-d3e8-4702-a7b3-ff71c9e49d63", "value": "T172D3E198F840DE22CAD1167EFA9E174833570B3CE6EA3301DD199721379B62B4E36D19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920210, "uuid": "c2128331-b036-4d80-b59f-4874eaa9f268", "value": "3072:rponhnSMawG8gW9E5/ByaS48XBMDi1dC9TIQQEBlmxrX4Ahvv:rUhSjwG8gWC5Jy68XBWi1dC9Iqmdtl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920210, "uuid": "353d9fd2-c1fd-4945-83d3-a9a7d6cf58e0", "value": 141405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920210, "uuid": "c3e29087-a0b6-4a31-937d-6b36aa15661c", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920210, "uuid": "6c1273ee-d3bc-4717-b227-48c4527087e0", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de95bd5a-9992-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786899150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899150, "uuid": "bdd6a34c-3719-4329-94d6-8e5c39a401ae", "comment": "Malware payload", "value": "6a5c5eefb34cd7775c8b636faf821132", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899150, "uuid": "471d25eb-1600-4f9b-a905-9508eb313593", "comment": "Malware payload", "value": "f7d96fde643f99aad02bc23b172b6af1949132782cc7379082723851f3881326", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899150, "uuid": "20f160ed-2cc2-4828-bdc0-1baa1bb1d27b", "comment": "Malware payload", "value": "76058f2cacc0fbf93e7aa6b6231a03d4a55f269c", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786899150, "uuid": "56d5d442-fb9d-482d-82d2-7711d9bc308f", "comment": "Malware payload", "value": "6bab2e34d98a8695c68cbf5926180ddd8584750a6b9032c50c0cd0b0398eb6c79e412351445b441e9147b7f0ba93f77d", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899150, "uuid": "6861e6ac-313d-429b-a5dc-4db6e3730761", "value": "T160E6332CFEC116EAE5B3813CE7F243A29ABDB4245771C6DF176982A05E531E0453E263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899150, "uuid": "d0181e25-4415-41da-a01e-b6142b2589a3", "value": "cf72283be50852e418ce6bbb6b645835", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899150, "uuid": "c665381b-10e9-4eff-a0a4-c33a507ec7f2", "value": "393216:SgAEsZ1i/2DzxDNrHrgxHj5FRK0xRXMCHWUjScuI3/PGTAI:SEsZQORtgxHtFRK0TXMb8vH/O7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786899150, "uuid": "982ae9e9-0314-4047-8d51-a34011d5745e", "value": 14096226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786899150, "uuid": "9db9a412-4243-406f-af77-04bb79924c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786899150, "uuid": "b090520c-a22c-4aa9-9cbe-f0b13c478e0c", "value": "composer.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05a017f-99ac-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786910239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910239, "uuid": "7c4c37a7-f663-45a2-8445-0d5c6e4d23bb", "comment": "Malware payload", "value": "ef4286df2658b990492875079d82a15b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910239, "uuid": "3997cc92-e3e6-4d77-8b20-4d160fdaaa0a", "comment": "Malware payload", "value": "f84341b6455408ce40ed5cabe639ad67a0484603ee50bc80f253f70c3fddc369", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910239, "uuid": "ef9839e3-33fe-454a-8b82-9db0ec9f90e2", "comment": "Malware payload", "value": "aae6ec06a607c319054bbe0d89f805477fdfa810", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786910239, "uuid": "1cf51ab6-b18b-41dd-be58-fcf15dc5f29f", "comment": "Malware payload", "value": "7b30fc3fce21029f969e9a45d9ab1240515596d6b26779d7f54696e1f700c6b9298ff6d89f5b66eeaef02d5336f501b8", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910239, "uuid": "87507c76-a10e-4c45-bc69-6fd93c471252", "value": "T189236D651A857C24AA98C4371D7E1F0CBDAD43E6324492EE7FCA3CF28C5AA9DD10871D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910239, "uuid": "26b6053e-1936-4a66-ba7c-ab052fcf43b6", "value": "768:6XRWNGxVK9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:GlxJcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786910239, "uuid": "12ac7d93-98be-4b9f-a2c4-3a17b951447f", "value": 50039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786910239, "uuid": "59fb8864-2e8b-4797-ae56-d5e3e02669b9", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786910239, "uuid": "1b981e12-066d-404b-a1f2-5aada3c3be24", "value": "k.