{ "Event": { "published": true, "date": "2025-11-08", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-08", "timestamp": 1762646581, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d3ff0b4c-c43d-4cf4-bd42-2e0c2491f98e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a9e68a-bcfc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762645097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762645097, "uuid": "e0741b2e-2253-4044-a363-42223a7b8fe2", "comment": "Malware payload (Mirai)", "value": "12cac1874e2e937ae47a0252629526a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762645097, "uuid": "7a02e7c1-ae7e-4e40-9c3d-d60eef2359d2", "comment": "Malware payload (Mirai)", "value": "001966e3134d634ab42e813aeef8090d031e165d03ab348b0ed7bcc1fa200299", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762645097, "uuid": "757ff6ea-2906-4213-8a91-32a1c5d3ce43", "comment": "Malware payload (Mirai)", "value": "ceb0d34dfb603f1c4600e7f252449d466cd45098", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762645097, "uuid": "7115050a-7ae9-450a-a5cd-38c5ea137bc9", "comment": "Malware payload (Mirai)", "value": "c3994266cc94a0e788fe7f95b035e78fb4558bb8fd1af5a4711e1875bade856247a4586bd7f563d43024dfe0d873d261", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762645097, "uuid": "a9bb7bd8-caa3-4691-9bd7-f060afcb31d0", "value": "T16BA33AD6B801DD7DF80FDAB78463450EB931E3611A931F276367FD97AC320A44826E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762645097, "uuid": "b1bdb4b4-9ba6-460c-947f-677bb677ac1f", "value": "3072:NWKPmHlO+JlMRhU8MEtriwclNPAFCyXP1VAsT:IKilOIlMqqeweNr+AU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762645097, "uuid": "1c776c1b-6012-40fd-be24-3473e2ea55cb", "value": 100496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762645097, "uuid": "d03b2afb-569a-4bac-b101-09d25247c6ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762645097, "uuid": "47bbce56-6de3-4e88-a63e-ab68f97bafe3", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97958718-bcd6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762629030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629030, "uuid": "9deb694a-5c9f-49a9-9fdf-3b48cd27701e", "comment": "Malware payload (Mirai)", "value": "7b923620dc5f7e21c0a822da9ef84e0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629030, "uuid": "2a263048-e340-40ea-b2a6-8e36c9c1fd58", "comment": "Malware payload (Mirai)", "value": "00dc2af81d297b2a1fd554e3363a71855afa18fcff8250fae68402180b78433a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629030, "uuid": "0f4d2293-7104-4cae-b0ae-2ca264df0600", "comment": "Malware payload (Mirai)", "value": "fa41f77246e71150b2ba564490259d73d92d7ac5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629030, "uuid": "20012ff3-7c96-4f55-be86-4eb9913a312b", "comment": "Malware payload (Mirai)", "value": "c77a89e934deb718014cf8219b86e0df5dbff5626a8b49eb263659618fd7daf69d567f27fa40263c33fa76cd35eda581", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629030, "uuid": "8f31a802-f1ce-4150-a17f-cbcb7213622b", "value": "T13313F2030BF443C0D9AB78B9C6ECFA593804B52D72ACC390DB5876353459EB9266E587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629030, "uuid": "eb9db8f7-616e-441d-863f-3f62b7627e02", "value": "768:dtR1F5zSGzTvG3f91s5b6xKtx4N8azqSjMo9W0xrRnXYfeptnbcuyD7UGQRji:DRVG3F1sGxKtp2qUMWWeRXYmrnouy8G9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762629030, "uuid": "75b0bb36-d291-4943-8cf1-81348ddc92fa", "value": 42420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762629030, "uuid": "3dffc0a3-d2a1-4f65-a81b-4f96469ab07e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629030, "uuid": "caeb2798-e063-4929-a927-a1916b173bf4", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ee7195-bc9b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762603463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603463, "uuid": "5d68c4b3-14ea-43ff-b467-64c100402e7c", "comment": "Malware payload (Mirai)", "value": "b0a742dab60c4cab16e8679c5c7495c4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603463, "uuid": "dc1eba1a-b4e3-47f0-a628-4b3d16eb9c79", "comment": "Malware payload (Mirai)", "value": "013e3d0d6b24ac832fefab30c0906b0e6e39ef9c2aea310ff2729cb3509cfd08", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603463, "uuid": "2180322f-b097-4887-ad3b-6b2fb1e08a15", "comment": "Malware payload (Mirai)", "value": "81279fc56d97dfd17f194f2a0694e2290758c30b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603463, "uuid": "3b246bb3-a6f5-4916-967d-7bfda6750132", "comment": "Malware payload (Mirai)", "value": "d274a94523e4c3ad6dd8e02b8928673deb817e72cf7c8a0a27ade4dae6ff90884667158cd6a9354fe9efbe70cf58ea2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603463, "uuid": "6cc58c4d-9a6f-4a46-a26e-de17269611e3", "value": "T1D4833A22B9361D27C5C468BB22F34725F2F6538A35E8CA0E7D620D4EBF256503187AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603463, "uuid": "5d0828ab-011a-48a8-b36b-8b92e7267a6a", "value": "1536:Eeq8buV0D8Imq7A2yWtWwOt5RXXAhsPtPyMGv:LdbuOA6Qd/lhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762603463, "uuid": "a7df3284-a701-4e38-b75a-3a1b6c299a5f", "value": 88580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762603463, "uuid": "60df1429-1c40-4000-9d8c-5a22acbc7f17", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603463, "uuid": "919b2326-6dec-47c0-a867-06ed5940fd2f", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf961b5-bca1-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762606433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606433, "uuid": "87501f84-90d8-4883-8827-d78eac65132e", "comment": "Malware payload", "value": "9637f791f0155ebb2ac3f3055b0c55c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606433, "uuid": "de6bdfaa-8b75-4178-854f-208fb72b8525", "comment": "Malware payload", "value": "018bbbca5717f4c38f47f152f6b6a49cdd472738cfcffac67368c1105514aa8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606433, "uuid": "efe3cbe6-2867-4a95-9b6a-b6a3caf89bb5", "comment": "Malware payload", "value": "cf81ea58bd362dd77f415906c670b176afbb0e9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606433, "uuid": "cff51b59-92a4-4136-acb5-c149c44d9e71", "comment": "Malware payload", "value": "31d370bcce1fbb7f951b2b840970169bd5186638d78ed6531a5fd895a7521006a8f8d1795e738127b05849fa0b3a3ccf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606433, "uuid": "ab6c821e-ad6d-4a3d-8cd5-f8737a24a4eb", "value": "T1233412195FE71E3FF580B8F39E09E21970532018253BF515299065E7A9ACC8B4CB6A3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606433, "uuid": "246c82b3-dcc9-4c34-af79-649ee3527868", "value": "6144:o0jU7Gek8qN9jB7RBJ5DE+1slamJBtBiBwFwQIdWxp872wUWY4J:Bo7GeT6R5EHB7iBBHd48CNWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606433, "uuid": "d861ce0c-4980-4c06-92fc-c436836bd642", "value": 232732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606433, "uuid": "613c15f9-7891-4e80-95a0-3df1719a3697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606433, "uuid": "9aa46ede-58fb-4375-b427-383fa34fbf5e", "value": "executor.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51439772-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762620751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620751, "uuid": "91d5c4ac-6565-407b-976e-d47acc6a2941", "comment": "Malware payload (AsyncRAT)", "value": "7e1f66ac24b749dadfd910b20157b4a5", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620751, "uuid": "563ccae0-5aa3-467e-96c9-d2161cbe1636", "comment": "Malware payload (AsyncRAT)", "value": "0199f567563ec04277169b9e8a12c57844e4a1b242b858d3c1bd1861230f5a43", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620751, "uuid": "6647d7ad-8ff7-42d2-b22e-6d9eb0947b83", "comment": "Malware payload (AsyncRAT)", "value": "66b69ed336d541df0812171ca68f06b89e5095f9", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620751, "uuid": "62cff71e-e3db-46d9-9f9b-ecef629137e2", "comment": "Malware payload (AsyncRAT)", "value": "919ab15ea7af47c541935424dfad0166af3a1abb879596104e66bbd1bd3538458d357df4bfefe3cc724bf77cd92de830", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620751, "uuid": "88b82f8d-833c-4292-be74-dac091319fd1", "value": "T15934A0603BBC65C4BE801C2B435CB945D6DDF11252623508A5A2BB7F4403E66EAEF74F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620751, "uuid": "87b31a2b-6516-4a8a-a449-7ecd9c34f014", "value": "3072:iOoOpbHV/H/bfvfvbfwlr2HUYobFl9qDHvueHWuoCEf5f6NmyEHpRbaJHSUHijfM:Es2WDVUkIwC09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620751, "uuid": "4ed40514-4fbc-49af-b18c-d238283abe37", "value": 234953, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620751, "uuid": "96e993fb-16d4-4714-8eeb-b7879efb14cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620751, "uuid": "30b45f02-858d-43fd-8f39-48b56d66c138", "value": "PaymentAdviceSwift.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5ebb358-bca6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608438, "uuid": "14a1ef78-6aaf-41cb-ab9a-b9bfc150b95d", "comment": "Malware payload (Mirai)", "value": "2c485f6407ae168560e8e887762a6dfc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608438, "uuid": "0e5dce07-0d25-46a9-9ffb-57e75f05a387", "comment": "Malware payload (Mirai)", "value": "019c9a8ef8f0fbce116735ad3c18ecbe441885bf10f0790c6fd1f16e8c5cdc95", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608438, "uuid": "5a4caf40-7216-4cf5-9b30-811c40319639", "comment": "Malware payload (Mirai)", "value": "47e49dbd2faa99ea4def2bbc68d09ff60aef476c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608438, "uuid": "7a7b5e3f-1322-47e4-bb21-74e3d9c8398b", "comment": "Malware payload (Mirai)", "value": "f2d191535dc4ad863c89647a640fd804dc8d2598cc2b6a70146a24240c3279fb47854b323e9c1016e4db60441928ddca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608438, "uuid": "e5ff3f17-0eec-4cbc-b96d-a72ba0c447d6", "value": "T1FDB2D098FB98A831D574583EAAC8C7C1796BCF79C0723221B9C4D638B4DA00E13B9D16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608438, "uuid": "59ca8be9-c22c-45f4-8c92-b2608443bbec", "value": "384:K/QKh5l+d7bXu6IApaoRgp0ulYDLS20RkMqh5HhoqD68l4lcnhymdGUop5hn:hdleApa/p/SDLmyxhFD5ljns3UozN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608438, "uuid": "3eab3b3a-de48-4ff9-b26b-9e0661d42ba7", "value": 23528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608438, "uuid": "f8ff50bc-f379-40a2-a313-05dffbf7b23d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608438, "uuid": "f641a458-152e-4397-a284-a3b6911ed6a9", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a82d0408-bcb4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762614455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614455, "uuid": "62de19e3-ce61-4c6e-bb3d-08ec0cdb4e69", "comment": "Malware payload", "value": "9743fb4edffd0a8a2282f3feb9db1101", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614455, "uuid": "20d21ba8-3e95-4849-b7da-bc33cad8c1ca", "comment": "Malware payload", "value": "01f02ba27700a72a171a890530ff6c72b6c0b9dceb2cc8613a6b3b4fef311ba7", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614455, "uuid": "cbbe04f7-6730-4256-a0a1-d784eff7aee2", "comment": "Malware payload", "value": "a4fa35a6476ce182e61bc3c218572b2c1241f637", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614455, "uuid": "9330ee13-f921-491f-9989-22c3a8c4dbfb", "comment": "Malware payload", "value": "62a1470099113da139b827a738302daea1ced488e63e8c9122a27c7d4e5aae2baf24fd7a85f24e00a8ee3933024d9d02", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614455, "uuid": "925f3b35-bcb8-48d4-8dc2-4d649fc9e23e", "value": "T1F03633CF8CE10F6BC94676A8EBA7E784ACF4057A189424DB18AD1B0076DF7F1448F495", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614455, "uuid": "2f00ef17-eaf3-4999-a7dd-b2c443069fba", "value": "98304:cnuH6pyvDk8TOIEAKZePoopPMGF7Y8KGLZlv+M5AXDshfHlYgrfDDEXYdU4v:cuH/rDhEAIl8aKLp5os5GgbHTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762614455, "uuid": "b56c37c6-5073-48e8-848d-80ba21c7ba01", "value": 5348221, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762614455, "uuid": "64fe1447-9606-4d38-a2dc-727ba17fba85", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614455, "uuid": "3ce86e8d-a0d1-4245-bf06-5c75fb0c1571", "value": "file_100.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f33943e-bcd9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762630250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762630250, "uuid": "df8a9b5c-ffb2-475c-ac58-d1dd85424cf6", "comment": "Malware payload", "value": "a24af30030204143b54d9903b1cee543", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762630250, "uuid": "79e147bb-d6d9-4c02-9925-321cd89264af", "comment": "Malware payload", "value": "022c001b1f5cf76695b8b76c82f2054c1ecd1da81cce2534c04b0631b6a6170a", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762630250, "uuid": "ee6f28b7-7e56-455d-97ea-bb64f3aeda4f", "comment": "Malware payload", "value": "e32d819dc90fb252e8b4c71a0d9cf80e1785c6cc", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762630250, "uuid": "279406b4-90eb-4800-b0ac-8e8538e375ce", "comment": "Malware payload", "value": "28a5bd2bf4e10203eb6e2eed293c922a2c74163997e699b6e0f95792d8812464b4642bf5fac4d04ae91b4d330592e2b6", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762630250, "uuid": "85985d3f-3a9a-483e-a744-d2ba1eda47b0", "value": "T1632107FE0C3429231C94E969E1D523CD71198EFAC8258ED0EA4E362DD984A2C3859DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762630250, "uuid": "baf4def1-6946-45ac-a55d-ee54b7e34901", "value": "12:dajaqw9pt2aPqw9DU2av8qw912aoqw9x2a0Qqw9r22aeqw9r2aWyzqw99G2aDqwC:0Er7zSgiDZd6qLBsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762630250, "uuid": "f13c4fcb-2087-4696-86ca-58930c96b8c9", "value": 1369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762630250, "uuid": "904a46d4-1e10-4ab1-8762-0bf01145ed69", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762630250, "uuid": "b15b284f-6ef1-4638-b0a4-2b51fb15c02f", "value": "res", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d06d49-bcc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621942, "uuid": "5f305333-e293-45c0-8e99-9a8025aeb96f", "comment": "Malware payload (Mirai)", "value": "ddc6afdcf4582af0b6b33b6d58d8f889", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621942, "uuid": "e086ce88-bbc0-45d0-92ef-607c5316c72a", "comment": "Malware payload (Mirai)", "value": "032cbacf5e6a63a99b66507a07619c4a64edf49baf30c37bbf45d9dcdf5e3720", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621942, "uuid": "090f7ee9-4bbf-43d3-baf7-87be12f28d5d", "comment": "Malware payload (Mirai)", "value": "988320f3dec6abd146eaedb0a23774bc106e37ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621942, "uuid": "6169a859-ed0c-44e3-9d7a-0f22acba3eb7", "comment": "Malware payload (Mirai)", "value": "2cc84a58e3e31064c80c3f066cfe7717c8c9cff35ffade39099834e6123c7d276c43019aaba4c4fa93dddff093da097e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621942, "uuid": "1abe44d6-48fc-4dab-a2e4-d4f91832315a", "value": "T17273A70E6E259FBCFB9C823587B78F21965833D626E1C644D15CEA011EB034E741FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621942, "uuid": "c0a2a043-61ef-46fb-b12f-419e9f00ce36", "value": "1536:zoVvPLWTs7ys6XcniEyNMV3sDmTRdVSabdza3TTLbwXmP5d:zo5WTm6XouMV3sDmTvVSabQ3TTLbwXmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621942, "uuid": "fc4f9f80-c22b-4193-b054-e0aeab760ad7", "value": 75976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621942, "uuid": "c1fd3b8b-e846-408c-9b7c-437dadf23c44", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621942, "uuid": "b30f1bb0-80d6-4ae2-8906-a9149d4c7ae6", "value": "jew.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d611ce9-bca2-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1762606518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606518, "uuid": "086bf37b-297c-422e-adba-730e37eed0b9", "comment": "Malware payload (ACRStealer)", "value": "0c5e3ff94f8c40b68ccab4187fa9adf0", "object_relation": "md5", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "78-46-204-134", "colour": "#BFE8C1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606518, "uuid": "1db7baf5-90a2-4ec9-9c0e-a56c4b57cc12", "comment": "Malware payload (ACRStealer)", "value": "03c3e5d36e6297e798dfa57308494f26e4d651a034fe11aaaa0fb848dcbfb12a", "object_relation": "sha256", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "78-46-204-134", "colour": "#BFE8C1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606518, "uuid": "a3f77684-0f49-43ab-844e-2220f0785d6f", "comment": "Malware payload (ACRStealer)", "value": "86d32475d53a4a24befce555cca6b33c93d18709", "object_relation": "sha1", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "78-46-204-134", "colour": "#BFE8C1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606518, "uuid": "dcede860-4b68-4635-bdde-95855a3927f4", "comment": "Malware payload (ACRStealer)", "value": "880b112f6e47efabe8577d4f60fb2992dfd39382cff37aaccb179cbf8df67c281bc9a7dc37813ad80a75c38ca594620e", "object_relation": "sha3-384", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "78-46-204-134", "colour": "#BFE8C1", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606518, "uuid": "5aa307de-c5d5-4c1d-9149-fe1997432d06", "value": "T11D3733E9C2168640A9170D340AFEB90DCAFA8D728123DBA59D5C028F1EDF6F175F9B11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606518, "uuid": "25bb3cfe-f6ba-40b5-9a16-1c69a42c4133", "value": "393216:Gd5EmNQZPwAdaDxAl1b4KnIhw6bt6Cms6wsyNTLhs8OqK4U20XnCY+JgK:GPnNBvDxO1b46Ih7bMCR6wsOT9s81bpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606518, "uuid": "1182de93-2242-435b-a53b-dbe2e72b2883", "value": 23044795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606518, "uuid": "d4b7df21-5291-45bb-a39f-87bff709304d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606518, "uuid": "3d4e6fda-5e9d-4a91-bd3f-a4d4aeda6a7a", "value": "setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b2e8f8-bcd2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762627139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627139, "uuid": "8f836558-0db7-4b22-b798-2bb9de95e155", "comment": "Malware payload (Mirai)", "value": "b5808292dc880e8305685a5ec767c320", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627139, "uuid": "9f764b50-3115-4203-aa87-bb0554423403", "comment": "Malware payload (Mirai)", "value": "042d43f122fe4f0349f34c358ed499ca29011ae4a35e147355cbf419d3db3746", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627139, "uuid": "d89cb99f-eb56-4c37-8c16-d9bca49940d1", "comment": "Malware payload (Mirai)", "value": "2c730385419a9f5f9c4ca6f075bb8158dfe14a01", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627139, "uuid": "fe5d8dd6-6598-4b16-9386-f284e45e605b", "comment": "Malware payload (Mirai)", "value": "8b4efd512c60b8db9f4a5612e63aad2e9c953ce0c89b5d36dd08f988ebed09dcfbf0e9490fc929f44891a14c11a84034", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627139, "uuid": "b4f44883-8e6f-4b62-9a4e-5b4f89988c8c", "value": "T19523F103CE912FB285F21938F57ECF07CF0763F4E4AE7636592417485AA10A296BE947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627139, "uuid": "e887c188-9f1b-4602-aa27-c2a56e625d8c", "value": "768:e9QKOMAf5eowzWx1IDyqNlK9QFgFFtBhsDcHwBaRoFXRDCZthZei/9q3UELu:yzA+zWxiDyKMQOPtBhqcQBZV1CZthZ5b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762627139, "uuid": "b7b6387d-1312-4ed6-a941-c9358189ff9d", "value": 45732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762627139, "uuid": "1755fd20-6b6c-4062-84f2-4eebc03fac36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627139, "uuid": "e2cc8aca-5262-4761-ba96-a22c157fe6a2", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1787785e-bcc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621943, "uuid": "011c1f96-2c15-46d3-b792-abe5261abeee", "comment": "Malware payload (Mirai)", "value": "46cb8405b70b70846d1c2943385408f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621943, "uuid": "1eecf593-88b0-46d9-9d06-f6abe404605b", "comment": "Malware payload (Mirai)", "value": "04585fc9c6e4e383c5d175d537bd3b9bd322208e1bd0824c0554aee8134051e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621943, "uuid": "ca4a420a-ee11-4d98-a2de-d942dba098bb", "comment": "Malware payload (Mirai)", "value": "1b0d836663bb9d75f304ed2099a7479254f6b163", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621943, "uuid": "1a1616cc-58b0-4ef0-b96f-661de8d9845d", "comment": "Malware payload (Mirai)", "value": "b26ed27d74a4c0a00c9896adf6eff9099b445f45c0d879a144c60b1610d4b51105a503a688d514297ba63f3b232d8385", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621943, "uuid": "8f15c5c8-3bb4-4b22-be62-ef633ca5df50", "value": "T1ED436B256A7A2E17C0E4B4BE22F74754B2E1665E25E8C61E7D330E4FFF21A50A0436F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621943, "uuid": "82b7632d-1a6e-4be4-a379-d5cb1540523b", "value": "768:Cuopf8bQPAZqRU+fECeU6tq9bXV85PnXIsf0lkgUI7O+qoSJ/8:CuOoQAqRU6ECeU6tSbXm5PX5Ifn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621943, "uuid": "45ae19da-b774-4a1b-adb6-795ae8c71bbc", "value": 59664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621943, "uuid": "caa16250-22a0-4a85-b9ca-42bf33d22751", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621943, "uuid": "0f4c1239-93af-4da1-8c6c-43e5d273709d", "value": "jew.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850789f3-bcd8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762629857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629857, "uuid": "7d2d7742-90e1-492e-8a86-836170ff64b9", "comment": "Malware payload (Mirai)", "value": "0a33d038cc5295eb056adcf25665b3eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629857, "uuid": "fa41ca74-c598-416c-af26-553286cfc7df", "comment": "Malware payload (Mirai)", "value": "04a7c37ff3ca6f6473ca1843c1771a1eac9ab5455bb5a10a399b92ccf6abd30c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629857, "uuid": "94cbc34b-d1ea-42bb-abd4-a4cd3b662bdd", "comment": "Malware payload (Mirai)", "value": "4ff3b3b14114064028cfac076f376e3aa12f3a00", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629857, "uuid": "3e0080e9-5bfa-4d31-a08f-1e67fd5f2d2b", "comment": "Malware payload (Mirai)", "value": "6bf51b885e7c97529a64e827fd5205f5f641e2d04d2b565c5f1b4d1c96fb80c918ab9535dd7c1c7c6e649d9ae2f1261d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629857, "uuid": "d90cd7ad-759f-4058-8ef3-ea8d760965f0", "value": "T172838DD4AAC3D4F5FD1209751177AF3B9AB3E53E206ADA87C3A8E537EC02541A80725C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629857, "uuid": "e8956d87-46b6-49ff-9911-b1f8b4feeedd", "value": "1536:zESkLgL+xsdwXYvPFnxjqulHbypfqjDogiUZSZKr:oSz+gJtx2mbyoPojs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762629857, "uuid": "5ccb98d5-f744-4318-9aa4-005d3d06898d", "value": 83220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762629857, "uuid": "acfbd554-7f25-437f-8beb-a1691e3f1de8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629857, "uuid": "8477e2c0-7b55-4dcd-a899-02e6f9f49b46", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99a418bc-bc86-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1762594673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762594673, "uuid": "84de9ddc-18c6-4075-848a-50507cc8e13f", "comment": "Malware payload (njrat)", "value": "37738a8f55a993452b58fc652b114d18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762594673, "uuid": "c9e836ca-0448-4426-b854-baeeaf85d78e", "comment": "Malware payload (njrat)", "value": "04c820bd9c5fbfa5006e89e0b265625b1124e15a1e38cafb5b0566557e72466e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762594673, "uuid": "84aa7efd-acb0-45d6-86f7-71c8626d2700", "comment": "Malware payload (njrat)", "value": "422338bb0b2661de6eccfba354fe6dc706a535ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762594673, "uuid": "363e6112-0ea0-4034-884e-cb6baeb796a0", "comment": "Malware payload (njrat)", "value": "be8603bf4fdb0cca43ead21a9c24ab8bb9876c8f655a34e06c952b338f1e3001dac30cc5869cb0dc0de0848534e258bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762594673, "uuid": "4ab9e82a-f124-4294-9810-c1d54398bfc7", "value": "T1FF24395237F4C92BEABF07B5E4B1122067B9E1079162EB8A3C8C15F95F53340992276F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762594673, "uuid": "bb8ff665-966d-4074-9e0b-c0abcbd31d9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762594673, "uuid": "d6ee17c1-5bb8-42fe-87da-ec080b1959f0", "value": "3072:V6+7gWZt09hUeTHIhlDSEHBAnpK37nXo890EmQ5FgPsk74SyJhMvSKPe+WZNPRPC:V97ht097H4E8hrgPoseBPRPIIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762594673, "uuid": "773ad75e-002e-4782-abd5-fe4b9ef8d8a1", "value": 225792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762594673, "uuid": "948fb039-69e5-4493-a50c-0c277d15ac3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762594673, "uuid": "57769291-ea87-4f21-9fc5-72249478c839", "value": "HackerApp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5670c48c-bc8f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762598426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598426, "uuid": "e2e5f63b-a960-4f7d-9cf0-3469fe1a0539", "comment": "Malware payload (Mirai)", "value": "07821170295282bffef60552b37e48fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598426, "uuid": "87684292-9ca1-4a00-a6a9-c6cf8a428b62", "comment": "Malware payload (Mirai)", "value": "054418bdc21446fb7401f48592fc7dd9e45688be4c35f6efd5818cf272f8a213", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598426, "uuid": "ff28fc4e-07b3-4e1a-945b-708861e2a2d3", "comment": "Malware payload (Mirai)", "value": "c7876d49b4f217c86eb7b9be07fc9a531f9c127d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598426, "uuid": "792de4af-d878-4052-8362-3bd40099da24", "comment": "Malware payload (Mirai)", "value": "2c38c305f6ce619afc57edaf93df9c8636b625d7bca99465bad282431bfff562f1f4a72aba76934b6e3100d528023843", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598426, "uuid": "5840b7cc-994d-4dcd-9eae-90339f119801", "value": "T13413F10EDDA62117EB4DEEBCF0F82197AD501995326D0B8C63529CCCF91E8A9E89C158", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598426, "uuid": "61dc8e23-ca90-41c2-9690-e9856b747551", "value": "768:PX/H8VpygBGEX7tcw8GyreOLSygxoMCzw0ZW1zt5RnNWG7shSeqB8plrWN:XeIAGEX76YdOLSLSk0YVBMkgqB8p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762598426, "uuid": "39ec379f-b19d-4cc9-99a5-43cd4f3c4c7a", "value": 42252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762598426, "uuid": "86c09742-98db-47ad-b7af-63ef7f4d0519", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598426, "uuid": "1c822c8c-1e27-4a3c-b433-404d9f382a86", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f99248-bc70-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762585116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762585116, "uuid": "6c1fb358-2e14-4f0c-8658-5e67bc094ece", "comment": "Malware payload (Mirai)", "value": "40508313140f9216e98e85770ecd732c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762585116, "uuid": "06959874-9377-4a78-b579-c23afe26ffb1", "comment": "Malware payload (Mirai)", "value": "05b390df3072f93e2b84c782f27d6e5a8f84e5fe5a6b96733693e62f1fd56a1b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762585116, "uuid": "c0ef8ec6-43e6-405b-90b1-f28f39fb3fa3", "comment": "Malware payload (Mirai)", "value": "a795cf08e48b9486708fc4e3b68b354418ec70f8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762585116, "uuid": "b2754de5-0c0c-4f9c-b277-30741b125dc5", "comment": "Malware payload (Mirai)", "value": "8a4dba93d68dfbea40581e6b3c06436768b6005688cde1be6b5de5f52739a62610122da8e4d30c670f2dc09d1009814f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762585116, "uuid": "ec597682-ea38-4420-a4ad-017c58292eef", "value": "T12BC3D75D6E329F7DF768833047B34F61A78C239226E0D685E2ACD2145E7434D681FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762585116, "uuid": "fc2011dc-6e65-4086-9f5c-589d094b4b2a", "value": "1536:rtXG2IY+AGPeq9jCM+H00FuRoFLKIkL5AHp7o9XnwmqdSilKjEoeVHSflzqF0JAx:x22P+AUj8DFuRQKTQfndSiUIih2fVpN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762585116, "uuid": "a336359f-6a9d-4c8a-9d21-66a52de93460", "value": 124676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762585116, "uuid": "00353eb7-707b-4bd5-9fef-7056cd481c9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762585116, "uuid": "efc54d38-10dd-4041-9367-1cb858657165", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b089b5bd-bc9c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762604161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604161, "uuid": "6f61555b-1fa8-4f52-9cc2-4792532a2760", "comment": "Malware payload (Mirai)", "value": "aa6837b0f2f90b0f5ed2cd3edb18306e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604161, "uuid": "97df95cf-b1bb-4a71-883c-62d5173fbf93", "comment": "Malware payload (Mirai)", "value": "063753e2b18bec108b1088ca2229ecfa3b4b9631b9f05de733112ff8533b8ea4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604161, "uuid": "65de7ad6-180a-4c0c-8772-6979a46160dd", "comment": "Malware payload (Mirai)", "value": "1ae694864e07837c96d8ce66a934f3fa83cd0b30", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604161, "uuid": "85795245-38b1-4927-a4d9-226cfa3e2706", "comment": "Malware payload (Mirai)", "value": "c82b2a2741558ba5f72982c4b808dc03f49a07ff9c37d1010543e2e4ccac57bf5dbab44c704a4ecb0a52312abda38faf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604161, "uuid": "9f0b6a1a-93e7-4ab4-8699-c6c23ac9bc45", "value": "T1AB03F102A0E0E3C0D92A417EB29FB9062673657C4DE048972F583D73F656732E76A3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604161, "uuid": "0a4c9851-e11b-485b-a51f-1fccb8462fbb", "value": "768:gSbw8FwnvKqLSnlgsRsCk73TWjVuCPXjETEPZY/cF4dA95KS5+JnbcuyD7UHQRjr:lbn4LIlkCk73ovETEPG/Y4dryYnouy8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762604161, "uuid": "aac5d018-cf33-4160-8a52-61af53aa0f38", "value": 40028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762604161, "uuid": "2d390416-ee10-4ce7-965a-6ee21ee5aaa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604161, "uuid": "26e12b3f-a441-477c-8d21-1cf33648b44e", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bf44826-bc77-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762588100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588100, "uuid": "3175be99-a71a-4460-8b66-e68301b6866b", "comment": "Malware payload (AsyncRAT)", "value": "b88585655656458c28e4f3ef94b2aaad", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588100, "uuid": "f33aecb5-042a-43ab-b4a8-9d9171b1c008", "comment": "Malware payload (AsyncRAT)", "value": "06a4a41c68f50d492f22d40dd5c447d874be29c36889263c18bfa025e4448bc1", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588100, "uuid": "97a83d84-86b8-4631-8884-dfac232266f9", "comment": "Malware payload (AsyncRAT)", "value": "a6504406aa02ec6967b1f9956f91a40b92e7c131", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588100, "uuid": "7b71e661-d272-417f-917d-9939266dc490", "comment": "Malware payload (AsyncRAT)", "value": "8dc0b07b25b0349977d4706704a3c316e722264242ac2861237a0d34109889981d3493679ff5783c2b9c5dc2acd0f65d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588100, "uuid": "130c8381-c28a-4f35-9cf4-6cec9a4489c0", "value": "T15F16BF237DD94C6AD4532E318A8962B8A15ABFF07E7711032D8C3F2E6771283D516DA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588100, "uuid": "e02fb48d-9c38-42cc-af20-e38704ccabf5", "value": "5fe731a4062e1bf43baf4908e830f42e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588100, "uuid": "bc5a0dc4-83ad-46d9-b716-b3ac7b189f5c", "value": "98304:GSi1joThFTi/pST+JTGQwOiK4voj9ghi1RebMIg9Cbk/V6+XI:GQTPTMPwOiKoojDIg9Cbk/V6+XI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588100, "uuid": "bc398055-b058-47a9-ad0c-70860aed0fc1", "value": 4080128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588100, "uuid": "d347fcc5-daa6-4528-a3ae-00cc70dc4184", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588100, "uuid": "f89ce7d3-3b39-4f94-aff8-38bec9b76012", "value": "b88585655656458c28e4f3ef94b2aaad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7446272b-bc9c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762604060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604060, "uuid": "1b1cf60b-510f-40db-9000-9f449e280568", "comment": "Malware payload (Mirai)", "value": "f44ecf0554dbd5ccf8512ab9469b4e2d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604060, "uuid": "8c043845-f865-4df9-83cd-82951786a328", "comment": "Malware payload (Mirai)", "value": "06db06a52e1ffbfcb0f0b7a31c62eb89110c7058b90f6f6f7d8ecd02a4666a15", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604060, "uuid": "2804bf67-a3cf-4d60-adc7-e8506f4d5a07", "comment": "Malware payload (Mirai)", "value": "5d7944b566794fccfcd567f0b1d43359f3e3f047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604060, "uuid": "06839da2-2546-4e46-a35e-86c0c6f7b1ea", "comment": "Malware payload (Mirai)", "value": "6c159cb6f1bd6f98061ff0fd85f6ad0ec3d2519ce5b06369c46e94b0aaf6d3fba0e6eb710c1334926ceea76d04038acf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604060, "uuid": "7b102b52-ad97-4581-9cf4-db9580676652", "value": "T1AAA34A07B8CCC4FDC499E138577E7436C921FC6E027D766B27C4AE26298BEE02B19645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604060, "uuid": "bd0e3cab-c68b-4d56-bffc-7aa91aced294", "value": "1536:LvVwa2Boz5vEb1PuIruFhIbGceHopOouvCuY2Ra8UAfBuNr3kwrK:LvVw8a1GSuFKbG4kNvCGRaMBuNrtrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762604060, "uuid": "f0f43a90-bef9-4279-beda-93bffb21a891", "value": 97936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762604060, "uuid": "6409daf9-8cfd-4032-9fd2-99db9700c5ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604060, "uuid": "63c13e8e-fa55-4d86-a8bd-0c33e07cf95d", "value": "executor.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "861e8bcb-bc9f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762605378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605378, "uuid": "798fd63f-19f6-40a6-9dfb-32158d8eaab2", "comment": "Malware payload (Mirai)", "value": "59a4c4ba7513bfacb8c9064afd8ce0f4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605378, "uuid": "6a3d34f7-3516-493f-9e3d-51e3d3f4cff4", "comment": "Malware payload (Mirai)", "value": "073e5f0d17203bc5764d470dc3ebd0fb48c119aead78df616dd0d62b6f1634b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605378, "uuid": "e80f7b9c-47ae-4306-84ce-bb7825f789e5", "comment": "Malware payload (Mirai)", "value": "2246be6d7606297a79b79788ff0deb7f1ed9f861", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605378, "uuid": "8ce65dc1-c92a-43c2-85f1-9a8eddb16cc5", "comment": "Malware payload (Mirai)", "value": "84adeeffb6f5b771a22fea0d96b7c333ced2e09f783c9a928bbb4ea3b5d443fd4993ba51d7fe316f44a0b9c03c248b5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605378, "uuid": "0379f95f-30e0-4126-a543-ed07cb362ad6", "value": "T121B32A46F9819F11D4C732FAFB5E514933136BB8E3EA3102DD24AF6123C699B0EB6512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605378, "uuid": "f0546d28-926b-48b4-9029-4b1252b986a5", "value": "3072:7Lt3savg+haSCirxFFQ36gVGrCfIW0U2y:7L5hhaSCirxFGKg6CQW32y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762605378, "uuid": "f2271455-6735-4022-95d3-692d459072aa", "value": 111756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762605378, "uuid": "328983c9-b362-48a6-8678-1b342a5dfa8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605378, "uuid": "39a3337d-747e-4a50-9e11-257a4ecc2415", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8238059b-bc6e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762584326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584326, "uuid": "bf6cee8a-487b-4b85-b441-5ba14e09a1ac", "comment": "Malware payload (Mirai)", "value": "01e4a92a3c09c19d849c969833111007", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584326, "uuid": "60a2872f-934f-4052-8286-0daa5b0ac972", "comment": "Malware payload (Mirai)", "value": "07762b2af252bea0117358449b7a4d85101454d00a4c265bfd3ce066b21da568", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584326, "uuid": "a4f841df-03db-4a94-8b73-fb84580d793a", "comment": "Malware payload (Mirai)", "value": "1c0aab38788014c73692458492e95e693e5ef0f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584326, "uuid": "e1602cf9-a47b-4e3f-a9eb-cfc0a1490e86", "comment": "Malware payload (Mirai)", "value": "d7132c4bc89fb5c71012f8b7ffa79771f7626cb1380b2a8abb3e699c230f4fa0b3499c0cad6e6b70312801326129ce43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584326, "uuid": "54afc40f-cc82-4671-b795-dfd0c8b436f5", "value": "T1E4432A85FD92896BD6D4237AA76E118E3351B3E0E2CF3247DD285F14338920F5D6BA42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584326, "uuid": "6895a646-6fd9-4b10-876b-692a15e967ba", "value": "1536:GVbd+1Nd9oGszTE4rFUsV8349wqV28fMnL9ROt:Obd+1NdTmzV8o9wqJfMLfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762584326, "uuid": "6b2d1137-3659-4a83-b0eb-76b2f9041166", "value": 