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b981124-9931-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786857376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786857376, "uuid": "898c6e61-1ba0-491c-9766-a138d80a81b6", "comment": "Malware payload", "value": "e3dedfaba9af3e30cb88af5e5c473327", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786857376, "uuid": "c7021f88-6436-4d5c-8a3f-06ea749d3c95", "comment": "Malware payload", "value": "f8e56285b57f3b1a33533e29f9d6f20283b10605aa6b941260c088edd64e8d73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786857376, "uuid": "78c48448-e64c-4aa2-98e3-5d10b2e3398d", "comment": "Malware payload", "value": "8c5a5a7d14ad6faa7d1a1168c1d24d5dea2c188e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786857376, "uuid": "6cb3377d-8a33-4432-af39-437ea483c001", "comment": "Malware payload", "value": "3d628702ce9e5d7becbf3ff1bed81f0a6cd63d225efffcb9fa581091c204c6fba218065819237c3ba0fdc5f904faee94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786857376, "uuid": "4e5691c4-3084-4aa8-a58e-992d766b050c", "value": "T117263386D29610A5F87F243089DC3EA1D3B610B7EDC311F759910A9694E3A85F73FE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786857376, "uuid": "e5e18c8d-42c1-4d1c-8658-2c202f9b8a93", "value": "98304:hO3vV//gE6lFh1YoSxtRlPvEVspxZjKLXrg18sb7bEU8oDEzYK0aBfy4pe:hO3vD6Dh1Y1tRl3EV+xZjKL72lb7bEtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786857376, "uuid": "0eb833ba-94c9-424b-81cf-3d7ad344822d", "value": 4825029, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786857376, "uuid": "a43e8d65-d188-4b04-baec-043a5b278565", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786857376, "uuid": "c99fad59-44e2-4bbc-adac-1c8fd35f7e50", "value": "f8e56285b57f3b1a33533e29f9d6f20283b10605aa6b941260c088edd64e8d73.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7735d231-9906-11f1-bd95-42010a9c0009", "comment": "Malware payload (RustyStealer)", "timestamp": 1786838847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786838847, "uuid": "e9a1b497-c87e-4766-a3f7-4223627c7331", "comment": "Malware payload (RustyStealer)", "value": "d222549235db4112333d82e12f767d47", "object_relation": "md5", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786838847, "uuid": "1dc32248-5f4c-4013-8aa0-4c2899b41646", "comment": "Malware payload (RustyStealer)", "value": "f9964a8d9d01052d9bebe057deadd7ce9d794e8296e2a72229f8ae4aa62ae224", "object_relation": "sha256", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786838847, "uuid": "0ef3f5e5-bb26-49f9-ab8d-58107a502d5c", "comment": "Malware payload (RustyStealer)", "value": "12463a81a786b04fe4b3b7d1aa1222e589e5921d", "object_relation": "sha1", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786838847, "uuid": "79ada809-fd1c-4589-8b6e-00c7d97461d8", "comment": "Malware payload (RustyStealer)", "value": "7eb2117363be20c07763d822d0df4f9ba988ed06dc74b563359f5b87991e890caaba693053c4918b7565e2adc988aa0c", "object_relation": "sha3-384", "Tag": [ { "name": "d52f85", "colour": "#BE19E1", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786838847, "uuid": "24734652-de8c-4ecd-a187-0b536e8f6aa2", "value": "T196164A43F67690FCC16AC0788346A132FF32BC8948367AAB5BD09B353E65B406B1DB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786838847, "uuid": "66d44b28-a9a0-426f-b70a-105f592c943d", "value": "bd6ac69ea8f6e3ade9b9834340f13265", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786838847, "uuid": "92c2f5e1-6a22-4fd3-aa0c-869cee3a430f", "value": "49152:4zwYqdALwkbQB1bw/48Hgbbv5mAF71XXG8PTWUhs5zs4moSK7iSAEExYxIU6isz:4oNB8kFB1m8bPs5zs53+sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786838847, "uuid": "e754e4a8-22f1-451a-a315-c980132617b3", "value": 4140032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786838847, "uuid": "7c4e8624-7890-4f25-b1af-f609e2b03afd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786838847, "uuid": "ee1ed9d7-55f8-4458-a7f2-aa255a4ba0c1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aaa6c41-997d-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786889802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889802, "uuid": "96a7639c-223a-4e4f-a292-8054dbabae58", "comment": "Malware payload (Mirai)", "value": "8ea7f7d0a88d9e7c80c36efdd7dd95e9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889802, "uuid": "3c9a479f-1791-4a1d-990f-65ffec702940", "comment": "Malware payload (Mirai)", "value": "f9a0e35d8dda23c5634bfdc559ec1e8911151605d58f85f020982a04ebf9ed78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889802, "uuid": "a139bdf9-f770-4720-a647-e27336a71528", "comment": "Malware payload (Mirai)", "value": "2a8e40fd935fad6ad7ce26404f88d9233572c1e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889802, "uuid": "41d23431-bd25-4d1d-b482-9a1ed0dc33ee", "comment": "Malware payload (Mirai)", "value": "15670cf08b7e2d3e2a85e9c9084cd539c12b99943e63985bac50e420d86ef9e1f8b9ca32d8c13895aba1b699c229acec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889802, "uuid": "f73262f1-6354-4243-83fe-2b51c27af163", "value": "T1A25302BC3A47E873ABF074BDF1FF03052B56A7BC5D847138293489A7628950284B5363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889802, "uuid": "79698388-a005-4a93-b797-f045d5b5e057", "value": "1536:U779bOCtpfHHcaL8ZKELuP4SkRkfmJMMqKSNVgQPsbrmzW0zGk:UlPtpfHHcaLZT4T+RrzCrZ0z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786889802, "uuid": "e1db342b-6ff2-4f19-b07a-34e3c29e26d3", "value": 65168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786889802, "uuid": "1f78e017-fba8-4e40-a620-552e239b7304", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889802, "uuid": "ef2fb596-a867-41d6-969e-e5424b66c316", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6537de5f-998e-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786897228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786897228, "uuid": "41b70409-0c2b-4689-b73b-2b5d04d8422f", "comment": "Malware payload (Mirai)", "value": "191efcb29de27c82ef1657647a85e85c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786897228, "uuid": "0b3ca2de-e698-4284-bc5c-18ad03d79cc1", "comment": "Malware payload (Mirai)", "value": "f9e554febbe32d19e39a23a163e331ca5828f697c60ff17a30282daf855ffea2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786897228, "uuid": "d0198168-e20e-4713-a1e1-73d99be80cab", "comment": "Malware payload (Mirai)", "value": "3673bee8cbec49aedd00ffbb1c17b917d695a178", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786897228, "uuid": "45675785-4f2b-4bd8-bc36-c6e47ac6f5e3", "comment": "Malware payload (Mirai)", "value": "df0db19958d4571fdd0184c11123988ce550270394fb4476f0e132b02332dc6e897a85633e087cfff8654c99af63c3fa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786897228, "uuid": "1951178f-c447-488f-8068-fc85e145c896", "value": "T172A3AE63CCA51D94D57445B8B8B8BE795F23E80046836FFB15AAC5A69087EDCF10A3B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786897228, "uuid": "2008d000-3b80-4e5c-8193-66cafe649096", "value": "1536:8/d35T0+kS+gC0lzAE8h7jSqNnbIh5yKEXlF7DcW/jLfCsGNwtOOvTm:8VJTddC0BbKIhHEDcW/jb6SwOvTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786897228, "uuid": "f5f97dd6-b98d-4f8f-b12f-622cf1ab0ec9", "value": 103968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786897228, "uuid": "6b887a0b-35e6-4e57-95fd-74953527e883", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786897228, "uuid": "ad7a994a-424e-4829-90e0-6ed12e16a53d", "value": "f9e554febbe32d19e39a23a163e331ca5828f697c60ff17a30282daf855ffea2.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa85e511-99ab-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786909800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909800, "uuid": "abacf912-2d4f-4d0f-919c-4fccb50ec382", "comment": "Malware payload (Vidar)", "value": "4805d8a1b58672086a08a0c7962eef50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909800, "uuid": "1756884b-2634-46ee-b8df-5a06c8cc65fb", "comment": "Malware payload (Vidar)", "value": "fa61e7bac49937e9681c98d2aa2330463aa478f0c82d9d62ae01021aca11988e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909800, "uuid": "dee3c853-7a1e-41b8-bf66-1a472bfecb69", "comment": "Malware payload (Vidar)", "value": "e21426fb37f7b7e05cd6989a859e97050b42a4e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909800, "uuid": "ed6d37f4-9041-4183-8177-89b812a45a7a", "comment": "Malware payload (Vidar)", "value": "e2d89babedcf79abd7e211a8115fb6d5d4d7631e1449b06f8e23fe55458c84d4c35abafc7f4b5ecdab0101f0d2e044d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909800, "uuid": "7f12dbf1-216a-4b13-819f-6acf62b591dc", "value": "T1EE169D03BDE0A464C4A4963698BB42117B38FC5E8B3673E72E91A5353F723D18D76B24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909800, "uuid": "7032d5cb-310e-4321-8f24-2326fd8235bc", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909800, "uuid": "1ce6d31f-dcd1-4811-b0bd-644e3319e20c", "value": "49152:jCKi4eynVzD6YY70JRUdMk897BLGFKgFjpZNiqpLjjkYhRm2d5X6:ju6veM7vLCKg/ZgqpLMmRmAX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909800, "uuid": "5915f093-b404-4142-be1f-254b59083fed", "value": 4330872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909800, "uuid": "4446c622-f96e-4af5-8386-7693e59d09fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909800, "uuid": "2dda670a-d40f-4170-aa93-2c024430466f", "value": "fa61e7bac49937e9681c98d2aa2330463aa478f0c82d9d62ae01021aca11988e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45046cf1-998f-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786897604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786897604, "uuid": "b0e9afc4-8175-48e6-a0d7-f24ef250adb8", "comment": "Malware payload (Mirai)", "value": "7a4b5b70ea35832fa639cf88a24054d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786897604, "uuid": "7bc2d9d9-4b28-447e-91a1-810bf65b3693", "comment": "Malware payload (Mirai)", "value": "fa7360cdc91422ac6bb71e2b336b6449ebbf8936948fee7800973813c192bb90", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786897604, "uuid": "dbfcb548-429f-4251-a6dd-83c347c695b3", "comment": "Malware payload (Mirai)", "value": "939f8ede34bc5dec9996a95ca93587e309d37763", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786897604, "uuid": "560643c9-c9ef-49a7-8c99-2016e9b38bd1", "comment": "Malware payload (Mirai)", "value": "c828430cf4738cfa973424a69a4a7df0f52d4cb0b39a51891031907e5d72299f81ff34db8bc4bbadc6e6abdbf19a0aed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "whack.sh", "colour": "#5F9598", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786897604, "uuid": "f318fad9-3b77-4858-ab33-3df0e588db58", "value": "T151E3C409AF601EF7E8AFCD3706E92B05258C691721A87F797534D518F24B28F19E39B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786897604, "uuid": "7ef38bfd-5631-4170-84f0-fbef6566975e", "value": "1536:KZIzlliDDZ7JWiCFkEevFGGFa3NbOH6OdFE12Oqf/+ZomaCJhtSTPTOCUvvX:gZh7JWiCFkE+FnDE1O+lGvUvvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786897604, "uuid": "8b0b35e4-692a-49e7-a709-556a0ee5aa28", "value": 147988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786897604, "uuid": "32605d31-ca8f-4512-994c-2df309b51689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786897604, "uuid": "bfb12070-15d8-4cd9-ba9f-facc8aa7be8d", "value": "fa7360cdc91422ac6bb71e2b336b6449ebbf8936948fee7800973813c192bb90.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fa1b8b-9997-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901125, "uuid": "a89ad255-27e8-4421-9f6a-241e62eb3db8", "comment": "Malware payload (Mirai)", "value": "f80007fa910ac84923cec06767e20856", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901125, "uuid": "d1369142-6db5-4e04-a193-ec58aa5c0d9e", "comment": "Malware payload (Mirai)", "value": "fb0802b03d5edca367e06ed7d37f7c1db5e6774338e4b6f82629b55c280d2407", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901125, "uuid": "2e786c10-1323-49da-a3cb-fd8651483e87", "comment": "Malware payload (Mirai)", "value": "59e1265b80295324325c23f0e618038ca3fdce06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901125, "uuid": "24e0b230-8e5f-42b1-a63d-e6468326aba9", "comment": "Malware payload (Mirai)", "value": "219ecda60c86d867787895fb139cc5ab39f329222f580466cee84c528f71a72a0e59a4dc61b74bbc52be6b8a3c8a2807", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901125, "uuid": "e60a044a-2c31-49bb-9029-2e54e28c5ea3", "value": "T1B7736DC5FA83D4F5EC130A351036BB379A73E53E2169DB87C3A8A529DC125C2DA1639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901125, "uuid": "717c0f75-423d-45f1-95df-d50b4f44d450", "value": "1536:Ms3y6v3JiRvWylREdwHE2N5Xekch3K68cS6Z3:Ms333IOylR0wDN4kM3DZ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901125, "uuid": "95a5b940-2bcf-4f32-8804-2b26b3f8f706", "value": 79412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901125, "uuid": "efe5e815-d4ff-4bdc-b727-66d91f2c0a02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901125, "uuid": "c7e91512-aada-4c97-8e9b-df34a64eb59e", "value": "nz.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1498103-999c-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786903369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903369, "uuid": "33e1589d-48c8-48ee-b563-69c0a99c6fd0", "comment": "Malware payload (Vidar)", "value": "ad4d5d7d866b4affa8a7675976bc4c03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903369, "uuid": "69a0a2cb-1ca7-4d14-b658-3fdc4b5ad548", "comment": "Malware payload (Vidar)", "value": "fb2028a9ec3146d38ac17a0bf841cfa84e98fe2505e3845b4f248815689b3e8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903369, "uuid": "aa352381-703a-4522-b638-c311e7db36a5", "comment": "Malware payload (Vidar)", "value": "7d0ef3b9090e7d1bd10eeca9128f20ca4f1c0536", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903369, "uuid": "d9de4094-7a93-4b3a-b590-831e9af1b424", "comment": "Malware payload (Vidar)", "value": "9da6a4e8f655ab3f6ce2a89c70f011b1a7ff55b8dba989659a7ac2f4ee422dabbbdf23420aa5402cdfe48969c7991e21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903369, "uuid": "44ebad11-2d5a-44e1-977c-35e475e93791", "value": "T1AE465B13A9A55878C0E5FB3084768691F766B80C573837D32E71AEB82F72BC26E35750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903369, "uuid": "7dceca15-6600-4c80-a1d4-307d6d94d5da", "value": "d8b31f8c03e0c76ff245ed05a15ffe6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903369, "uuid": "abf76a11-f66d-4f39-b3f2-9e12c2da9591", "value": "49152:LNXlbxdY8x15f7FrKpjo7Yxz2tF0coNYSFHNT+fQPqahva95BwnbDyqiqk:LTztK70uHNFHJ+fSja95Bwbu5qk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786903369, "uuid": "32825965-8c83-4a68-be84-0feb87530ff7", "value": 5697144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786903369, "uuid": "992c6c0a-a88e-4aa1-b3cf-69b29ffefd64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903369, "uuid": "6e9daae4-e96f-48cc-99f9-d424e698b048", "value": "fb2028a9ec3146d38ac17a0bf841cfa84e98fe2505e3845b4f248815689b3e8e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a7821c-99a2-11f1-bd95-42010a9c0009", "comment": "Malware payload (Vidar)", "timestamp": 1786906059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906059, "uuid": "226f00d8-198f-4bb9-8b66-2a7888c8f724", "comment": "Malware payload (Vidar)", "value": "07732e854b7169b5b1cf92d4b3e33447", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906059, "uuid": "b4fe1bcb-ec3d-42c5-8221-fcd7dada759b", "comment": "Malware payload (Vidar)", "value": "fb977d559998ff5e20ab3a3aa0f974524e10c01cb10da93249355f421f1e158c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906059, "uuid": "d2311c1e-e217-41c4-b5ca-cee68b7a82d7", "comment": "Malware payload (Vidar)", "value": "d190fe1d9c3af980f7e822289952703352ac4a4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786906059, "uuid": "61cb7bc3-fa2e-43d1-8010-99a27ba2bdc3", "comment": "Malware payload (Vidar)", "value": "8daff8a8b1eb0c6118fbf360932c7269499c88ddb41d285a209f679481485c526c4b87977271c02660003b6b269da32a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906059, "uuid": "4e0b6c16-1615-4f17-bbf8-5a42d7195894", "value": "T14DF59D07ACA148FAC0AAA73189B215557B30BC095F3663D72E90A7B83F737C06D79B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906059, "uuid": "1d60a976-1d90-4a88-8074-b303d06503ae", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906059, "uuid": "339406c0-3044-408f-b721-c28b23bbffa0", "value": "49152:wBROOS3dqkns/KBAdH2Q0xR+iW2GJ19ctnvvMRJTqfQsKHtncZzZ2GD+8SAgysLd:wBR6YFbb4793fvYBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786906059, "uuid": "e6f289ca-f032-47ca-b753-235849ce2314", "value": 3495248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786906059, "uuid": "85d3d22f-b3b4-4166-a441-ed433bbeb07c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786906059, "uuid": "07c34847-60d8-48a4-88d2-c9a1d15cc169", "value": "fb977d559998ff5e20ab3a3aa0f974524e10c01cb10da93249355f421f1e158c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea684656-99c3-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786920215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920215, "uuid": "e8d74a7c-f57c-4cb1-96b8-5dd6f7efc797", "comment": "Malware payload (Mirai)", "value": "39660620209c3a7f9b8ebdb5adce3747", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920215, "uuid": "27cb9a47-19a4-4dcc-9ba6-6dd08903bd36", "comment": "Malware payload (Mirai)", "value": "fc2c3f2f744a85974a80e1d9cb8b90da884801a1282068b807349f561986c022", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920215, "uuid": "a16056e8-bc8d-4204-8e59-5873f4d25b8e", "comment": "Malware payload (Mirai)", "value": "2732e69008b0d8151282053f7c35b9575efa7868", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786920215, "uuid": "6e95d6ea-f933-4ea0-b341-24a05bc743d3", "comment": "Malware payload (Mirai)", "value": "c1c1538d5410012cb1e04e23436318fa1dfce37cc94d8a00f6f14d3e021eaebd34376934146656da7beb896a0550a0f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920215, "uuid": "d3099826-9a0b-459f-9fe8-f754119bf427", "value": "T12FB3F107E6A060AEE497C370975B5627B236398012766B3F3B45FD212F22F206BAD750", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920215, "uuid": "fbe3ac9b-2101-4ae3-b79d-519a1168470e", "value": "3072:Nov4QV8Uwdap/99DtLVpizr0OYHkfsycvMq4BFghP0Q:Nov3OUwdc9LVpi30O5EqqegaQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786920215, "uuid": "f85b7bf6-37d8-43da-bf34-888ff7b00fe4", "value": 115521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786920215, "uuid": "0b91c8c4-e17e-4e73-8f64-c65511903648", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786920215, "uuid": "46d5f3aa-9ace-4868-a2a8-2791870d4b46", "value": "na", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351e5dd4-9998-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786901443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "6e6e3120-0211-42d1-8f0c-01a9c5f09654", "comment": "Malware