55244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762584326, "uuid": "506e753b-13fc-4ce2-b0de-e6632ae4a382", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584326, "uuid": "ef19fe57-4705-4dc5-815b-bbb05251660b", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3a460d-bcf0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762640124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762640124, "uuid": "2048ce57-e5da-4206-be60-7bfb4b5b9b54", "comment": "Malware payload", "value": "0ec111ec17145b8fa8701182c6edb9b0", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762640124, "uuid": "c7535849-216e-44c9-bddf-5f74f7f2eb82", "comment": "Malware payload", "value": "08ce991c5f2171a3f91ea98252084ebffcf420d823635350ef88aaaa4f549a58", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762640124, "uuid": "d178f530-9325-4ec0-b590-288e281f8087", "comment": "Malware payload", "value": "3391a89226e1152f452d19a060ca9764fc6222d2", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762640124, "uuid": "ce34076c-7d2e-4ca1-bcbc-9c7efe2c5e0d", "comment": "Malware payload", "value": "eea771674cf93030c77ef276c631e204848bc3fcf0b8a8770697ba98d13c2d3dcb6ac8882a2861417c8c3e05fd67d6d4", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762640124, "uuid": "72c6550d-7c0b-4333-be9c-48cfab7b77b9", "value": "T1A16533BD83636086CA36B4F9A26DC50F82055376CEA093D3080B57D56C7668F927EF39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762640124, "uuid": "17268dcf-2375-4069-908e-2883b3ccfa96", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762640124, "uuid": "c4a7ab7d-5ea4-4acc-9fbc-74b4b9231f05", "value": "24576:Jwz1JL6f/g3VKNgvRc8ebCu7uGs7buC/kYttAmf3h977hGt7u7S3:Kxpw43UNgJsBfs7bdJxx9USI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762640124, "uuid": "7630c5f9-7ab4-49b6-8682-4b043e793b63", "value": 1474560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762640124, "uuid": "c8125045-bc00-4deb-8ac6-9cd9d49a5a88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762640124, "uuid": "8511ded4-29c7-478c-b053-d800e584d152", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edc05936-bc87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762595244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595244, "uuid": "c93d5664-8c02-4c41-91b7-723220db242d", "comment": "Malware payload (Mirai)", "value": "1ab961211e6fadcf5a8d1b78f8e3ffd7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595244, "uuid": "6cdaaca1-3d94-4a47-b964-ded3ffe2dcf4", "comment": "Malware payload (Mirai)", "value": "094fc85a92118596cf8018ffd88e3527281087731fbd33f95dcc5fe305884bfc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595244, "uuid": "046d95d2-80ee-43e3-88f5-6438ef2b8a77", "comment": "Malware payload (Mirai)", "value": "64a5d2f80facc01a641b3179d060166b7a30f985", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595244, "uuid": "456d3282-d9be-4567-bde7-efd3d0a4c0fb", "comment": "Malware payload (Mirai)", "value": "5224df42ba2b07bad931bdc58474872b7e1255d6c56d00a552b55e294edf5f064704c4bb253c753274b62e742d7c1e09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595244, "uuid": "2ff68f86-34ba-48f4-8dcb-d32e2287f592", "value": "T18B733941BCD28B2AC6D423BABA6E619D3321B3E8D2DF3117CC144B2877C656E1D37A54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595244, "uuid": "f636cee2-76b4-4e09-89a2-1b7ad76ca670", "value": "1536:E/ZOBaEKwbhWiKN5EWUb1JB7ocXFKIqINd36k5yw0UcTEhyk20pPKQ:E/ZOkEKwbhW+x7f1K5IjpcQ4Z0pP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762595244, "uuid": "e4bbf1c9-9064-43f8-a0af-b6302b24406e", "value": 75676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762595244, "uuid": "ec80213e-5ea5-4ab2-87dd-a16dc8898285", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595244, "uuid": "b7e57aa8-036f-424a-8636-3abd79a2cc89", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "317669dd-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762602229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602229, "uuid": "15e796aa-a4a1-49b3-95ac-f81fd21c0252", "comment": "Malware payload (Gafgyt)", "value": "5987f75a38555744c007fa8fdf6c334a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602229, "uuid": "e36df36a-5acc-4feb-b18e-cf99b1908eae", "comment": "Malware payload (Gafgyt)", "value": "0a2cbf27c8bb563123b798a302ce9673620bc48491234052d6d28816568e40c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602229, "uuid": "516839be-5216-4e23-996d-02e51181918d", "comment": "Malware payload (Gafgyt)", "value": "a3c7c13c5a3b407baaec3318699bfef809c24059", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602229, "uuid": "0399aa0d-6595-4c40-9223-04160ee7b15b", "comment": "Malware payload (Gafgyt)", "value": "29378a5c4a3cfee4b80e8e6a08f2f22017ede5778df8a07841fc6c7d858717332aef70bc975f4ea221f119afb4a3e21e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602229, "uuid": "1153540c-23c2-42a5-9b4c-960e23bf72fa", "value": "T13BE32A06FC004627C2D12BB7B39B428D77225F695BDB3351EA287DB02FE1B991A395D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602229, "uuid": "b4ccccff-1cbe-4904-b87e-a050e3685de6", "value": "3072:uhRHih54YD1GMwdvkRu0VsQsBMqetJ8add9QzhsFR/wv6K1DNPx+PdX4TtQ6W8Gq:vfu0VtEMqetJ8addQJv66cdX4TtQ6Wvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602229, "uuid": "7e923598-1d42-41db-b115-a796f8c9ab35", "value": 146439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602229, "uuid": "ac57f500-4bd8-46f7-8250-dc9b51e2a2c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602229, "uuid": "dfdcb73f-78de-41a3-9ba6-b22d30dc4e3c", "value": "apache2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f41b233-bc38-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762561048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762561048, "uuid": "51318e52-d740-4c1d-8d42-a9dcb8c07789", "comment": "Malware payload (Mirai)", "value": "4fe36fe22a6e0260cb79ba23f4371879", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762561048, "uuid": "fcc253e4-dd8b-4952-ba78-3aa500eaca1e", "comment": "Malware payload (Mirai)", "value": "0b1fca7bb14177bc2d160113133ef7837e284394a206a1aa4795a592ec809b96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762561048, "uuid": "54a15076-b093-42d5-9d02-7a93299bf108", "comment": "Malware payload (Mirai)", "value": "91140122e86424088e42f9b0b628e4d6cc3e8c6b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762561048, "uuid": "ea5333dd-5819-464e-a129-5ce5e328ea71", "comment": "Malware payload (Mirai)", "value": "bda970c5625a7e9012ebce6d484c98065f7f3ef9a99b9ff6dfc3bb955b8be10b16fbfabf4487988dcfd9b980b4275ce5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762561048, "uuid": "19d9a4da-2a09-476a-a56a-bfe0245a306f", "value": "T1DB03F2341C6585CED46B50780B3C07E0A8316B6692C3BD16259EFAC6D8076F2A52FFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762561048, "uuid": "08f3175a-23a6-4d7f-9d25-97f6095b8da4", "value": "768:9F+xYaF57IpHNUbn23DqCxm3dnqERNCyrRpaOIQ5UVEdUu9cqCJgGlzDpbuR1JVE:9F+xR/gNUbn2eCIwERAkLaOIRN0+VJuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762561048, "uuid": "31062770-81df-48bd-b914-7e39f451778a", "value": 41088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762561048, "uuid": "4825326c-f26b-490a-bcf1-cb7efef4c640", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762561048, "uuid": "8cf1aaaf-acdb-48a8-9d41-4ea65f0e1d42", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18268851-bcc5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621514, "uuid": "550d7036-c37b-48a3-99fb-9aad088f1bbf", "comment": "Malware payload (Mirai)", "value": "be29b614e806b907164c0ff6bbecbc6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621514, "uuid": "6974ea68-ea71-4e6b-8afe-b37ffaed8bf2", "comment": "Malware payload (Mirai)", "value": "0b7436180fe3c4236362762d07309d999bc330442c6870a7be6fe36d009250bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621514, "uuid": "481b8b4f-728b-4d79-a94a-ba1e96efa00d", "comment": "Malware payload (Mirai)", "value": "f1347664afff80c01d248e2604144995eb43289e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621514, "uuid": "21a38e76-0dc3-408c-98f0-09860a16fa91", "comment": "Malware payload (Mirai)", "value": "f09d04d016f3ee552cd721a4871413c90b351204f1ce528cd7e55708d9f7f87ce956d8b442f2feade5f6c6bc3c3d8ad9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621514, "uuid": "fe71350d-5d38-416e-8027-7bcaa2b074c6", "value": "T17F73F1082459D210EF211736C89928898841A9D5D0EEB1FF312A5E2DDDCFCA32DBFDD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621514, "uuid": "45b896d1-2fe0-4466-961d-57e0e293512a", "value": "1536:D8IHq+kgs7VI83wgrzlEFSPO/hcoiisjuq5Z14LcLtBcGXUqh9+sadEO3dzzUCR4:4IHq+kOQwgrBEEO/h7iF6q5v4IL05DRs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621514, "uuid": "b820fff7-0f4f-4934-be62-b1fab88529bc", "value": 77216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621514, "uuid": "d7023541-99c0-4e72-99e0-fdf4e30ebdc8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621514, "uuid": "dae45dfd-79cc-4be1-a1e6-33775a4bcbde", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3860bf20-bcc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621998, "uuid": "b745c661-bbfb-4a5e-8482-2cd626770b23", "comment": "Malware payload (Mirai)", "value": "ddfe4c7340c610283e5d15d2098c342b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621998, "uuid": "83cf456a-4326-4d59-97ef-e9d538f5742b", "comment": "Malware payload (Mirai)", "value": "0ba30aa48d800018f56fc76af763193938683213c06bcfc161ac377d507f5bcb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621998, "uuid": "1858d520-cdd6-4ce9-99ad-aa2a183fb8f0", "comment": "Malware payload (Mirai)", "value": "b05d8dde9171d06215c830b2ed458aef0f2ce099", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621998, "uuid": "eeb14440-e03f-434d-8df1-87c255e74a9b", "comment": "Malware payload (Mirai)", "value": "0abae8dc6917900b0129bf925e259ebe77a44185ee54e89b7e3532fd3cedcc766a6e14afb46f118da80a6780357c7941", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621998, "uuid": "0e44d894-75f9-4ff1-8611-abe1cc476b91", "value": "T199A3068DF58BC2F9D90B49309026B2FFC731E4698171865EDF99EF35DA33581A612388", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621998, "uuid": "c38b00f3-2bbb-4352-80a2-59957e8af7ee", "value": "1536:2+nNWPOY4sJR6T0cY0x/Rh1XMVjeBwWYi2AVtP5QVHu87r+qg:2+nc7lD6wd05nO9Aj2AVtxQn+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621998, "uuid": "dc3031fe-0d02-41d0-948f-314fb13c918a", "value": 99636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621998, "uuid": "b1151b67-fb54-4729-8b80-a64456797ed4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621998, "uuid": "1afe9421-9f71-4c73-b964-0e50c8731099", "value": "executor.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45288af1-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588948, "uuid": "51675457-2408-4301-8297-ea2a2cc66bab", "comment": "Malware payload", "value": "0e11dfb716456945453ba8961ede5ade", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588948, "uuid": "45cbd261-8022-4ebd-a701-ee6d33df354e", "comment": "Malware payload", "value": "0c117a277fffbe9dc0f7ba50be31c50461cc24b28ea784b700188c68e420049f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588948, "uuid": "6269a451-4dc7-4501-b676-e9ad5c9d6fe9", "comment": "Malware payload", "value": "d33e702a484b893e6480fe7f183fa26912ddd753", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588948, "uuid": "9c8722d4-ba18-410f-a0c8-08206525902d", "comment": "Malware payload", "value": "61749b741b3a4db4e9a85815cc108feab1662053a99fbbc9b32ffa875d03428e8257060c45280a7d4106ba9ce163af60", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588948, "uuid": "f3a9a2fe-50f6-48f0-8f24-382fa29ca6a9", "value": "T13131EACA7E5A519B432A36904D5B8AA2D91041C31DC2BF3CF80C52A88FE71272D7ED6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588948, "uuid": "8726d462-d012-47b9-b9c3-b0eb2d80e159", "value": "24:kZybwvR8XGO9FYK4LLvV0eg8pAFxpIXNQtP6:kIwviXGOnQLbVYyAFZP6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588948, "uuid": "edb523c1-99cd-4240-9f2b-bddea03d3528", "value": 1632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588948, "uuid": "75ad9455-e38b-4eba-838b-487592202366", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588948, "uuid": "bcb93269-f41c-4f07-bc5a-0935eae3b607", "value": "114174 SEA FCL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f59fb9d-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588858, "uuid": "d5daac19-bfa5-47fa-95a6-da577828097a", "comment": "Malware payload", "value": "8acf95260389214b3ef7b6fd33540536", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588858, "uuid": "d4c3beae-c1bd-4e56-bfaa-cb1945977d3b", "comment": "Malware payload", "value": "0c92340ce798961808abd2dc52fabcfddc096fcc24238c048a68ca3c65b078e9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588858, "uuid": "a5b07792-32d4-4662-aaf8-e164eb27630d", "comment": "Malware payload", "value": "e44a582715a035b28510554f2816272ea57e374a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588858, "uuid": "25037574-87c2-4c99-9ade-37f1892c0673", "comment": "Malware payload", "value": "762a25a4c92f4f0f832c1168e8d7204704b72fb65355d54d3a21f48a66c4c0a4eea1ac3634a5edc93f5f56da29d44d59", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588858, "uuid": "64ec1a24-ba17-425d-a64b-ab996dd5c597", "value": "T181E0687B32817014816B33C0EB1C0A470CAB179A2ECC4A64D12914617E00BEC416ECA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588858, "uuid": "837615e6-be0d-4077-bae7-169095af681f", "value": "6:uk2IqXffzCtjg1mttVlOA/CLgFLCy6gCQU1X29HLCRCwvHKs/SIKMCUfokEwwzPf:ufVXf2K1mtXK2CMCQU1sHcCEHKR3DjwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588858, "uuid": "280934d1-5f40-4072-ae0a-3fa51cc8587a", "value": 381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588858, "uuid": "5fbc29bc-f4b3-45a6-b219-f9a78c495114", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588858, "uuid": "34d409d1-82d8-4372-a402-7041797c313e", "value": "newversionclick.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b35129-bc94-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762600537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600537, "uuid": "b9b5248f-9c32-4843-b5f7-96053f1eb973", "comment": "Malware payload (Mirai)", "value": "12c28a1f34429a2221afea3d92213c59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600537, "uuid": "480abc8b-abaf-4445-ba5a-58365834f044", "comment": "Malware payload (Mirai)", "value": "0cfb19d1ad33a0f9b109febeda9e87293e606535d10ac9d211a13ffa61bd120c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600537, "uuid": "439d6356-7766-49d5-8f56-1c7895d49f6d", "comment": "Malware payload (Mirai)", "value": "2133d69482eccf0fb9525ad7e4e2d1ffdd836e2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600537, "uuid": "927c1c91-0d7a-449b-bc81-a8789c2974c9", "comment": "Malware payload (Mirai)", "value": "1948928fb7e7de33547ad33263ea91b4734d850664a1f4f38c8678360e76b4742d238514f29c863abcda7f1cef34c47e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600537, "uuid": "21d62adc-37a5-4504-baa9-5f595325340f", "value": "T137D3E74ABFA11EFBE86FCC3745A9170524CC562721B87F7AB530C518F24A28B59E3970", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600537, "uuid": "64b20169-48ff-49f0-9699-5d3a98f410af", "value": "3072:8IrTVObumdzt8NCvR4FvlZr3j5E2emcw:lrxObumdzt8NmRsvlZbj5Fcw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762600537, "uuid": "7d6d494d-7088-42af-956b-7c95f99512d2", "value": 134420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762600537, "uuid": "790269a5-9eeb-4c64-ac3d-9917d4b78f32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600537, "uuid": "e2f15173-7eff-4fca-a8f5-e6baeac58dfc", "value": "executor.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab58f07-bc83-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762593440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593440, "uuid": "139740cc-735f-490b-8a21-c8d98d65fe18", "comment": "Malware payload", "value": "c41707e3bbf5b203708a9acc91e0abc6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593440, "uuid": "e0f9d9e0-c677-4886-8088-eeb7d460ff11", "comment": "Malware payload", "value": "0d1ce439a00c8b866bad3e01bdf2c9c78d4469c90f02f4f0d2104107cc68b7b7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593440, "uuid": "5fd59565-9b2e-498d-a5e5-c06f8a3ecea1", "comment": "Malware payload", "value": "fda65d05fb12846fafb97d225401e09caf8534cb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593440, "uuid": "54fde486-9bf3-40ed-bf0c-93e5ad086fc6", "comment": "Malware payload", "value": "be7220d01bf68f69cfe68ab0485d6ec12e5409b07a75d8e79a93dce8a2ea0ef74bd54e8340efb5e08f948486e6420fd9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593440, "uuid": "c30d5699-2622-4c20-afe4-3f0b9ef7f8bd", "value": "T107661203F74E492EDDE2BA784E9313716A15ACEC1410928F4902F218BEB76D95F25FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593440, "uuid": "3ac19945-1617-4620-ab46-e7180799f1ab", "value": "98304:8yi7EbjLnAxEbBgTZ4vALAZzbdTQ8mjrAl94s3irwBhkwH2UyOpUkKWxTaB7x:8r7knAugVYl5bdTQM9JSrEhPn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762593440, "uuid": "0f6b52b4-206a-4d5f-b3ce-670f935459e8", "value": 6984900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762593440, "uuid": "16f91b1c-d9c0-4ba5-b13c-d636baa78660", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593440, "uuid": "2e1c719b-df9e-4b0f-9b89-587d5c6dcb0f", "value": "TikTok18.