payload (Mirai)", "value": "6935e5b3bfc92027c775c8acba736170", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "3ff677a5-c7fa-4a77-b7e4-72a05e21fc0e", "comment": "Malware payload (Mirai)", "value": "fd375233ae40384734539bd50dca5cdc44f5b2309389a1c58c17b90f7f04888d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "6a0bd87c-4f99-4a51-b96f-1bf61c0da58c", "comment": "Malware payload (Mirai)", "value": "3351cead6266f29a741b7601f272acc421f907b7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786901443, "uuid": "48b9732b-36df-4fc1-9bde-7e755cfbafb7", "comment": "Malware payload (Mirai)", "value": "dcac45ac72af28a3874af99fc2863e65c9a8a7f725c384e1322e6a93bcb356ee40aefd655e5c3b47ee9b8509c92bbaeb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901443, "uuid": "1d062345-2217-45c7-bdd6-7629dbad6279", "value": "T1B0E35D8AF4029E7DFD4FE5BE44670D09E931A39131830B2A53DBFDA3A9311A94D17E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901443, "uuid": "64786d3a-4f25-41f6-bc40-a32610127296", "value": "3072:7oDlIyA+oy+ZGiTW/lZoEhH5lgLOoe97dlJ8jA4:1Dy+ZGmEFxoe918jA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786901443, "uuid": "62aa465a-6549-4284-aee7-cc3bede7e323", "value": 147336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786901443, "uuid": "c05b016f-cd63-41c7-8ee5-698845ba7f38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786901443, "uuid": "96dd1ab0-77f1-4e8f-840a-5b2135625623", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b396ca8-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786915116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915116, "uuid": "9a2e8fe6-8c44-483c-91ae-5e4d5ee4d12b", "comment": "Malware payload (Mirai)", "value": "f7317dd7d40d5e49b20c884cd980990c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915116, "uuid": "0a630ce4-8a63-40c3-b461-55c6c6714921", "comment": "Malware payload (Mirai)", "value": "fd59794a4ac26aa4b1e26e6b1767e600d453425bf4edce1ad5353aa7af682960", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915116, "uuid": "a6f9c10f-dd44-4093-8db5-dc45992d39fe", "comment": "Malware payload (Mirai)", "value": "7fa9c8fd6fcd654e209880ef6b7b78bfce67bd39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915116, "uuid": "f874e9f8-4c9a-4ee1-a70d-3741032c59b6", "comment": "Malware payload (Mirai)", "value": "49766d68ed6566378d58a4c2e039d9822f84e358654252593457e3b139dc8fb63c3f66679900e4208bca2ef9cebc7bed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915116, "uuid": "374e35fe-82ed-447f-be16-84cb1b08c9c3", "value": "T1EF443B56FA929A13C5D31739FB9F41053322E65693DBA202BD2CABB03FC72694E73501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915116, "uuid": "646e6fc9-7f9d-4489-b6a5-c65dfb88e231", "value": "6144:d/yqfaFKqYyDlgonqk8a5XmOD4rmuvKJF5lssM7khWoscnyWL/KNxcnX:d/yqisqYyDlgonqk8a5XmODvuelssM76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915116, "uuid": "143783bc-abdc-4ff2-b45f-ba9380cd927b", "value": 276772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915116, "uuid": "83e4f7be-05d0-487e-b692-19471e1e4568", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915116, "uuid": "99be0e12-a676-4d37-a7c2-0f1350896a48", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d6e44b7-994f-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786870184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870184, "uuid": "591a77af-36c5-438d-a82e-e98295d12d5b", "comment": "Malware payload", "value": "0c675a8b9795500e5e162169722718cf", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870184, "uuid": "dba1ec37-a4ec-43bb-bbca-5110f540f99f", "comment": "Malware payload", "value": "fdd3a6c5d4c6f0d9ee6bb8ed7c04187a780e662b48ebc9aaf15f1b5f5ba3dc85", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870184, "uuid": "cfec9f21-102b-49a9-bbe1-0fc84c69bed7", "comment": "Malware payload", "value": "ee882c58928c0a4006a7dac6ce8fff65d1d70a24", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786870184, "uuid": "b290a56f-bb18-423f-afe3-c339f0820359", "comment": "Malware payload", "value": "7a99fa184c9508dec2375ca1cec1b54daad96446fd5d6d2d29edae0915d3cc941132216a956a88daee7321109c413b17", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870184, "uuid": "48766bfb-a364-4413-99b5-6acb52ecd9ca", "value": "T1F8C27D966A867C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C15F9CD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870184, "uuid": "e247a451-d892-4a7e-9798-032a9c06b2f5", "value": "768:+8vCB+25j6es8Rb9FYpMSUpi+20qUpi+20YQX:+8l25Jtd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786870184, "uuid": "a0773054-4c97-45cf-b2d9-d740a3ebc448", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786870184, "uuid": "ef040510-cf1e-4b69-ac5e-89fc909bd76c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786870184, "uuid": "a24e40a1-37ed-4713-a04a-46fd64279045", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4c36ae-99b8-11f1-bd95-42010a9c0009", "comment": "Malware payload (Mirai)", "timestamp": 1786915121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915121, "uuid": "2cfe6689-21fe-4b6b-a86d-c77ea27af3c3", "comment": "Malware payload (Mirai)", "value": "0517aaccc22e828704d0707e786896be", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915121, "uuid": "f2961e2b-bf2f-4aaa-9d4a-396a8d9d5ffd", "comment": "Malware payload (Mirai)", "value": "fde134790d4e436c56fe85dc3ef2532fa47f58cc151e4bd3b480e811d799ba63", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915121, "uuid": "8e1f7d82-9c19-472d-b721-82849ea55e1d", "comment": "Malware payload (Mirai)", "value": "ed0e6849b8fbaaafb5ab95d23ca7792c5fe898b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786915121, "uuid": "1b93b0a5-c329-4d9b-ab5e-44389dd750bd", "comment": "Malware payload (Mirai)", "value": "2eb200bdc2ef2e327fccab765000fcc9819d2bcc629218341d92ef495f7be45a263449228b749e5450cbc03f62eeb030", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915121, "uuid": "481917ab-f18f-461f-b8fc-1c63cb3a66b5", "value": "T161246A4275E190FDC983C2389B9F9526D931F41F1238B21A374D7E222F6EE215B6F681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915121, "uuid": "aba6efa0-1622-42cf-94be-035178ed7a73", "value": "3072:pJNBiBPFv/itTw1AYnB3xCqaBfv51+DGEkhFyxRQVrZt9uQlssMab/BlGH+Iys6d:pJNBIMtTw1AA19Ge+5LZlssM7khWo7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786915121, "uuid": "b1730adf-9f18-4fe7-a2f8-71cad9a5c1c9", "value": 224488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786915121, "uuid": "63f8879e-7cf5-455c-8752-d72179e11577", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786915121, "uuid": "e959a2d5-2bbc-40f7-90fb-f4338099a1de", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2cb0603-999c-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786903371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903371, "uuid": "cdf409ea-ccfd-4ba9-a7fe-ba5a83a4fa87", "comment": "Malware payload", "value": "8d7630830ed54f063c16596e87511178", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903371, "uuid": "882dbd0e-f7b0-4087-839f-00865a2b8b61", "comment": "Malware payload", "value": "fe139f5e79bb85516fb7405e8a92f0a9465bb06ca1d7fd623d45ff162e2a9460", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903371, "uuid": "0f65fcc2-5e92-4706-8977-42f0c8706ef1", "comment": "Malware payload", "value": "69bfe67d0304de4037f51d13d858f1a77a9a7528", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786903371, "uuid": "ab3e8504-d1db-4b41-857e-2302c34085e6", "comment": "Malware payload", "value": "f9ed510bc2c52a0e98f65d536fc9f6dc91f3c2dfd268d78c0f0f9aa24abc6d87108e069124fa5eff4b56a381ab12fc3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903371, "uuid": "fa059a51-5563-41db-b2ec-79ce6d3d52b1", "value": "T172367B07ACA148F5C599E735C4B78256BA24BC0D4B3023E32E907EB82F727D29E75764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903371, "uuid": "c35ba655-f8c8-47ae-b1a7-9f65ee33ce72", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903371, "uuid": "4718c741-33fc-45a9-8113-f9b175987bc6", "value": "98304:KdR3g4LOkAliQ0ykuYAIJ1tIXaNByaKlP7ISY1ofa:KzpYiFyDYFJ/Owq7ISY1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786903371, "uuid": "09a6bb1a-ac70-4e14-bcc6-8413e8c4e366", "value": 4926304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786903371, "uuid": "cdf7be57-2ccd-4a34-838a-d4a07353f5f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786903371, "uuid": "da83f2c5-6158-40d9-9cba-49f858f2afe6", "value": "fe139f5e79bb85516fb7405e8a92f0a9465bb06ca1d7fd623d45ff162e2a9460.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ebae7b-997d-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786889921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889921, "uuid": "ace17584-c67b-41eb-9300-cf3c21c25f18", "comment": "Malware payload", "value": "434f83ab286ca7e5abe7562bd966e4a2", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889921, "uuid": "83721c7c-9566-4dd3-bf4c-b27a8aaa60aa", "comment": "Malware payload", "value": "fefca4c24d96c67cf13f8dce76d148c4626b72138293dd899b949aca43d8615a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889921, "uuid": "62b7966f-0c5c-48fe-b008-8d6ad97da733", "comment": "Malware payload", "value": "e003f5b074c7d3b1507dffce139515d285535d07", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786889921, "uuid": "0feb83d0-f58f-44b3-8f3a-3ce136bc985f", "comment": "Malware