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe8013cc-bca3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762607298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607298, "uuid": "e46cb372-bc0a-4e23-9155-5d03484ff55c", "comment": "Malware payload (Mirai)", "value": "d0de89494fa1e7f3e244acb094d4a462", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607298, "uuid": "47fa2f49-46d9-4398-b407-d4f958943161", "comment": "Malware payload (Mirai)", "value": "0eb150b0d3cc33563bc5d98ffb5cbf407619a3843d5a2bd9938c5e99121e5eaf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607298, "uuid": "af82caa6-29b7-4ed4-91ca-1149deb5856b", "comment": "Malware payload (Mirai)", "value": "851f81063418eaa515b23bde914bdafd47b029f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607298, "uuid": "ddce9731-deb0-4c14-9e80-b6dc2eabae69", "comment": "Malware payload (Mirai)", "value": "d40b592dad7b23901db85a7636f86805693cd91bdb2deeb3850ee0d45f62e14bd38d3a1b068f1abe544d6c60a1f5cf7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607298, "uuid": "9a453399-5036-415a-9e9d-d79f37d84cb1", "value": "T1A3F2E0E6B8E48F08E19E147B4A9E3E4E0D61D58FDA6089DB7CA434397D09B741E0C5B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607298, "uuid": "8734c7f6-fdd3-45b6-b4c8-80016deac443", "value": "768:TFypCA8oTZs0imoRuKWgNd+I+H+gbiK9/JsFlacvgsrGBnbcuyD7U9URF:JyCoy0ikKHdfCbi4xkY/sonouy8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762607298, "uuid": "0d0a21d1-c7f4-4250-b709-e0a09609a9e8", "value": 36636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762607298, "uuid": "73cf5955-df74-48d5-b374-e6e8f2120500", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607298, "uuid": "1779b1fb-0e63-4605-8d6d-ff6a167ebbff", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c7e299-bcca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623686, "uuid": "07a3a532-73a9-45f6-a9a7-9cf910c57759", "comment": "Malware payload (Mirai)", "value": "3423d79511347b50d5b7bc7c2e15fc76", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623686, "uuid": "5d363da8-1442-41a3-a459-e10fc854324b", "comment": "Malware payload (Mirai)", "value": "0fd27fa54236fa6d221c26da02ee733881cf6ef449227d9123f3b1e2f9f4f918", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623686, "uuid": "8f96591a-9abe-4d5d-9d17-5580bcc78207", "comment": "Malware payload (Mirai)", "value": "feae8ccb94859d4690a002874db32b3f927d4fb5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623686, "uuid": "4a31ef1c-7fdb-4eda-99a4-389da05038cb", "comment": "Malware payload (Mirai)", "value": "a02050232779f53c649ae8c932cfa538c7170c3d5c6b037aebf82698ff6405f992b04e3d4ea94bcfa2f2debc786ea4f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623686, "uuid": "b3396227-8285-4ba0-85a4-e22dcbf2a7dd", "value": "T13A14B81E6E228F7EF6A9C73547B74E24975823D623E1D641E1ACD2111E2038E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623686, "uuid": "d3dae75d-7a92-4c77-9ad0-04c0412d2c5e", "value": "3072:QDy7dCcHfWaKYCYv5RuiMK3+cQOXfj56hh1PRDV:QDy7dCaWalr3bt+eX7ERZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623686, "uuid": "ab6c21fb-78bb-4b4c-b11f-d307d80d0e36", "value": 207860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623686, "uuid": "c81db29a-e39d-41a3-a406-e4e0b74f7be6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623686, "uuid": "100a82bc-5c3c-478d-bb21-f427cc6b6097", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79affd8f-bcba-11f0-91c6-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1762616953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616953, "uuid": "5690d72c-f7a7-4871-81e0-f5635475d593", "comment": "Malware payload (Gafgyt)", "value": "01f30117b9a15b1d1865159bb7fa16b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616953, "uuid": "184394f7-27f9-43d3-87b9-c400b77cdbeb", "comment": "Malware payload (Gafgyt)", "value": "0fe34d63a0e551c126822aca926d7082a7d86ace67d02ec069716ce2ac187dcf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616953, "uuid": "8d5c60e3-23cc-4539-844a-9c94c78758cb", "comment": "Malware payload (Gafgyt)", "value": "60584852e896856d362b6d2cd1377647886baeb0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616953, "uuid": "52266a52-9221-4d91-a50b-1cf6290b7895", "comment": "Malware payload (Gafgyt)", "value": "9fbb567ce7d8f3f00161960d8fca7cef51072d2e77edfdd7f925492d48cf22e2be8c6d0be6fd20e12720be9f172c5ac6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616953, "uuid": "b85ce7c4-f2fb-413c-aab3-2be943f4b888", "value": "T12513B605EF650FABDC6FDD3345A90B0634CD940B22A53B3A7934D928F61A54B89F386C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616953, "uuid": "a770b016-37f5-4124-9ea9-37a5002528db", "value": "768:/ZBah1wjXVhSPnXKKK4PxdWXGMr1PVeh4feoF3Dl89XiAx2kN7oxH3:/ZBa7WXVhmnXKKK4CV1ts4fLBqKkN7C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616953, "uuid": "88cd6e55-5259-463e-aec7-a2ca9081d365", "value": 42732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616953, "uuid": "8c4d4429-21a5-4b7b-84ff-068129fa9453", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616953, "uuid": "e9e2721e-08e5-44e4-b9fe-19941056ea5d", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df49951-bc74-11f0-91c6-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1762586896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586896, "uuid": "23e867c0-5b3f-4506-96c3-1ed7d6c23940", "comment": "Malware payload (CoinMiner)", "value": "a4a10f391c475aa16ad4ba8357bf3ddf", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586896, "uuid": "16f4e4de-d281-455e-ab36-304abe93c447", "comment": "Malware payload (CoinMiner)", "value": "102d5fff472901b5975ec026256100a67e29b3348c754836d6131f5b48bc4043", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586896, "uuid": "aefbb56d-26b8-4c44-8448-ac0335f1f93b", "comment": "Malware payload (CoinMiner)", "value": "97214c8df04f1d09398befbd7a3bf6933810fdb7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586896, "uuid": "3bdeb756-2afb-452c-8d4e-dc087a5255c9", "comment": "Malware payload (CoinMiner)", "value": "8baed432b8d0c32e940aff819561e7f92a05833ceb773da1c9928d1feaca65ba1452553961ee1ae93d9db71fe18ad73e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762586896, "uuid": "406e9b87-efc6-413a-ab74-e40328a4897e", "value": "T1EB45F196A3E503F5E0B3D279C9558E86FAB2B8550B24A7C703E486716F172D14E3F322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762586896, "uuid": "fe86b5e4-6df8-495a-860a-ffdd4acb5e9c", "value": "b34ba0bbf4fa1de467dfb3f5c80ea6b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762586896, "uuid": "a884059b-ccff-4546-b5a1-dce0a741931f", "value": "24576:F30R6kBgNCJOwGyKEw08F6fNraHSQFLeHlI9gTDjexF:F30RZfc0g6F2HSQ8lI9gbexF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762586896, "uuid": "8714ca6b-70ac-4f2a-960f-6641e0a1b9bb", "value": 1237084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762586896, "uuid": "1f7a752e-6ae8-4adc-bce1-5681461a8a02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762586896, "uuid": "a97c9c61-7648-4f7d-aa3f-48331448984d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cedaa64-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620395, "uuid": "8663a1f0-0387-4286-8721-1755627f09e2", "comment": "Malware payload", "value": "ad61ec87cf6c3eed61d66cfebcb663bd", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620395, "uuid": "97e14b12-9c0e-43ff-b6dc-f1073156e5c3", "comment": "Malware payload", "value": "10d96a57b4a446b30816229307984a151f1d319eb8e25fdffb0b6185055f778a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620395, "uuid": "20fd834f-f9f7-4261-9429-5ece43834326", "comment": "Malware payload", "value": "d5ed3157984f8c1034d1c59703add06fc828404e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620395, "uuid": "745f7a8e-3e6d-4a83-aa15-dafcf3ffaeaf", "comment": "Malware payload", "value": "13b7ded2a67c92338d4c97beec58dac8323ae2e6aed138501f55b1631cf24f130ee8be526b118881fea2d724ee2d08be", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620395, "uuid": "3e2e9cea-ac97-4339-98d7-ac700432676e", "value": "T107449F3D0710CE53467FBC6123661526B96F063570E63736C2A1B024BF9C938E6AEEE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620395, "uuid": "3c881497-06bf-4272-9ea6-11a82e863d4e", "value": "6144:R5foAiRXNhTJuPUqd/KeqvqU+J6VzgYh1G5T6wBhyKr2V37oncOG51TnrK:qTJD+J6VBwBcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620395, "uuid": "7e888375-bf98-4fb6-8c6d-72d6664902ab", "value": 253998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620395, "uuid": "7e00f69f-9d22-42a5-adce-44ee2411852c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620395, "uuid": "2c586ee0-3aa4-46f4-a7f2-ca581c88098d", "value": "RFQ-SDS-11152022(1)_20250215095300.635_X.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db36e898-bc43-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1762566007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566007, "uuid": "6c2bb7c8-6507-449c-a49c-e6467e8840ba", "comment": "Malware payload (DCRat)", "value": "a635702dae2292903ebbc6f006c6f024", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566007, "uuid": "37da16cb-852a-4494-acaa-9bee46879b62", "comment": "Malware payload (DCRat)", "value": "111991c69b0bad660b72a0746afb87cfc2a94e38bd6e68673587e7204b681695", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566007, "uuid": "8014f3a8-8cee-487e-98c0-e0adb1105c48", "comment": "Malware payload (DCRat)", "value": "3d75e8cae25d34405bfeb330f5fed6847f954bae", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566007, "uuid": "2c1e6538-7bc8-4f50-a028-e51bfef45383", "comment": "Malware payload (DCRat)", "value": "5aca59bb004e31ae4e1bbbccf4ca64d073decd3b5089611778cdd9b4b052f0705fe860a3e321df9e4af5692391d503e5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566007, "uuid": "bcd22d78-3072-41b6-9711-e4270402c26f", "value": "T12DD5DF1A75D24E33C26417318663023D82A5EB357662EF1B3A1F2097AD177F0AB721B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566007, "uuid": "c6f47c08-2e75-49a9-8f43-a8a42bbdf851", "value": "12e12319f1029ec4f8fcbed7e82df162", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566007, "uuid": "e5f761b7-4fdf-4f49-b4b1-21aeee06ae72", "value": "49152:IBJ+2Fthjj8Nm/UKZ47LA/nO9ZqnVPwimNhKKs+yWxV:yE2FthhUEiLirFIRxj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762566007, "uuid": "e2854d57-586e-47b7-a8cd-17db0e330f1f", "value": 2859897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762566007, "uuid": "1308db0a-70ab-4e0e-860f-a3c25ea127c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566007, "uuid": "aee78ec9-2af1-4702-97d2-1449b386267b", "value": "A635702DAE2292903EBBC6F006C6F024.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42bb91ff-bc73-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ngioweb)", "timestamp": 1762586367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586367, "uuid": "0763a752-520b-4d5b-a5cf-f64ecae1da11", "comment": "Malware payload (Ngioweb)", "value": "4a2d05f9e4bb2ac0c77cd1d7c276436f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586367, "uuid": "b805ff60-3ebf-4c1f-8153-f7a74a8dd377", "comment": "Malware payload (Ngioweb)", "value": "119031d11c894b585fd88084898929a892beb5b9df57e56b779d8aaa3dae9ba6", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586367, "uuid": "19e2c62c-196b-462b-9b11-4a4a477212ba", "comment": "Malware payload (Ngioweb)", "value": "226f2a82ac1e86b18108fee90c46840d955d7ed7", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586367, "uuid": "20ee34a5-e402-4d93-bc4a-220b98221ce7", "comment": "Malware payload (Ngioweb)", "value": "1d69f60510d8c81d6b7a33027f91ec3d116703c2139bfa280d613b3808e5942c96266b12545b96b73ec18967b329285a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762586367, "uuid": "94354f36-1a15-498a-9148-3ff3a8f538c8", "value": "T11A01169DA826D0E4E138E7403855AD0B614D8B51A590BBD854F82C35D0F965CB605E7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762586367, "uuid": "414e4463-ae7d-4d4a-b946-1b9f4581108c", "value": "12:78CVCSECDSECaSECISECXBSECwSEC7bnSEC7k/:pVDwbNCVvM4/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762586367, "uuid": "f4ccc4eb-af7f-4d21-aa08-59d9d794572e", "value": 760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762586367, "uuid": "0178d475-cb12-4c0d-af17-d66e1111cce0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762586367, "uuid": "15e90340-9f8d-48ad-ac34-c9953f85ca87", "value": "dvr.jaws.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbe50c3-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620718, "uuid": "de87b26a-753a-4987-8a03-9402dbd005b6", "comment": "Malware payload", "value": "b4e9bf2110e7bedcb46253f6262016e8", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620718, "uuid": "5e9d71b2-5e56-45bc-a29c-fc338595057b", "comment": "Malware payload", "value": "11ce6d41907407e92c9491e88e764a87359efc972e1245dec47236ba9d7fa167", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620718, "uuid": "9974f5b0-e77f-4a4b-919f-5a89d28b8c01", "comment": "Malware payload", "value": "1bd4c041b07674f7556037f8e2871d9b0703fd1d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620718, "uuid": "60c6bf08-05d9-4d8c-83c4-210cd834af9d", "comment": "Malware payload", "value": "322f40ac650d3adb87e96cb01a8618e0304c73f7b8ee8ce5a754609872a39cfab8f7c08f8a6b315cd8d7c6fd6576fe50", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620718, "uuid": "d586d21f-0d29-4d6a-a69c-bceb9d53a3bc", "value": "T1A0B3D7D8AA94313D09494EF7FF69C51845AA4B27013370B8E7EB1209DF21D78A269DFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620718, "uuid": "04543998-5891-4745-a83f-9f777d147b36", "value": "3072:63xJXns6hJVAdDboKElDd0L9GkG7byZSljk:63xJswcoKElDd08kG/yZSl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620718, "uuid": "619a92bd-d1b9-41e8-be27-999e19d6ae74", "value": 116377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620718, "uuid": "d2a7b3b5-e670-449e-8f7b-bd513475f7c8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620718, "uuid": "c9e2c53a-c9db-4ada-bb84-bfaabe3597d5", "value": "FACTURA_009090853244543pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c597ca4-bc9b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762603697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603697, "uuid": "1770d12d-49c5-4bd0-8e1f-91d18949abc9", "comment": "Malware payload (Mirai)", "value": "3aacc93da1cfec508d31d6229ddecb08", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603697, "uuid": "74ba1b8c-e009-4628-b6dd-bda0d5e49c25", "comment": "Malware payload (Mirai)", "value": "11ef7882f84bc4c2bdd4af327dee278c147a32e681ba6857573bda4ef4b2a47e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603697, "uuid": "38b04859-7027-4348-bbfd-68af998f4e04", "comment": "Malware payload (Mirai)", "value": "19916ca55470d896816e7542fff3e45eb9ef14a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603697, "uuid": "48605d8e-66a3-41dd-b5ce-57b1222fb98d", "comment": "Malware payload (Mirai)", "value": "f1fcd83192d4c4938d1d7548397230da4496275a55138cfbe5e9b95548c063d6966b2886eb43aa53669aea8b993ed05c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603697, "uuid": "2ae2797b-4d76-445d-b841-a905828e4896", "value": "T1EC03F2603284B653EAB58231F808E750A3CA1F7CC1AD65B43DE4829E95C0C5FB6F99D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603697, "uuid": "d7c8f39e-3306-4fb1-b2e7-64e3644a5962", "value": "768:9PD2kAmMLT3hZelwMgwWT0JcLysXQ+qcSAjb5Bzs3Uozp:pchUloyaLkbwv5Bezp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762603697, "uuid": "62f87c02-5ea9-4fae-bae3-d76fab07cd6b", "value": 40120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762603697, "uuid": "f2e31266-376c-460b-8d66-76dd60cbc46d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603697, "uuid": "544eb3fa-8627-4618-8cac-aa348c62ba0b", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fbcbb56-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602227, "uuid": "b2f094df-9998-442e-a9b0-2110ee378c47", "comment": "Malware payload (Mirai)", "value": "6904d8f8be332975bab61265bc3b023a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602227, "uuid": "1f8b9459-6311-45cd-9c2c-4f36f51e969b", "comment": "Malware payload (Mirai)", "value": "1215deb8b09e5416237a0f36b0f1f153211be37ccf89a0ba4ae3af83ee045190", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602227, "uuid": "05596e03-9678-4cf0-9788-b3ce2894698f", "comment": "Malware payload (Mirai)", "value": "ab65e88cfc047618a2cd48fb38824bb2092cb0a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602227, "uuid": "e388b3ff-1407-4b8c-bbd3-8d33ad4907fe", "comment": "Malware payload (Mirai)", "value": "34fa4ba5e56477e3ad9092730098ae24fc682e77c778e6a9309bb312f60c61eee1b78388328ded1c134887252b0827ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602227, "uuid": "1f405ced-7b94-4039-ac4d-123656bf5d87", "value": "T1249339C0F647C1F2D84309700067FB3FAF32D5A65026DA1AEFA99E32DE635819606B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602227, "uuid": "9ca547c3-aaa6-4d66-8563-d51ae0f24331", "value": "1536:YITG2eIh6dnkFAEiDAq6JaaWJUM1B1VBKWWJ6GzXxSinVZaX:rTG2Fh6dkOEaJUMBvU4GzXxSDX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602227, "uuid": "8d279e8e-beab-478b-8d31-522e7a9517af", "value": 94088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602227, "uuid": "d66d30d0-fe99-4986-aa90-129b3c8c5765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602227, "uuid": "eab88ba4-6576-4988-b3c1-f2212ffa3efe", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321011c1-bcd2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762627141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627141, "uuid": "5be0cef5-bd45-4798-829f-2878735914ab", "comment": "Malware payload (Mirai)", "value": "9203e347c4e58d8cbc5f3cd59b291769", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627141, "uuid": "d8cb76c0-38b4-47cc-a9fe-3f29d61c930a", "comment": "Malware payload (Mirai)", "value": "13ba233a5f5eee120980717639fbda989d5bb94301e7d90cc280c4399a7f948f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627141, "uuid": "34d00cae-1de4-41fa-a6b3-2a9012fff409", "comment": "Malware payload (Mirai)", "value": "2d2312061336b64df05ac4e4035faa5cca3ad3c6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627141, "uuid": "7a5a55fa-a13f-49fa-94ad-bf31e82fd948", "comment": "Malware payload (Mirai)", "value": "79580b1e4fcb9d48ed21520261207e966f43787fdca69817dbebe3e8d236e46aea8b5b6a503cd4b2e7b5242abac28b6a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627141, "uuid": "9f503baa-0eb5-4536-8f71-ac050d1c6b0a", "value": "T18183AF73C9241D98C65842B575A4DE3A0323F9405A831EF616ABCF76D00BEDCF90A3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627141, "uuid": "aa35d13f-142f-4ae1-8d85-b1f543887f2b", "value": "1536:i/V5nAjRtKXdusF3XfbKgkJFa77hmUxCiRqT8o1Ur2:id5nkHwlF3XWgeahmUxzy9Cr2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762627141, "uuid": "c377457b-942b-4b82-b898-79b8f1759412", "value": 83488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762627141, "uuid": "c8a1f2fe-5994-46ac-b944-100f22baab15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627141, "uuid": "2fb1cdfa-ee19-4e1a-87d2-b254e1ef6fb2", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7519d79-bc96-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762601649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601649, "uuid": "8eb197ba-a404-4ca6-85ce-55e65dd7de4e", "comment": "Malware payload (Rhadamanthys)", "value": "f05a6cc8e325d2bfa7b45dfc81f0f5f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601649, "uuid": "2a8ca79d-a540-4eba-ae09-984cfb7a6e07", "comment": "Malware payload (Rhadamanthys)", "value": "156e8ae43242304b727c3012e3f3b794305a2483db792f26ba84557885d20773", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601649, "uuid": "22ae47a6-62ab-44d8-b2f8-80f68d157f17", "comment": "Malware payload (Rhadamanthys)", "value": "f6957781d0a0cef7bde2e95dec2c11be28ae9d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601649, "uuid": "a544ab88-1056-4f83-818e-a19c2e866c0b", "comment": "Malware payload (Rhadamanthys)", "value": "9544f88aff6e252ecb4b01c5075c1de2fea49a55204c9622de934dda3f65387bfc0960208cd883b769b1feac1b5e1269", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601649, "uuid": "bafec342-0b23-4f6b-9013-c5464279006b", "value": "T102861240A9C9D7F8C0C96F7C3641407E76D16D9DC5BDC75C5A9AEC333EB2A8804AA392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601649, "uuid": "a4161151-6093-4cb6-83d0-c5cca55dcf41", "value": "5294a01d1d81d8e369d426d5b7a26957", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601649, "uuid": "120ae90d-25db-4aea-b5ad-9a1556627c7b", "value": "196608:q6Rwg1JLRswXUGqgjCSMUX4ml/pZ6KsDQPCA4bZJH54X:q0HXsgjCilxjPGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762601649, "uuid": "3f5d2911-2df2-473a-bd81-e1b34715f9b6", "value": 8491568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762601649, "uuid": "7966a4cd-8032-439b-9492-9c3cc854bf86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601649, "uuid": "1eefbba4-6709-494d-b3e0-698debdcec5b", "value": "chronos.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b26794d-bcb3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1762613788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613788, "uuid": "761c5ac0-e908-483d-a4d6-2e5957df9b6b", "comment": "Malware payload (Vidar)", "value": "99ee53332c8d9b9fdff53dfe5dab6849", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613788, "uuid": "0b2d7c86-6ef7-46e2-8328-e67737b5ccef", "comment": "Malware payload (Vidar)", "value": "15a88e20e970e86f94a6328c579552bd2469329bb258d2672e7c85bfb2946502", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613788, "uuid": "e2900808-850d-484a-a7d7-47c40f2a187e", "comment": "Malware payload (Vidar)", "value": "eb16f438899ea81dd84aa625e02c48e24c8e43d7", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613788, "uuid": "2b623aae-1cca-44de-a457-aa4c31639cf7", "comment": "Malware payload (Vidar)", "value": "0ea163d0b1366c030592cfe14561a9ff3064b992ceea4ee8da8279100078ac72251288adb5356045e779110620794f2b", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613788, "uuid": "ac2495b0-185d-486f-ae97-bf242195ac9a", "value": "T136B55FFA926C3314C893367F05521516407854C065AE796F3DBF81AC7AEE638B38FA1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613788, "uuid": "a76bb7d2-c651-4a89-8a3f-4d6190ba6c9e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613788, "uuid": "8c7a6247-8340-45bf-8498-874b23b0fedd", "value": "24576:KjfQbvZPzw3v2pN0O0tFfKESQbRrPhsp1JYgWNgXzT6Y1F0jsz97BrY+6:KjItPz62pN0JkEPbxmZnGY1FYur+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762613788, "uuid": "3763421a-3e95-4c80-aeb1-78f9725782a6", "value": 2441216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762613788, "uuid": "5c45e5b6-9863-47e5-8d63-63ac70ed7745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613788, "uuid": "34251fc6-8900-4601-bbf5-8473648d714c", "value": "Set-up.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691c89c0-bca2-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1762606618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606618, "uuid": "428e61a9-2dfb-41bd-a1d4-8e3762e867e1", "comment": "Malware payload (ACRStealer)", "value": "192328ecd8e8f3808955cfa15521c8a4", "object_relation": "md5", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "5-78-87-38", "colour": "#5A5599", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606618, "uuid": "49c1ad81-e7c2-4081-abb8-7ec7444618b1", "comment": "Malware payload (ACRStealer)", "value": "15e14711b3acbdb53a60016d76a796d6430183803cb59db41a49567917d3b3c8", "object_relation": "sha256", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "5-78-87-38", "colour": "#5A5599", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606618, "uuid": "e0cf47ad-179c-45bd-99c5-856414d7c6ad", "comment": "Malware payload (ACRStealer)", "value": "13b2e33509097c3afbc57142c01c49af2aa0ddd6", "object_relation": "sha1", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "5-78-87-38", "colour": "#5A5599", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606618, "uuid": "5554dbc4-c599-4df3-808d-fe0b5310e7da", "comment": "Malware payload (ACRStealer)", "value": "835922b31420a330186243fc6e1342511ba42b9897418770486eec9a1229cf85de70c50d1fdc41927ae1cdc3003ed02d", "object_relation": "sha3-384", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "5-78-87-38", "colour": "#5A5599", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606618, "uuid": "b46774db-7883-4518-9792-6dea5522bdf5", "value": "T19DC5125692A24FC4C8AD063980EB1F527759BB8A5146C30B5B71E23F7FF33B1AD61881", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606618, "uuid": "515169d8-446e-48bd-98ce-a46975121f80", "value": "49152:kTP+gxRRpNG0iAZteAxnOfoLErlAeX4iW5xb8Irgm:SPprDe1fg+lAeXrW5xwzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606618, "uuid": "8a09eb02-618a-45e5-88e9-4460bc12cf5d", "value": 2645872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606618, "uuid": "3022c8f4-cd36-488a-b0fc-97844ee18884", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606618, "uuid": "cf0ef876-00b2-4ae3-938e-6c3d26a3f56e", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6620e544-bcd8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762629806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629806, "uuid": "4de6a374-8f99-4d66-be92-8413e87c05ad", "comment": "Malware payload (Mirai)", "value": "6ddf5ded7b04263b09a207fde1722a84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629806, "uuid": "64568f70-14c5-476b-9cef-d7ead773b786", "comment": "Malware payload (Mirai)", "value": "15ed1c5c35d21f12674652697f8cbb5286467254b4fe9231a8340fbe81df2344", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629806, "uuid": "1e8087da-de67-45ed-a65b-e666f5ee7c47", "comment": "Malware payload (Mirai)", "value": "67e0af834a2084873d1968a154d559c86f09a5ec", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629806, "uuid": "22d5c4d0-f099-4898-a56a-1d60aefca7e6", "comment": "Malware payload (Mirai)", "value": "c1c9d50ce7f22fe233ce6cd16e4d301ce6cb7d6b316de40ea093d875af5b29d67cfdb412a16a3d26e9500b1e1b8af864", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629806, "uuid": "2f426a02-a330-4816-baed-7f91696331a1", "value": "T124030275C0B68194CC6F22372E7E37176E25D45B7B22F8DEA1D03665ECE2A984B047B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629806, "uuid": "1717deca-92ba-4505-86c5-bd6c1839ca14", "value": "768:CNBJOE2SeD6+6IDI6AWzN/O9eQ7t44k5yvh1GGGq8gEWXnbcuyD7UHQRjQ:CNBJ5e5vDI6FzY/7tDk8R8gHnouy8HyU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762629806, "uuid": "7b7f170b-3fb7-474e-bafa-74cdd502cbfc", "value": 40872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762629806, "uuid": "5a703fa3-6d4d-47e8-b2d3-def5b4d0552a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629806, "uuid": "43fb7da5-9df9-4cbc-b5da-ee35c7ad0db7", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a015b017-bcb7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762615729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762615729, "uuid": "f9b798b8-b5f4-44b1-9d7e-605b18d74819", "comment": "Malware payload", "value": "03174c4cf1c281a81803985f8e650a8f", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762615729, "uuid": "7f4ba838-3f1f-491d-8448-97dd1efb51e4", "comment": "Malware payload", "value": "166a7c3b4a00d479a26a03f755d0aa0971b15575eae705973d27c7001012c106", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762615729, "uuid": "2d749ff8-d76b-48b2-922b-818d07e2e129", "comment": "Malware payload", "value": "37323d3350ae402c317ecb4bed3a6eeea1b58757", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762615729, "uuid": "729c4c30-8d11-449c-b3ae-dbbdf4439f4e", "comment": "Malware payload", "value": "7e87dc925876ae1883eca4f654a9b454d788dbae9f31044a297701ed44e388b6385804f5fc2347030e16d08580543518", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762615729, "uuid": "234ca7d2-b474-4d1b-8950-3bef87d42ce8", "value": "T132B5334C4A50587FD94192322DD30C1651BBD6BB8F7BE1F234FCA403A57B8768A2AB47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762615729, "uuid": "bc28febc-81bd-47d1-a240-6c294142143b", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762615729, "uuid": "45a0cf1a-58e1-4d5c-a77c-284b4284bd60", "value": "49152:rnOMxsFcAKoMi/ugqxIjiMk10j8EBsS5xUIbu5hexVZg0UDJ:rnVaGi2gqxIeP6dsU+I/BUDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762615729, "uuid": "40a5660b-c712-43d8-afd3-35af0581eb21", "value": 2457088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762615729, "uuid": "691cd4cd-311e-4f1e-b962-b5b0591fc3c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762615729, "uuid": "2f642a78-97ce-4e0c-a55d-951b202d8177", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca2cef6-bcb9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762616529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616529, "uuid": "719ed06c-a338-4ed0-856b-9514b7d9f183", "comment": "Malware payload (Mirai)", "value": "528930261ea3cb02f32702e26269c025", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616529, "uuid": "e8667d07-33bc-4a6b-a87c-6cc99a0246d6", "comment": "Malware payload (Mirai)", "value": "16aa7fe4c3a5fd3e534f09193fa8bc9d7ec6dea1dc9ae14c35372eafc575a613", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616529, "uuid": "4eb0b3ec-eb28-46e4-8915-26edaeffa297", "comment": "Malware payload (Mirai)", "value": "1842395d73f557717dbc744a4a6cdc253d6c9cdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616529, "uuid": "a8fa2d48-c460-435c-9c79-ee9213f9cddf", "comment": "Malware payload (Mirai)", "value": "677a068c5004781b099ce54fc9e627c94f6e8652a15a5ba13783d17e5b1827a092dc635de4404ac9b6013de109a3ac2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616529, "uuid": "3673dee7-bd0b-466c-a809-133173b3cc30", "value": "T1B7D22C46B985DA03C5D062B6FB1F428D3B26536CE2FF33035E166F616B8792A0E7B540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616529, "uuid": "5d9877ca-f5ac-4576-8c22-9c342d3f621b", "value": "384:sHGvBP7MvaI3J/c0yMSQb6Vpju7LOUD2VtjpY49BCWx5v6IM6XR9Fx4enwjMqb:sQDr2c02QGPju3Dktp3CWvWYm8wTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616529, "uuid": "bdac4a6c-6199-45a3-b17a-3e35818397a0", "value": 30580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616529, "uuid": "ce33a9d9-1be6-4711-8d71-ab507a99a24c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616529, "uuid": "ae980297-0482-42a7-99df-d4c2b2934b80", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f986f2b5-bc4b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762569494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569494, "uuid": "63b638d3-b926-4848-b36a-d8fcb432ce33", "comment": "Malware payload", "value": "02b318b97ee025ec76c7566af082e4ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569494, "uuid": "0d4b6b32-b31d-4644-ade3-44dde9de06cc", "comment": "Malware payload", "value": "16c193e0951e4649d08312856bba21449eeb11068838c6079d77bf88cb37086f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569494, "uuid": "9025f504-2b0a-41c6-92e1-cd08fb17b5b2", "comment": "Malware payload", "value": "93aee472d8ec3bd221d338056e76511e27d569d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569494, "uuid": "65eee2b5-f489-4364-9779-1ed1e5a96ec4", "comment": "Malware payload", "value": "c9736d71f7fef8f7f63048dc7ce8b6eb333b593f2496dbd70ec3298ab5937298626c56a8aaa67228c8979f041d0fd009", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569494, "uuid": "33a3b882-3936-4038-bec0-b310b25f9e92", "value": "T1CCC307567710DFB2C26D853009B3C7566BFA26E22AD29449F22CDE0C2E7130D691FED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569494, "uuid": "a381c0cb-e3ef-4e68-8300-6234527825e3", "value": "3072:SuryzD5158hqX0I+cQTOnBiKytJE9VjjpK:vOj5amnBiKCKVPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762569494, "uuid": "15cf5bf9-5e39-4fa0-abb3-c6b9bbf9752f", "value": 123664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762569494, "uuid": "a45ec4a3-f3cb-4254-a90d-6a74bb75f39d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569494, "uuid": "12188027-cecc-442d-b28c-fe282d61353b", "value": "frost.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2f4081-bcd2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762627158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627158, "uuid": "8dfdff25-e6a1-4ccc-9e33-d9dbde2d4a3d", "comment": "Malware payload (Mirai)", "value": "0fff20264db2dc2926819d00a9e6aa5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627158, "uuid": "fecca902-391c-4feb-a577-88d0a2a1e1b5", "comment": "Malware payload (Mirai)", "value": "1706e405701289a351ec81bac09019c02da839ff04354854800003cfe453911c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627158, "uuid": "65c34531-0131-42ea-afaa-f9bb904d0510", "comment": "Malware payload (Mirai)", "value": "883a370dad51ec0ba2ba9b9e48629d056ab5cc3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627158, "uuid": "565641b6-cd34-4bc7-960c-d682f0ba0453", "comment": "Malware payload (Mirai)", "value": "ff87d17100f5aab41b5a899294f19a8cfbc2cabf8139ec5573c02e5d4d3bd4ef9e567d716c9841bb15e3d32420c04aaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627158, "uuid": "ac36663e-e625-4ca4-96fc-5bd08cd835f7", "value": "T1A3A33D46B9918E12C5C212BEFB5E518D33136BB8E3EE3212CD24AF6073865DB0D7B516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627158, "uuid": "2741738d-0682-4005-bdeb-50dfecee9817", "value": "1536:vDndBDNVR57YZa5LCPxeePlv1sW4h5b167panwlqXfD+Ritzs3ieV7uT5UYjYCy:JBrC5eQ9XI/67pan1zs3ieV6Tu/Cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762627158, "uuid": "f2bed7fe-0a75-4c6e-8ebf-fca18e20f61d", "value": 103880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762627158, "uuid": "47db1ef7-d627-4b8b-b89c-7e2e742822d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627158, "uuid": "dc89db33-372b-40ad-bb37-c63b2528b6b9", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93f64e4d-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762620434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620434, "uuid": "f4862f99-a08b-48e6-b13c-76a50e000df0", "comment": "Malware payload (RemcosRAT)", "value": "2a3c261803e29354b4da0bb018e20ab1", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620434, "uuid": "8eb3247e-42ea-4b8c-ba59-311866ef922c", "comment": "Malware payload (RemcosRAT)", "value": "187c46bb2c04db37c266164e10d76305966f881901a784bf7c74ef99dcbb3fd9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620434, "uuid": "0e21ff36-5bce-40ed-ba86-2f9aaf1baa0a", "comment": "Malware payload (RemcosRAT)", "value": "8062dc5294b12750d45b1036a8d5a7c711697b71", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620434, "uuid": "1f322e97-f3b5-4760-8265-e92df15883be", "comment": "Malware payload (RemcosRAT)", "value": "c84c1d5011de02d14472bcf634ecd2f1fbb0a1d89c44608f7188adb20a6966da79e9bd12aadc400b621bc33ebbf46252", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620434, "uuid": "7d10ab36-01a7-4b3e-b8c4-b7fdccdc8b67", "value": "T1AF72343A965CEFF00B3E21F411873D1520649326B83ACD6CACDA81547F267519FA78EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620434, "uuid": "e84549cb-69b4-4030-a743-1bdd4f99df91", "value": "384:XXeXXSXih3Gn+I67ZiFeqSXJwYZXxTQforPdkiy+wVupNrq0:WiX4FLQenHswrP2ie0jrq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620434, "uuid": "e8742b48-1873-4898-a58c-e6fa4fee6e90", "value": 16049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620434, "uuid": "6acc8317-bc56-4433-8480-1db8c6e10221", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620434, "uuid": "cb09fc29-83eb-4a5b-8915-2158d92a29e6", "value": "RO_20251105_99465416.01_995989.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f7ff42-bcdb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762631045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631045, "uuid": "1a9b7ac4-7bce-47b4-85e8-d5ea0449bea0", "comment": "Malware payload", "value": "6e965186d8eea5e9651e5c38d6de351b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631045, "uuid": "2bfae789-4b16-4125-9373-c68dd1c54b7b", "comment": "Malware payload", "value": "19a331e787c3f5c3ba9c565f4e265a69f0804f92255abceccc670343e0ffdb2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631045, "uuid": "7564fcee-4b92-4966-9fe4-de6aadc7680e", "comment": "Malware payload", "value": "65019d0bbea194190f36d84074969f25f2a2bae6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631045, "uuid": "9d7034ba-d349-4c72-8f69-555253d9d32c", "comment": "Malware payload", "value": "22479844c5d691151210de5534bde2a0bb06a81f40d902ba5a588c1bb313f8dfc69ef41ae95ca7f77ec4490324323ffb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631045, "uuid": "11a9ff2c-3507-4329-a0b5-ec7163fe7741", "value": "T11A93D6385864A432DF89D833C579E6F2D6715D4B68F161D50EF72A233AEB08B1CE9702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631045, "uuid": "ddf9e009-29de-4320-96f9-fc4e0499b49e", "value": "7a446eea0e81062d00134322faa7fdef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631045, "uuid": "018e81d8-79bb-4d81-ba83-7cf2a4b42265", "value": "1536:K5UjHCdsu7NqY3CX/m5lMovXspzdRR/sm:hWd37NqPe5lMWSnlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762631045, "uuid": "503eeb5f-d855-4089-80dd-2076566565aa", "value": 93696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762631045, "uuid": "08fa9783-e6e9-4c6c-9ea8-6de2d03392fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631045, "uuid": "33d6ebb9-2865-4f27-ad85-d2707671c16a", "value": "Instalihaly (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162886b3-bcc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621940, "uuid": "0babb18a-1700-4ad5-88b8-b3df38ff0909", "comment": "Malware payload (Mirai)", "value": "26e9a2cc1655188b433040d82c212759", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621940, "uuid": "1e11fa33-cb78-4a46-a0da-96aeb721db70", "comment": "Malware payload (Mirai)", "value": "1a2eb6cd831404772907f34e44bb33d6eb377c795afd38e01ea9120b9d6ea42e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621940, "uuid": "5003afa2-609a-4deb-9dd6-8aea5bf4145f", "comment": "Malware payload (Mirai)", "value": "a1fa076887530545b2ee7b6d9011aa2344147403", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621940, "uuid": "a91d81d4-e981-4616-abe6-8574fd07b1da", "comment": "Malware payload (Mirai)", "value": "b695fb2aa10d224b44ca3abbbdaef31d3491c31e8f363432082ecbf331453979fbfc365e2c42461f2f6fea00450e2adb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621940, "uuid": "8865e7e8-09a7-4627-bffd-777d69043dd6", "value": "T11531B2C4062500FD6CA59916BAB4471C74C0AA5A6EDC7FC9F7EC3CB8805CF8C705A647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621940, "uuid": "2c85aa90-c345-4c38-b10b-2fa043cc2bf1", "value": "48:vnfZnsJnEqzn7lNfnCxnRLnwZnkzkinLDn25k:vBKnD0BCkAiHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621940, "uuid": "9eb62dfe-1dd9-427d-9a31-366d13ec7cec", "value": 1803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621940, "uuid": "633ac940-a7cb-4ca2-a8a8-b20c339cc8fc", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621940, "uuid": "80c85683-0659-4032-9d6a-e2c0fc61bc8f", "value": "jewn.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5186c4a2-bc77-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588110, "uuid": "2d64b4bc-d348-4a03-9c1a-13b0f57bff9d", "comment": "Malware payload", "value": "6dd5f3aaba0d558a98ce3b9f009cbc58", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588110, "uuid": "d8f68b67-ae7b-4589-a093-7894a0d30d26", "comment": "Malware payload", "value": "1b11e7f54f0f85e3e8983bcac62cb124c9a2a49ef0445ae6d7fd356538ab42dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588110, "uuid": "60655616-41e0-4ac3-a844-a26f8ad3600e", "comment": "Malware payload", "value": "8093eec3f8fd186eca363a55a9f36eb6d90310b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588110, "uuid": "a4fc8a2c-2d5f-4316-a3dc-48ab4eabc164", "comment": "Malware payload", "value": "a3bb67c163f45b11dd1b99bed890278f06efb43a26300813ff29dd4d85b787dad230733f6cce1a9dffb5b66536af4333", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588110, "uuid": "b553ffac-a21b-4016-932b-ba3ad5592d21", "value": "T1832723E0EF959423F27A3BB769DBE7D1C02E6DBAB150810BB18C76190324616BE4713D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588110, "uuid": "4e0cff96-34b0-4801-92c1-d527360fc2bd", "value": "490691c1e02a66f93031cea140117d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588110, "uuid": "4d8e946b-74b1-4b55-b1f1-eb1e920ed9d5", "value": "393216:63C+dO/Vg/CizjMTSqkF81kFh91Tg2dj4ZeJcg:GTdO+/VjMTSqki1W1ThjEe/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588110, "uuid": "d04120c9-e419-4ca5-bff9-6dbb8af46fa3", "value": 20970481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588110, "uuid": "1d97d611-1e64-47bf-b2b1-ec92fba31cf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588110, "uuid": "1761265f-4f3e-414c-ae26-47317b9c63ef", "value": "6dd5f3aaba0d558a98ce3b9f009cbc58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b3010f-bc95-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762601250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601250, "uuid": "3562414e-3e7c-413a-bde5-6d511269bdeb", "comment": "Malware payload (Mirai)", "value": "cce22c686eaae16dfae49a1c52d4cc44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601250, "uuid": "a8309562-3c38-4bf7-807e-543bbd060fa0", "comment": "Malware payload (Mirai)", "value": "1b8706c230fd34fead734150d64735fceb2190624af017e16fe3be354b6e7560", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601250, "uuid": "d40b4b84-da17-44b4-b1d9-9740a98979c4", "comment": "Malware payload (Mirai)", "value": "916f3ce432f3fb9dacdf26e5a6a090a11cb9f564", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601250, "uuid": "945e3e61-71e2-47f7-bd89-2ea598f0b4a3", "comment": "Malware payload (Mirai)", "value": "1b65c1a35042a1c562f2a0e3ec5c1f6d9f5a848e92970cf56679d41fc83ce84d9d44dce5ab8ee901d380f1853ad76f2e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601250, "uuid": "64f54bf9-d10d-4408-bb58-0d175bdcd150", "value": "T14AA32956FC818B11D9C125BAFE0E518E732307BCD3EE73529E209B71678B56B0E7A406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601250, "uuid": "050356a8-166b-469d-981c-6c151dbc4e41", "value": "1536:f+nc2JoFGrkWBCQbaJM1jAQPaxBj34//dW9i3+DxTNwb72B5ZYDayema:xykWrbacAQPaxw+DxTNwbqBvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762601250, "uuid": "25b1db68-f727-4d4f-8060-ff14c7180e1d", "value": 99992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762601250, "uuid": "7f646185-7513-4bca-b2f0-066701c3960a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601250, "uuid": "a122c381-8a3d-4cf6-b706-65e4555b8b1a", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e0e5c33-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620424, "uuid": "2fe92ccf-d95c-4077-bcd1-3cfcc8a83473", "comment": "Malware payload", "value": "c535890a9798a9859ca7da457958fc82", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620424, "uuid": "603b68ba-98f8-4a0b-aa9a-7ce52c434c10", "comment": "Malware payload", "value": "1c6ffce1cf786bfbdb5eb33d61f1db26da7e9ae52aef43266407abccc7cb20e6", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620424, "uuid": "5cc5e1be-29f2-410d-b05a-fad5dc9ad6f4", "comment": "Malware payload", "value": "5893285d742bf851c34e16abda36dc6e68204a6d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620424, "uuid": "13ddb699-cf6d-4363-bde5-cbde41a97995", "comment": "Malware payload", "value": "6920ad1755aec9ff2e0dfbdc8aa825746abbb81c84f2d189c037d97eb2ffc146c087e62b1ad4b2b618a8d4cca2c67ee9", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620424, "uuid": "bfa12545-55f5-4c07-b73f-9c2b94c29182", "value": "T187A32D909D62293F09FA02EDEF5985DC45FE7319013970A96D6A13092C0197CB2BBDEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620424, "uuid": "8dcf7bb7-9f05-4eb0-9153-a83c2ef360ab", "value": "3072:kFEpDBB7vLMnERtRNSU+PcK8bgabAJL4E5z9vq:kFEBv66TK8b9bAGE5zo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620424, "uuid": "623103a0-e97b-4b55-94b9-0ede4fea6b9e", "value": 107137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620424, "uuid": "df589991-bfa1-4012-9ca8-50d5e8d4264d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620424, "uuid": "c989555c-c169-4602-9af0-62a9c1d8fcb8", "value": "INV PRIME.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899ddf56-bcd2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762627288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627288, "uuid": "cbc578af-6735-4d16-88db-5c1904d19b2f", "comment": "Malware payload (Mirai)", "value": "63626b701141f171c65f417b0d09541c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627288, "uuid": "9732b728-f210-4c46-a6bc-7483029a78c9", "comment": "Malware payload (Mirai)", "value": "1dbf137ce559af2b55c6d16727671b7799d4886816255d025a2b5be037d680e2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627288, "uuid": "424df00f-326e-4196-b53c-b55cea4414ab", "comment": "Malware payload (Mirai)", "value": "d781770b6bffe908a68991373d487d736240b656", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627288, "uuid": "b5392c55-e2ae-409d-9c69-7f77540db9f9", "comment": "Malware payload (Mirai)", "value": "9f103d6fda4c4df024b0dcbfda4819463547fc812b0db7fcfe8ad5c44307f2655a14756fae21b85736ba6bda1ff94f81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627288, "uuid": "188ca5b9-6652-4b92-97d0-2f5d07ac05a9", "value": "T1F413F12140D85672FAE2777FFABC6047833756FD91FEB9201016892C816660972FC6AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627288, "uuid": "e11151c2-a214-401d-9f43-afe85d00160c", "value": "768:UptAyNATYTvhcswg2FhRUwb2MBztjN2hdUN44lysb9lKC9nG3Hs3UozheS:IZua2RZ1z2o24ly09nG36zheS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762627288, "uuid": "84f6b859-8ee5-4e43-8667-4ee415f13e55", "value": 42868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762627288, "uuid": "4f1becd0-3a77-4adc-a92b-149057a3ab9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627288, "uuid": "cfd406af-3721-4e71-9eaa-fdec5c3d5468", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ed845b-bc8f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762598610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598610, "uuid": "a7428d55-0f06-48f6-a5af-f9a5e58c3b51", "comment": "Malware payload (Mirai)", "value": "60485e54a9ed1dabd805103058175e00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598610, "uuid": "2261c896-08e7-493e-a8cc-6e450920e273", "comment": "Malware payload (Mirai)", "value": "1e03eac47c7e8a62efe15f8cc82678ec9ae9d496720c87b1bb93b2f5fb6066f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598610, "uuid": "1fba1cde-42d0-4180-82ef-3395301b1c9c", "comment": "Malware payload (Mirai)", "value": "e10e94ab693bab1d06f775a143abfdbb4240797a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598610, "uuid": "0c7d8f10-dcd4-47e0-9118-f8d76d1a464e", "comment": "Malware payload (Mirai)", "value": "11dde8bea87dbd3253e5af9d90fab9cb32f748878109badbcfe61d8c24db8a4cca3299f61e453b93d444b7d7c0295647", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598610, "uuid": "cd1fa7f0-7db3-46bf-815a-5b118510e517", "value": "T12A03F1516819E320CEE33833E2FAD314EFC748CCE6B364662B64989D9DD50912BB7587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598610, "uuid": "51937251-cede-4c1b-aa18-e672148e1462", "value": "768:yLW+94T9gkJ9s7c1MJSxPfDyg4UuRfTxULRDRU69myq3UY0/:yl4T9svJsPfOUuTxw469mG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762598610, "uuid": "3f540fdc-ff54-455a-b88f-ea27a8cfdf8b", "value": 40872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762598610, "uuid": "e9450903-eb11-4bc1-a23b-dfec3e5b886c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598610, "uuid": "1a34a360-5adc-445b-8ffe-f3f7f4c82999", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e975e1-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602346, "uuid": "a0106386-4b65-455a-9326-c637699141f7", "comment": "Malware payload (Mirai)", "value": "6304bd2d463ec39b20cd36ed16a1ae56", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602346, "uuid": "15d9c8fa-1bfd-4714-a5f2-bbdec444b27c", "comment": "Malware payload (Mirai)", "value": "1e6becc05f0fc860e219a51afe5337a4d4d0205ceea51a07ec4cc89bb10bc9ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602346, "uuid": "9d088562-147f-4c58-a6a8-c3fd197aa1a1", "comment": "Malware payload (Mirai)", "value": "6620df6a2db019fa26fa6a69005bdbc653c81e03", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602346, "uuid": "7bfe89de-4030-4111-b2c9-02d3c7531860", "comment": "Malware payload (Mirai)", "value": "c5493be6e1ccae7e3eceae31cee86810b59b2261107aa928a36c84af688fbbd21fe58ccf9fff32d89557129eaa7443f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602346, "uuid": "65070c2a-ae6e-4ab0-81ad-716c1bcb14b4", "value": "T13593B61ABF251FB7DC9FCC3709A91B06298C554A32A97B367E34C528F64B21B15E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602346, "uuid": "0d230155-eafd-460d-913e-139cdc68d12b", "value": "1536:a1QPTf7gZapEz2I52zb8BkM2xk/ncRbpfDZz1pG+4Md8Y:a1QP73mzz508BkMgfD7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602346, "uuid": "0232e252-2fb8-4fe2-a1de-23de8655e321", "value": 93388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602346, "uuid": "868b76c4-fd57-4b6c-8ab6-799d4148e9b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602346, "uuid": "6492c1f1-97cf-4a03-a3ea-781db8a5bc01", "value": "kowai.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e7e854d-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (CaminhoLoader)", "timestamp": 1762588856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588856, "uuid": "84221d38-cffd-4a6b-8cc6-3a9973cc34e7", "comment": "Malware payload (CaminhoLoader)", "value": "7fa5b5b49eac568e12cffdc389f42749", "object_relation": "md5", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588856, "uuid": "dade408c-bba4-471c-a5bd-af21ef995df2", "comment": "Malware payload (CaminhoLoader)", "value": "1efd5c1794ecdb88e58ac698a5b94f6ecbfc121fc09283f7724c393a07dc6936", "object_relation": "sha256", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588856, "uuid": "8061d129-ffbe-414f-b688-43863f287c57", "comment": "Malware payload (CaminhoLoader)", "value": "ae65b1befe3b654d53b9225b94fbfdeca9b51f62", "object_relation": "sha1", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588856, "uuid": "28f884f7-6bea-442e-b2bc-c590e96b72eb", "comment": "Malware payload (CaminhoLoader)", "value": "bf25b778dfd3c9ba92ae2cfe83dbaffdd3e82da739523798d3b4395280b03065c278910f87b648b5f5e6318cc799c8b3", "object_relation": "sha3-384", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588856, "uuid": "81d319a9-0c6f-4018-b5c2-bc94aefdda0d", "value": "T1D0261235A2BF182BF5FAEE57AAC1E713616A249BCC16909B720D00CC0F37ED15177A58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588856, "uuid": "90f35278-f60a-400d-9e82-c21d9ec33a44", "value": "1536:IlaTo5n/+TGTHP2hvXfSfLq+IYErWpKhf+dzIph:4aOiGTHP2hvXfSfLq+OrqKhfjh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588856, "uuid": "9f0672ae-f3cc-4f25-ad34-c439d7e2465e", "value": 4614997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588856, "uuid": "4ce49609-b785-4517-973d-a885b4366406", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588856, "uuid": "d587c85b-5094-46a2-8d30-4437065ac461", "value": "Request_for_Offer.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a994826-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588957, "uuid": "ece2891f-fb34-461f-9fd4-8c6f00b05657", "comment": "Malware payload", "value": "c7eaf47d3975197fa5c4411c2a25f5d8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588957, "uuid": "83a7d37d-60b3-40d4-a6bf-032122d708e6", "comment": "Malware payload", "value": "1f2642a68dfdc8d127efc1c8a9e8e8114e8e9c4d665b3ef748d42f691eeb50c4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588957, "uuid": "b8f77a5c-a1de-4bb7-8359-0286793acc9f", "comment": "Malware payload", "value": "6c163dbadd876c12fd49995401411daa709f4e08", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588957, "uuid": "f77bfeb0-e784-4f31-8555-69fb8a91ce7d", "comment": "Malware payload", "value": "ba6eedaf812bbbc817e6d215de24edd3be93e3c2853d5ac08ed869ff683e3609e764cd10362219b4541186e7f65d74c2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588957, "uuid": "f3ad6981-8fee-42d4-8d29-359d2bcb3678", "value": "T1AE259D3A02A878AE7D17AF0033E5880D451C5739EC696CD86379EDE7A578BCC12B45EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588957, "uuid": "1c87c4dc-5ef4-41be-9559-547b9b919825", "value": "24576:BvrYKPI4QfNoeEA9qP/fLdMOyYtGOU9YxbngH4t1dz+0mvtOvM/:1rqhUx5Fav", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588957, "uuid": "8b0156ba-6fbe-4a90-856c-69a40a2745be", "value": 1030082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588957, "uuid": "5853da49-05a5-4cc7-aa7e-e951a1eb5fcf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588957, "uuid": "2db946e4-ff17-4811-bf5d-1b9db7d046e5", "value": "Swift-03112025_xls.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba038c8e-bcb3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1762614055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614055, "uuid": "2f51c648-4cc4-45f0-a5ae-6357d57aefd6", "comment": "Malware payload (Stealc)", "value": "a91a093f40af08e1a8748d9e33a22480", "object_relation": "md5", "Tag": [ { "name": "91-92-240-18", "colour": "#B85A5C", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614055, "uuid": "84343809-29b7-4100-b7e9-b150a0f2536b", "comment": "Malware payload (Stealc)", "value": "1fbc9bee4ae68ca2d5bddbe7cbd34d14e3e550293f5c22a8dfc3c97bba1b2074", "object_relation": "sha256", "Tag": [ { "name": "91-92-240-18", "colour": "#B85A5C", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614055, "uuid": "925ff315-44c7-453c-be86-294fe740e3ed", "comment": "Malware payload (Stealc)", "value": "1514f6949ce8cd0605cb0b91381a331f31ee3afb", "object_relation": "sha1", "Tag": [ { "name": "91-92-240-18", "colour": "#B85A5C", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614055, "uuid": "adb77f58-6a97-4d52-8f42-306e21aca0d5", "comment": "Malware payload (Stealc)", "value": "96d65a794db37b22380891594f18c7df5477ed7c1af2028653d9f97bdb8378264d6402d59f52d771594d488c20ae1bdb", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-240-18", "colour": "#B85A5C", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614055, "uuid": "e86b8252-40f7-48f6-967b-10d78b8cc424", "value": "T1EAF54B427C8994A1D1AAE234CAA5BE55B330BC584F3D37C32F15A6721E73BE44E72358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614055, "uuid": "eb2dde29-9975-455c-b7a4-d042c2efef39", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614055, "uuid": "ffa5fb24-ca1e-4816-a885-a44410af8cf3", "value": "49152:/CKiWlMUtOQWAfW6bzyHSdsE+hgsNdbD1:7RtkAfW6bzzdt+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762614055, "uuid": "9297bda2-b3ed-4aa6-bb43-80b99af46f8b", "value": 3563520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762614055, "uuid": "1ae83de1-f6a0-4d42-9d2c-22b3a678177e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614055, "uuid": "7a1362d4-6f44-4cb7-9e31-6f5fde3cb763", "value": "Licence_Version_Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "208bb5ae-bca6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608214, "uuid": "6305f49c-1709-4ab7-9a9f-69349737f8a8", "comment": "Malware payload (Mirai)", "value": "c2ef4b9adac272a957ccb0506877e713", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608214, "uuid": "c302dda3-4421-451b-b441-f47e73c25cfe", "comment": "Malware payload (Mirai)", "value": "2093aeec7c509856bd2e6e019eb20ed0ff24eb97f00d606a37a0ddcf4186d537", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608214, "uuid": "9be924f8-53dc-429a-8557-85e293ab35e0", "comment": "Malware payload (Mirai)", "value": "49a62819fbb532841a5571d83e6092fb6feca5b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608214, "uuid": "4c64a601-e3c2-4397-882d-51860d67203a", "comment": "Malware payload (Mirai)", "value": "89dd7fddde270ed847a617bd630a4670a5205e0c6936a7b0b61f243f3388a8745b94644648ed701070b3d4809c705caf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608214, "uuid": "b4808f5f-38fc-4ac0-8005-a898e067b91a", "value": "T199431885FC92897AC6C8277AA76E228E3321B3E4E1CF3207DD185F2577C524B6D27941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608214, "uuid": "6253a494-d73d-4643-90ea-8bdda31ecab9", "value": "1536:xrHOC6NrDJQLFzpmXlFfqV83ZqTc0R7280A2gD751OP:huC6NrVk6SV8JqTcSq80lyWP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608214, "uuid": "96006250-29a0-4452-84f7-047ffc90b9ff", "value": 59356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608214, "uuid": "d16b5771-32c7-4447-81f3-e0062823ce74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608214, "uuid": "003b4e69-f2a8-4091-badb-564e52338a89", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e0d87c-bca6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608189, "uuid": "9bbd875a-7e42-4464-99f1-82070a2ca6dd", "comment": "Malware payload (Mirai)", "value": "47d82b0599014f201d85a43b6dd3705a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608189, "uuid": "5d0e9063-eec0-421d-9f9e-411e38ac10b0", "comment": "Malware payload (Mirai)", "value": "2150af3d03c0636424e453df3de1434791a2e09e95eb7f6bc628cc115615c4a0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608189, "uuid": "3a7926a0-f3e4-45af-abba-f74221fb8995", "comment": "Malware payload (Mirai)", "value": "2e4ead39efbc7fe566ca5fd1cb759cd88ae6bae5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608189, "uuid": "ca9f350d-e7dd-434e-a4b1-75a0fbc9ec1f", "comment": "Malware payload (Mirai)", "value": "151ed7ed6a19de753d4281d430aa9b253ae303bcccd249d89edbae9c6a12641f30e1e6d9ef46f784bd626b18bb50f0d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608189, "uuid": "1e0310cb-0a45-4721-856b-6b06fffda079", "value": "T103C2D1D0D8919831D850C5B0C76C474AABFE7FB942F63335283CE694E2E9A8331746D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608189, "uuid": "2735df5f-bfcb-4dc9-85e9-8599be1821ed", "value": "384:QfhcOI3LKLQPNuDYJJwDCIVD1NoUL+hhE8dVMZQTsvbhymdGUop5h8e:Q5cGcVuDYJ6zzqgQVlsjs3UozX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608189, "uuid": "c5ab1455-1b7c-4581-8841-76015a4df830", "value": 26368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608189, "uuid": "a8fcd704-3626-4664-9646-3ba03e2d525b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608189, "uuid": "c00522df-defc-4a1a-b811-a948b0f77387", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a6bd0fb-bca2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762606459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606459, "uuid": "0bdbfe6e-dcdd-418f-a5a3-dac16b102207", "comment": "Malware payload", "value": "39dbede5aac99a38916b7f93579129fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606459, "uuid": "f5f7af6c-94a3-4844-824f-1f5a1e2838d4", "comment": "Malware payload", "value": "223981440c373d022d3afaaf588a12dd367449713b6ffec718429e5883c9baa0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606459, "uuid": "acfdd7e8-9572-471d-bf0d-a96287091390", "comment": "Malware payload", "value": "a74ea2e22e4af70dd738d6ba042814ad655b277f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606459, "uuid": "33898d81-118b-4f0c-a279-834682e6bccb", "comment": "Malware payload", "value": "9be85fef35a9b8a4efd508ad391f89c39a92b53070d80b6727eb567c4cb90f239ed3ccfb91945564790f9aba5105cd9e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606459, "uuid": "76d32c91-affd-4388-b09b-49ee23254b72", "value": "T15BE49D99FE4E3D46D2C7F33D9B4587A1312B75E4D32382B27941025DE8DAEECCAA1610", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606459, "uuid": "84d1f45d-118d-4c24-9efa-863dd9cc929e", "value": "12288:fwQpoCV2n3O82/tMnQFn5bhOj9G2D2Qn2Jjs5vZLF7:YQpoCV2n+anslhOJGzQLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606459, "uuid": "159bd075-0ca1-4d3e-9bbe-830607568ac1", "value": 669920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606459, "uuid": "578cc0a8-801e-45b4-8aad-3a31a6b7ccee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606459, "uuid": "dd8726e6-4aab-434b-8264-37d8d84cf8d0", "value": "executor.arm64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1837ce70-bca4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762607341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607341, "uuid": "0b6a690b-463f-4200-a8dc-8bb039e68289", "comment": "Malware payload (Rhadamanthys)", "value": "5d7be4d457f62f4bea637f20a5a80576", "object_relation": "md5", "Tag": [ { "name": "176-65-132-69", "colour": "#93FECD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607341, "uuid": "9c21c9b4-8ec6-4548-a67a-1ed4f0f97c43", "comment": "Malware payload (Rhadamanthys)", "value": "229c551b9825b6b41594f4c26a3864aae479d4d11d908406c25170c5596ea626", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-69", "colour": "#93FECD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607341, "uuid": "122201a0-2838-4a9a-b1d9-0255c00d96fb", "comment": "Malware payload (Rhadamanthys)", "value": "0219398fe8d70ae8ff45258dca3befc4e1e8bed8", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-69", "colour": "#93FECD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607341, "uuid": "fb450064-f86a-4476-88e0-7ee08557feac", "comment": "Malware payload (Rhadamanthys)", "value": "29ddb217a219debe230ece4b01277611f5018394bf6c6f3c7e8f801bb05a22333b8adbdf5506e621642d255eb14bce65", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-69", "colour": "#93FECD", "exportable": true, "hide_tag": false }, { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607341, "uuid": "848224be-70ff-44ff-87b0-18a705388ca2", "value": "T1E4369D03384459E1C9EAE1348A618941B670784A0F7337D3AF91BABA1F3F7CC5A3575A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607341, "uuid": "e2decbfd-15a2-46ae-9fad-15b1462046ce", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607341, "uuid": "42d96fbc-38c5-4294-ae10-44e988e814ba", "value": "49152:gVrIhK1tqT34eZHNVfgEmSwDM2SgEEkw2Z0D12iJT+x3OaDGap/9zommqmIOvP2g:UIpbvtl1/wggkfHiJT+xd6aj6qMvOeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762607341, "uuid": "7ceb8488-aed9-49c7-9c05-34b552b5ef58", "value": 5309440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762607341, "uuid": "8820c2e2-d7a7-45f1-acef-515d8f07a1a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607341, "uuid": "62d7cfae-4b25-4408-b04f-104f5d2b3e90", "value": "setup_patched.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5b21d3c-bc6b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762583178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762583178, "uuid": "74fbd457-8e4c-4298-9ee6-617eeac6d6ac", "comment": "Malware payload (Mirai)", "value": "45004d873a33e772f76fe982cf5b14c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762583178, "uuid": "c811fced-d485-4af5-9feb-4d7a7a881e15", "comment": "Malware payload (Mirai)", "value": "230a21a1cb505383afcfbc0a955d7a0546cdd39954f62475d9a730f94a049d01", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762583178, "uuid": "a11ab792-82bb-4c48-b83d-9a653dcbb821", "comment": "Malware payload (Mirai)", "value": "c72ff83a55944115a6df5c3ac8491e76197e2a9a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762583178, "uuid": "88dbdfc3-c4d7-4fd8-88d3-7c7207790b13", "comment": "Malware payload (Mirai)", "value": "a37e64ad68c85331820d23d0e5fbd18bd05f42c0e725da7f5bacc9d08e3734cb13c4679db99f76d08f02dd47fc8160e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762583178, "uuid": "174853a3-9e92-46af-8232-e8ef8047a714", "value": "T1A173AF63C9642C94D55842B9B0B48E7A5333F90456872EF616BBCB76900BEDCF40E3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762583178, "uuid": "94bfd9bb-3378-4d68-9e0c-7c3260ead9a5", "value": "1536:v/iZsIuVHqWr0n9DqK/AKsayV7XOengdCvqcfb7/lW:vKZshBZS92Kvs/NngdvI/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762583178, "uuid": "418ca0c4-2386-4749-9a2c-c1fd86502ee7", "value": 79392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762583178, "uuid": "787f465d-96c3-4cc7-ad7b-47bc5513a46b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762583178, "uuid": "90f729fb-ebfb-481c-9138-04b6f628079c", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e15e9e5-bcb3-11f0-91c6-42010a9c0006", "comment": "Malware payload (SheetRAT)", "timestamp": 1762613874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613874, "uuid": "03e73f38-2d4c-4843-83f7-1a6f5ecbd15d", "comment": "Malware payload (SheetRAT)", "value": "3e4d46612eb70a89364566b286b2b000", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613874, "uuid": "33f0cc45-1a19-469d-8691-a23bb5b467f4", "comment": "Malware payload (SheetRAT)", "value": "231fd53698c2b599aebbc7bc2ac24d813f06a20684283a4d9cfcebdc4004ad94", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613874, "uuid": "962d54fa-ca0c-43d3-a64a-83908f6f33e1", "comment": "Malware payload (SheetRAT)", "value": "4ae4911d2074412c646812ea485c8918d874f285", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613874, "uuid": "10401fcd-7a72-4353-a2b6-e62484faf5f5", "comment": "Malware payload (SheetRAT)", "value": "e52c2d56d7c371f4685767fb03919d33156e533b13c7e45a07ab0c27e36e03430169ba6b83c1405449113bec5f821609", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SheetRat", "colour": "#49A40A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613874, "uuid": "3aa54476-fb76-4728-8f91-0e307c25c53d", "value": "T13D642322B2DC9123C2EC46FE1460D1490327FE576ABAE708FAD8B4F9C241A4556CE93D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613874, "uuid": "2bfb176b-4676-42c6-962d-9f78bf9ed0fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613874, "uuid": "3d10bfe6-f909-47d0-81a7-9525848f5890", "value": "6144:2EJ/pG/8PPD6X8f/KEAktawK8rImgitKq869LKHmH3flFcYxuNHsTaPb9g:2EJ/M/8Pusi1kkwK8KqBOGv46wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762613874, "uuid": "478773cd-643b-4ae4-8dd8-d6e04781a96e", "value": 312320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762613874, "uuid": "32a38bfc-7a52-4540-a8d8-b2d6c24e6831", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613874, "uuid": "165b25c0-af0f-4ddc-b11d-0a21e7522359", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09ef98fb-bca3-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureCrypter)", "timestamp": 1762606888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606888, "uuid": "fa25b84e-80f2-4899-83da-3a981bbc68af", "comment": "Malware payload (PureCrypter)", "value": "2a6eb1fef1f754e0217d78047219553e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606888, "uuid": "ccb31e2c-f776-4306-98d3-3d82367bb6ca", "comment": "Malware payload (PureCrypter)", "value": "2375a6489fc38cf4cc71cd4c8b4765a8e9a13c63f16116827ca6ef6b554b3ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606888, "uuid": "f1afff3b-1845-4ea9-b37b-f5af3f531c7e", "comment": "Malware payload (PureCrypter)", "value": "c3d796487af6ad8df5254ae0b55c51f812b323ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606888, "uuid": "730a82c5-e2e5-4329-a325-c744aab688a5", "comment": "Malware payload (PureCrypter)", "value": "c8a28c1dd05df542ce3a087075627ca7eaac7d935224a5799adfe2780497ea9c5f57878f690d761fe060bbaf02f94863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606888, "uuid": "6d6dee15-50a3-44bc-9b1e-7cc7670e559a", "value": "T1BC3633B0FDC98807EF88D1F967D0CA9D05D3767ECB5342B87A4A544FA4B9183E129B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606888, "uuid": "279ecc8f-5a06-4c61-a39f-af1bfab0104d", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606888, "uuid": "d3495b58-8229-402d-baa0-fab7ec642ff0", "value": "98304:pC0qREb95MSLUtRaDIN5gBC00SCc09ujXmBiA7i3yuWUxLh:1qRaPcNBZK09uj2gxyuWUxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606888, "uuid": "86797189-c838-41bb-9064-4c2d1e86382e", "value": 5046272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606888, "uuid": "3e2c5395-fea0-4ceb-abbd-4461f6e8cbba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606888, "uuid": "3db18a81-8234-457e-9967-fc6875fb48a9", "value": "Installer_v49107_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d585d8-bc6a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762582639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582639, "uuid": "e9561ee7-95e1-455d-8b16-81a6947393db", "comment": "Malware payload (Mirai)", "value": "4ce3e76fbf088a60c0bd29e342e511c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582639, "uuid": "75f1f521-eef1-4f6e-a4c6-eb30e4cae463", "comment": "Malware payload (Mirai)", "value": "23a44923aad10516f6a9ca588f2e5a069d86d8bee55700e0d787dcfc25364433", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582639, "uuid": "6258dbc5-8eb9-45c5-b057-eed0ec8d3a38", "comment": "Malware payload (Mirai)", "value": "92ff9e4285e8ce55fd08e1c804e694e7e4f1e11c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582639, "uuid": "e112667d-cf05-4984-99a5-854922a52b1d", "comment": "Malware payload (Mirai)", "value": "9e0326343cbd5ed4e0771a063f32b3e2bc8af3f8316e80830c50399bbadc6cf7ee21ceff3436719f2f4db611c084c9fb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582639, "uuid": "e1c985f9-55af-47e2-ace5-ac24ed02a2a1", "value": "T14403F205C8B9676AC97B557739AE6FCB2850841A0E4D8AEF8CD4106E9C7132EFB047D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582639, "uuid": "82a5e2b9-ece5-4c2e-b328-ecf509a5effb", "value": "768:cnLB9NE9YuID4qGPXDHCEjeAyI+u704FIaOjYdzfPe+u9m8RnbcuyD7UGQRjz:gBDE9Y94vHCESAHyk9zfo9mOnouy8GyH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762582639, "uuid": "08001052-cc76-4147-a407-a849ea04bb1f", "value": 41368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762582639, "uuid": "3315bdab-d5f1-44b1-a52c-9bf8e0b72b2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582639, "uuid": "4ae31c44-8dcc-431c-b5c5-20698e3e9c7a", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34f45d12-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602235, "uuid": "df116519-388e-47ce-a729-63f4716f8bf2", "comment": "Malware payload (Mirai)", "value": "d713244daae457a5c9bf121181060600", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602235, "uuid": "92f68428-488b-4000-b522-f81f98c4be8d", "comment": "Malware payload (Mirai)", "value": "243f02faed2826cf0abcfbf22d401be218f418679b75ef7e6a6751a1bc7a545c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602235, "uuid": "f8134229-1ff3-4e0f-85e4-3aa4c4dd4a8e", "comment": "Malware payload (Mirai)", "value": "8c1d64efb8bbf0b70b6be17906a5a12e3968a17d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602235, "uuid": "bc652b20-063c-4fd9-abb5-dbffcc26039e", "comment": "Malware payload (Mirai)", "value": "0d619ea868b80de07b786d955472c84ac148288cac81b46a03b9ed03bf56521df46b27b77caf8ffacdf2a6bb54fbcda3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602235, "uuid": "28f20083-4692-4437-8d3b-6cf63cf5b25b", "value": "T10D415CD4D3418B3852865323FFB9AB8D3D8BE75B3C32DF2EE85518BA0358C487195942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602235, "uuid": "b03c80f7-b595-438c-8325-6f3b0fdf422a", "value": "48:CTc1THeTWVXT0BTFFmTO+ET7PeTfSTYnTzw:CTc1THeTQXT0BTFFmTOdT7eTfSTYnTzw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602235, "uuid": "062770f9-1e4b-43c4-b4cb-c62ec04362e8", "value": 2096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602235, "uuid": "b65fba9d-7718-4cd4-8006-fb41982afe15", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602235, "uuid": "14baf99e-06a6-4d17-a771-7a513ea24eca", "value": "8UsA.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4bc04bd-bcae-11f0-91c6-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1762611925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611925, "uuid": "b42aec00-09aa-418e-a14f-a2c808d44a3a", "comment": "Malware payload (Socks5Systemz)", "value": "07ce11eb0c613680324349251a02f718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611925, "uuid": "30c574ed-e0d1-4070-aabb-22aa8662f0f2", "comment": "Malware payload (Socks5Systemz)", "value": "2467a15e01219fca80155df36a2f97be5457c59bdeb1ac1fff027174bd8db383", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611925, "uuid": "378cd170-027a-4885-9d0c-8e4140ebdc62", "comment": "Malware payload (Socks5Systemz)", "value": "ed38aa11b19d981707daf7b7d8ce5515ed3158b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611925, "uuid": "29e97ee6-327f-41ed-a1a8-1af0d6a7536a", "comment": "Malware payload (Socks5Systemz)", "value": "82a64c6c0faec736bb32ab5c882e363999dd1b97da5e1d1095e7157e25d28221b36fd2d47f7a5d63eef2b60197b09e0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611925, "uuid": "c44e1834-6a27-488f-bb40-2425e027f316", "value": "T18A163323D8A2587BE1D4FCF49C1E94180934B9214CE412C63BFA5F796A33E95DA11B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611925, "uuid": "881540a7-1d34-4097-8938-b89d608250d2", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611925, "uuid": "51aac348-81c5-4d9f-8b11-9eb1f3b84d9a", "value": "98304:MzsrnHCOnvfZF8sIALjznkgKFT/Yu2LU71VL3DKD6p7TQ:NnHCyvfZF8uLPnk5l/pwU7PL3DK478", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762611925, "uuid": "f166996b-f956-4c65-a812-97375a708dac", "value": 4197459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762611925, "uuid": "c94513f7-3ee4-4a07-a5ff-886262d61b62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611925, "uuid": "0ddf3b68-7b33-405e-ab0f-584b84f3b0d2", "value": "QDA2c2UJMw4bBdLbqi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a393a2a5-bca7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608863, "uuid": "f159ca6b-a911-4fb6-9158-1de85b6acd5a", "comment": "Malware payload (Mirai)", "value": "c2572b7dcba5d98e72403cfb37a9fc97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608863, "uuid": "a6d94d7b-72b5-4f75-849b-e5c20a58ad2c", "comment": "Malware payload (Mirai)", "value": "24a03e97b4ea6bc5698c43ff7f0cfd2327a9a6da983942b747d9072ed8aaf487", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608863, "uuid": "e6866e59-4306-48ec-b441-f5e90dfbc7fc", "comment": "Malware payload (Mirai)", "value": "9c37fcd3d3a2a82f87b18ef4a61558ec8b1698bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608863, "uuid": "8d41b508-3bd2-4518-96d6-180ada9289c7", "comment": "Malware payload (Mirai)", "value": "d4e8184363e8a03aa5e95294a2557f0127b5e11e4da95d43fee26a02e59749809fb4a4e362a6e9249aa9978eed5b30e8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608863, "uuid": "20fd525a-286d-4ab8-8dc6-db3c66756ae7", "value": "T162834A02734C0D47D1A75EF42A3F27E593AFE99121E4FA89650FDB4681B2E33154AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608863, "uuid": "ed65f5a1-1cbe-4122-a1a4-1c51a0ff9cc0", "value": "1536:0qipvHp+OV2KQusg3O98+wu9qKbGE+Kdhz:XipvkOgs09KuWoz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608863, "uuid": "4a3b9f0a-6377-459a-889c-3cd6b99db600", "value": 83528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608863, "uuid": "b875d3ec-e68b-41f1-b834-2e52344d2ce4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608863, "uuid": "d8384b2d-b884-4ed6-be1b-2d0ea9514a38", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050842a0-bcca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623630, "uuid": "2a62c211-cf43-4182-9d5d-5e545e8d921d", "comment": "Malware payload (Mirai)", "value": "565a282ef2687b33922a95c429fc3890", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623630, "uuid": "6b93a1ca-5d28-42c4-b348-70fe9e58e769", "comment": "Malware payload (Mirai)", "value": "256b13faad20b46a9c2f529bbbab6824d6e04152e18935ef4e27e08e8cbb8090", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623630, "uuid": "9ae3081e-246d-40b4-be5c-c520c1797b5a", "comment": "Malware payload (Mirai)", "value": "7b908ba2474822dde0a59b16335a1929670a66e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623630, "uuid": "96faae6d-52dc-40bd-b871-769dabc6ecc5", "comment": "Malware payload (Mirai)", "value": "915c38a1f64dbf39578f4ffb532bb9c91e4ce7b32900caf4ea42a6ca89c40e9226196b263de3505b32b479b842f5e082", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623630, "uuid": "b64216b2-f2f6-4b2e-a1d2-412b043660f4", "value": "T15BD37C73D8256E98C625C5B4B0648F782F43D1A881436FBE69B7C2B05487D8DF609BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623630, "uuid": "8b488108-20c5-4509-9d5e-6397a2ddca7b", "value": "3072:oOuckx3SPZjjNnfXDM3dLWIK1Er+6hh1LLb6:oOuclVjNn/AdaIoENLb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623630, "uuid": "34c29bb2-d879-448e-a4a2-51615e9d185f", "value": 141920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623630, "uuid": "8289a6a1-8e50-42fd-aeb2-b302be94a87b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623630, "uuid": "3e494dff-177b-4931-b61e-5638cba452ec", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa509428-bc4b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762569495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569495, "uuid": "efe8a14f-f303-4d81-9512-2795bbdc8071", "comment": "Malware payload (Mirai)", "value": "c166123a74bbec5ca38322fa51a26735", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569495, "uuid": "c2a17e66-75ee-45da-a8b8-28e3210fdc5d", "comment": "Malware payload (Mirai)", "value": "296d6af5b711aada05ec72d517af8b677c32d4f894fda2934ad5289b7f671619", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569495, "uuid": "c095591a-3249-4b2b-a119-11f35edaeea7", "comment": "Malware payload (Mirai)", "value": "393f390a0bca8a019e273b848ceeff98356dbd70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569495, "uuid": "1128238c-aa89-403f-b2ec-d73d6a8d7ae0", "comment": "Malware payload (Mirai)", "value": "8a749b68f1d292fe80627cd841e026a5de2627d3d29ba8c03f8526f4fd8eb17f99ef43c54d1933decee1004abb871c68", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569495, "uuid": "79f545de-fdc9-43f0-ac09-0ada97f7f2f4", "value": "T1C8834A84FB87E0F1F6A305F0061BE7AA5774AD185015FAA5FB0BBB797C322126D4621C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569495, "uuid": "7a7a47ed-0593-4d0b-96a0-af88df2e94e6", "value": "1536:XenS4WqqVzXfZ9fghZiIGehag+8LSaPu7orfFCdRiAt:XeSjqqVzXfZ9IhFGKag+8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762569495, "uuid": "011e0f7d-8b03-47e8-b38c-c946fe1a9d2f", "value": 87264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762569495, "uuid": "b43792ad-64ff-4455-a3af-b6f1e7525d0d", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569495, "uuid": "683224fa-b92f-44e0-afcc-3fbd762aacb7", "value": "frost.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f181c455-bcb8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762616296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616296, "uuid": "97a5f9aa-4e02-44f0-87e4-b36c88a8a15d", "comment": "Malware payload", "value": "17b3722fe9b4a7870d97b1f075347986", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616296, "uuid": "01627a91-1bfb-4b6c-99d2-37299286a570", "comment": "Malware payload", "value": "2a09f3c1c133e2229708929f98b9aa1c83f037e59dcbcc02b63616e786ecc4f8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616296, "uuid": "9d0bbc47-0834-4873-bd0e-816bf1a008aa", "comment": "Malware payload", "value": "6bc169b1ad2b1ebfe081f32e594efad14ddd86a0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616296, "uuid": "83cc4ff4-c343-402f-b928-2355eed7a4d5", "comment": "Malware payload", "value": "9656f57fa3cf002a538df9294efac781e80e1fa9e91215e21b97eaf924721f5be150cbc909dd4fa7beac940f9ea83088", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616296, "uuid": "264ccbf3-4f89-49af-a3bb-d1e29ad82008", "value": "T1085612DB26BB34A584B832C4CC97340562969A878F257559F3620EC8EB9AF31F077D70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616296, "uuid": "b9abc520-9224-4a03-8663-8a56d8e3fdee", "value": "96:gETbEpoitHElEbE1UFbq69I0E99gPIfL45GXaE3VnUMyw8zuz50J:BUmegbl38zkuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616296, "uuid": "26d31ccd-8ed3-44bf-8a24-ce60539373b4", "value": 6448801, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616296, "uuid": "26c2f9d3-5321-4045-857d-cc5c060bb2b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616296, "uuid": "e81c059f-1576-4c83-b281-f4cf8dc0cd3f", "value": "IMG_20240511_0000009.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0311c0-bcb9-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762616531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616531, "uuid": "6411c5a1-01e9-49e7-afdc-691d459981b7", "comment": "Malware payload", "value": "19e3d296f807d242a08d573e9596a801", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616531, "uuid": "1155f82e-c923-454d-9d5d-3eeabfcb9900", "comment": "Malware payload", "value": "2a4816da6e64b3d7d46082a9403599bc8a3b0c3b5e40e244c6812bb1ea4e5f3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616531, "uuid": "3a062c4a-32eb-4aac-acac-1baf520bd09f", "comment": "Malware payload", "value": "01ad8bd210846a6dde23314fd5b1f275b7664c11", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616531, "uuid": "addeb68c-223f-4a78-b918-3961a10060e8", "comment": "Malware payload", "value": "64176af496beac485a001d4d78cfc4d85e842a4dc924e570107a60cb82b189fa5004fbdb7ace51c814c50391e18e85d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616531, "uuid": "4aef47c7-805c-4933-980d-d9a582e393ca", "value": "T12EC24AB8A7DAD231D5E866BD669B22BCC2A253DB885DE3C3471C2C106E7138C7C11B4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616531, "uuid": "f542bdc8-f7f6-4c0d-afb0-36178e533b9e", "value": "384:SGLQ6DH7ENkKSnjPP1JjpLKrdYz7rKY9b1ro1Cp2:dzpKMr1JjlKrdYz7rb9wCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616531, "uuid": "f1ca6403-b58c-40d2-8fff-4253c66af787", "value": 25928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616531, "uuid": "1f9196f2-646b-4b75-8913-58a0219f3525", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616531, "uuid": "67bcb7e1-6d58-4613-8365-8c5593f66ec3", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a228235-bc9e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762604875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604875, "uuid": "af4549d0-5f38-4b2d-b84a-ed4f5a80eeb5", "comment": "Malware payload (Mirai)", "value": "c6c2f181c8672e64e2784780b34c3017", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604875, "uuid": "0e2e9778-90b6-465d-a937-ace09858aecb", "comment": "Malware payload (Mirai)", "value": "2a5cbf241e6c5df7d3578ab62671651ed277220be6a868ff3184d23c60fb8b6b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604875, "uuid": "a672028c-2522-4e91-8e75-9205ab4d311f", "comment": "Malware payload (Mirai)", "value": "a4585245fa5c3720d467d6f76e92d8c065e45833", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604875, "uuid": "19bcc9e4-ad89-4437-90de-51505a233f11", "comment": "Malware payload (Mirai)", "value": "b7e682f112988dbae85155ec4afe645581835154382b76aabdb539852129ff33876742b2bb1b79e2cda321b1771eff06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604875, "uuid": "668bb2ca-ad27-4c2a-bef4-6ecaf5ff2948", "value": "T1BC933A01B3180F07D1675EB06E3F23D6D3DEAAD022F4A649650FB68991B7E325186ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604875, "uuid": "44f6a65e-7816-401d-a35d-d4f784d80cad", "value": "1536:Cv60mKF8uqN9Cy4PlX8jDvC4dS03z+EyNhzMvqJoZdSZem/0:m6dGPyClAx3KEs+M0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762604875, "uuid": "0e04b860-1d80-49a4-a0d0-1d95169b6a6d", "value": 92232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762604875, "uuid": "115f34f0-c1e3-4419-abaa-a664fcb2e158", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604875, "uuid": "195dce0a-13ba-4d46-b996-dd9c33be9b97", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e38809e-bc69-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762582172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582172, "uuid": "cff2dd81-b600-4cc2-9e90-f15bca6d4a87", "comment": "Malware payload (Mirai)", "value": "633b8a664053842922885fcec29d05b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582172, "uuid": "656b3e98-bc7c-4188-89a3-57fe531b0299", "comment": "Malware payload (Mirai)", "value": "2c600d1b808cb5272cebb0de29bcbe8f453a51a05d036c693e0f378f57b41685", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582172, "uuid": "962cf372-e288-4bfb-b762-838d026f597d", "comment": "Malware payload (Mirai)", "value": "45afa14c1a6da7eadc481152495beab3a821918d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582172, "uuid": "3ce8b324-027e-4b55-9f4b-3d31b3415224", "comment": "Malware payload (Mirai)", "value": "eb27d7c909c651f1a136a85dc762511e09c87c9b37723e61f5ff067a9c06c87a32b454240dc8bf6e5c68c6d3b0252f13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582172, "uuid": "24b3808c-53ac-4bc3-967c-f8ab996e03c3", "value": "T1BE933A55FD81C612DAC06673FB1E428C37271BF8E2EA72039D265F21638E56B0E3B591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582172, "uuid": "f077018b-4f85-48b4-97ae-3e574d311e37", "value": "1536:jcAIxYqHB8rWkR2YHXFyiN1TkBKL9ll2Gvwfjeme:jcA8YqHWrWk33ki9HWu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762582172, "uuid": "2ad5baec-00db-452c-8c51-cc931831fab5", "value": 96676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762582172, "uuid": "2ebf2e89-b618-4fa7-8a6b-af1e3be5738c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582172, "uuid": "fc9d6eb9-3334-46ec-9ff7-e0983f874040", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5827386-bca8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762609323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609323, "uuid": "6e636c88-e99a-4124-8bff-aef46ac53129", "comment": "Malware payload", "value": "35e1020d2cf6c895f8703de36c6ed00a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609323, "uuid": "553d4941-270a-4898-91f8-9d0756f16ff1", "comment": "Malware payload", "value": "2cfe6a530b26eba7c8c71c5e167133ee6ae2bca672e926be945d2a4261bbd019", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609323, "uuid": "797117f2-7bbd-4b67-a520-d443687fbd37", "comment": "Malware payload", "value": "2e4e052beab6ef97f26d8cc1a3a54324de076463", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609323, "uuid": "1c599e9d-c3dc-4b64-ac43-81f781ec475c", "comment": "Malware payload", "value": "d8f9659871980465e02ba759323ba6fef47e225e5c3472e2127446143361692d66bfe3661aeafd99aa29d54332c5b5a1", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762609323, "uuid": "2851fa0c-060f-4566-b77e-a3f02da7bce7", "value": "T1EDF4E71AEBF611E4F1BAC139D552312AFD7238A5473496DB9780461A1F31BE8EE3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762609323, "uuid": "dee6e6cf-4f2f-444f-9041-5752994f5d20", "value": "2ef8c985e9b36f0375b5310d853d0ea0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762609323, "uuid": "3c611030-44fb-4083-aac0-53076bb36fd5", "value": "12288:Fb3d4GYSpFoO4IduluDO+ZFiXhzjEXembVYdK:Fb3d4GYSpFoOOuCmcj4em", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762609323, "uuid": "b168bfd0-4ee0-4138-a5ac-c8b16dd9cffc", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762609323, "uuid": "9aa92430-7098-47ec-afe3-7a80c29040c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762609323, "uuid": "d64cd18a-4b15-48ff-b05c-0a8075352b87", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adcec86-bc95-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762601037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601037, "uuid": "bdcd935f-c479-4811-be75-040cd1e4adca", "comment": "Malware payload (Mirai)", "value": "25e558b3b6d812048b9a4fe0d7b8a1a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601037, "uuid": "4dab3731-bd58-4005-b6df-c994e0576c26", "comment": "Malware payload (Mirai)", "value": "2d3653635259c9d216e8328510a6e07ae6d4ba57c6d2fd7fd50c7e26699db40b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601037, "uuid": "f62c7224-a1a3-42a5-9258-7af1dc0c0d9a", "comment": "Malware payload (Mirai)", "value": "02e964f6a4d0d88419d345770a7af487a0fc7304", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601037, "uuid": "c5e59f67-1fc3-4017-ad11-32bb79cd1fe0", "comment": "Malware payload (Mirai)", "value": "75cbf532ac207f1a8fc71bf94589924dd01b1fd869bf7442620d741ae638eedee12a9815b2359a929959e0bd7e4a791c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601037, "uuid": "8d40e892-3778-4218-bfa1-830961ff1a75", "value": "T1AC13F182163A8B0BCA7DD0771CFD795E6420031D59C79EF9AAC5B63E64C0768EE286C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601037, "uuid": "77b9aca6-9a5a-497c-9a02-3c09ca820be7", "value": "768:LYsaHFySnxbqJj3TssolmBzVpTUlOFAosXDzBt1B4DHHXpuRcH8YtXIwBPnbcuya:OlySnh2bYP8hp+49sX3v2HHXvcYDBPnp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762601037, "uuid": "77f373d8-2916-489d-b239-e08a2859e330", "value": 43004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762601037, "uuid": "ebadc50a-77eb-4254-b899-cc1527960908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601037, "uuid": "f65b8791-d19f-401b-abcc-30dc4c8159d0", "value": "executor.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b291b80d-bce5-11f0-91c6-42010a9c0006", "comment": "Malware payload (QuasarRAT)", "timestamp": 1762635517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762635517, "uuid": "b1f2441a-2ffa-433e-9607-deb25e6f0471", "comment": "Malware payload (QuasarRAT)", "value": "bfb0efffd02a877d464b2c3628fd719b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762635517, "uuid": "c5b7cbc0-a104-42f3-b105-f53ffff782e9", "comment": "Malware payload (QuasarRAT)", "value": "2da636aa556256d9634ac820779f84cdac7f767f2a92be6e5424862d8fcffd85", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762635517, "uuid": "518e2a28-2f78-46cc-8fc9-2a45402f85ba", "comment": "Malware payload (QuasarRAT)", "value": "ca55d23eb9d7fb149151131a0314a36a04bc2e8b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762635517, "uuid": "e33665ec-0073-432c-a8b8-99937332d5a1", "comment": "Malware payload (QuasarRAT)", "value": "cf7025438bcb6dae71bc946418eb9506930ece2c38f06192a5f12f2ab93b0027b5442fcf05648ecf1a08dc0545e82980", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762635517, "uuid": "45fa408c-e352-4d80-bb59-ecec160dbffe", "value": "T1BD15CF5073E54207E1FF2BF9A4B606050B73B552E936D78F19C8A06D0EA3B91DE603A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762635517, "uuid": "c0e77650-3e0f-45de-bd34-7f626594a11f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762635517, "uuid": "f5d5f51d-478c-4fe7-a070-ba292033d597", "value": "12288:nMen0tWfOzAYQyg7oZisqtksOtgg+WLyDrQ9/7WxdtbiLNg1OkG8aPKTkCEH:MDtWfOGyclOoWLuyWfaN+OaAKTkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762635517, "uuid": "3752530f-2895-4435-92bb-58da1df53c20", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762635517, "uuid": "88d2eabe-7d60-4621-8840-2fb3c70615c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762635517, "uuid": "c1fccdb8-a6c7-461a-9bb7-13e71e8907b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cae52b-bcb0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762612697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762612697, "uuid": "3c31f91b-fdda-4e9a-a502-fdd5e4be1d81", "comment": "Malware payload (Mirai)", "value": "724e39f11ec8d4b830093c68345f8333", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762612697, "uuid": "7a96a888-9545-49cd-89ea-51e90e32937d", "comment": "Malware payload (Mirai)", "value": "2dd102cb77605ba721bfc799a870cfd3f883ccaff65b565669fe847dd9c9a178", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762612697, "uuid": "d3269656-352b-4b70-a1c2-9a11662f8768", "comment": "Malware payload (Mirai)", "value": "53d8961eb37647903fd45d5381029f41255e49da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762612697, "uuid": "347e7c12-c1ed-40a4-99aa-f0a5e8acb408", "comment": "Malware payload (Mirai)", "value": "0fc1bd69a4f22af0c3823a9ed662f6bcb08e4247a2ebbc4cf3416234e7d90a6624b04973bb44723bc9105520e044c3a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762612697, "uuid": "ae9e60af-aa47-4098-acf7-ee76a69d4fd8", "value": "T1F923F14AD3F1137DD52E233868BE655628C0F44B63A409273ED4209DB8ED7E16B2DC63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762612697, "uuid": "91f89c91-f4f8-4de8-8b83-ba53da076d84", "value": "768:LessG0aMqhczBPPoy3YWX/RJOHXkRMscGQaUdhBMfn66s6nbcuyD7UoQRjk:LessLD556HXbaya/nouy8oyY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762612697, "uuid": "a67ff299-b7c6-4cc9-9ce2-c4e5506d754e", "value": 46732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762612697, "uuid": "dfc049a2-424a-4751-a209-48c22a01138e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762612697, "uuid": "f13ff47f-a280-4fe9-9e27-2cdb685509a1", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa51c38c-bca0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Meterpreter)", "timestamp": 1762605868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605868, "uuid": "6289e84b-1348-4861-ae63-bbbd708b3f31", "comment": "Malware payload (Meterpreter)", "value": "c41c4dbc5b59f55ecd0a0fe0a46f28f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605868, "uuid": "5a2f6cdc-1526-4d6b-8152-937d038a895d", "comment": "Malware payload (Meterpreter)", "value": "2dff71491616990e3a350ba7c1128ccfee9fa9826cfaaf92f62e1051ac63e46f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605868, "uuid": "7d9a480c-8e30-43b0-a690-7dead820b225", "comment": "Malware payload (Meterpreter)", "value": "dc8742bb944b97e33563bd611ced0e0062902