payload", "value": "5b5e604a73a554e9fc7a94162eccb9b9846210c5b37dba462c5024310c1fae6a43e97f259339c1214d98ae0595183cf7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889921, "uuid": "03ef3686-43f0-47b7-9498-448ec888a066", "value": "T17CC28E966A867C44BDC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11FACD618B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889921, "uuid": "921be818-9fc9-4791-8fc5-f5e382344b2e", "value": "768:A8vCB+25j6es8Rb9FYpMSUpi+20qUpi+20YQX:A8l25Jtd2QX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786889921, "uuid": "6a793834-97a3-4efe-8524-3bbcc7126046", "value": 27042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786889921, "uuid": "130bca66-7c0a-45fa-bc02-a66f5c255b14", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786889921, "uuid": "f71994d8-a049-449e-9a55-69a8b6953c04", "value": "wr.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e163e059-99aa-11f1-bd95-42010a9c0009", "comment": "Malware payload (AsyncRAT)", "timestamp": 1786909463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909463, "uuid": "0dc9b01b-8425-46e3-902e-a924bf6bd6c1", "comment": "Malware payload (AsyncRAT)", "value": "021f068445108a37687c003ccb70c7ca", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909463, "uuid": "a6a06d95-327e-4031-a781-8cdc18ecb54d", "comment": "Malware payload (AsyncRAT)", "value": "ff8235089a02e71d422a0c227f177f14052b58d1558324a6001ded65418bb498", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909463, "uuid": "3bb8fd10-0f0d-44ee-92b7-dc6ced93f7de", "comment": "Malware payload (AsyncRAT)", "value": "78056bd6965fc82f7fa8a05564ba6c4f3d80b07b", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786909463, "uuid": "5fb6e7a6-f949-4b59-8dea-474ed582220e", "comment": "Malware payload (AsyncRAT)", "value": "be458ddbaaba7da9f6d37a77064c996ce0803547d9cbdcb9e70643d8a7d814718e9ea4c1e8604233be97e17e5c828293", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909463, "uuid": "7c274ddf-85ef-4e43-bd05-d7e8cc179808", "value": "T1C5A38E116BE5D11BF2BD4F38A8F32242827AB8E76603E60A1CD034975B33BD155539EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909463, "uuid": "56f9c47a-0543-4941-896b-426c41b105a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909463, "uuid": "4d882a20-23db-4e46-afc3-6fdc3d4bad8a", "value": "3072:DuYqTsAvSX2rx2Wu3bzNXketnRPF9EVnb43jaI5grEO:DuY6vSGF43bRXptnRPF9cCGrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786909463, "uuid": "b0bfbac8-aa7a-4e87-a757-0f1cea03f218", "value": 101376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786909463, "uuid": "8a656e66-bca9-4221-8f29-97bd7dd80490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786909463, "uuid": "f653fd00-c26c-43cd-97e0-6d497f5ab796", "value": "ChromeUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf760b7-991a-11f1-bd95-42010a9c0009", "comment": "Malware payload", "timestamp": 1786847312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847312, "uuid": "f78c75fd-fbfc-4459-9ba4-88a24e5b5505", "comment": "Malware payload", "value": "c99c5309ddb31e3279a837bf0b8e31f8", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847312, "uuid": "497e301b-e749-453b-879d-97e6b43c162e", "comment": "Malware payload", "value": "ff952f33bf27328caebb9ec9df979396c725a45cea5c516d81d9a309d6a77169", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847312, "uuid": "2ff1465c-e54a-4e72-9a3f-227992eb65e5", "comment": "Malware payload", "value": "666e55a6b3e4e37c3d0eabe6cc61f3cd29ba9014", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1786847312, "uuid": "9844d406-b615-42f3-a4e3-2f4dacfeb136", "comment": "Malware payload", "value": "973dd788319525b2a50fd6109c41ca1741bf2073325d72ab0d239b0f0404fa38308023947519a6c7d8483a3e951f1ff7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1786847312, "uuid": "8689af61-6e78-4184-b76c-0de6a66483cd", "value": "T1BE463317CF0EAECED7F2E3389332602B91377564478A9397E9A452A068F76E0CF56540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1786847312, "uuid": "9e321417-1fd7-4966-9d70-5d134e5eafe5", "value": "98304:6FlpyF6pdjoS4q+CKXSwYluEc2ek3xepzgvO13hnVeZ0gU:R0qq+CKXSBudxdpzgW133w0gU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1786847312, "uuid": "e0b26719-6bbb-497d-abea-2c84cbcc3400", "value": 5730733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1786847312, "uuid": "7590455d-6d47-4685-aab4-1e07f2a11695", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1786847312, "uuid": "5841e6aa-80b6-44f6-a44d-17d66b1027aa", "value": "C6BANK.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }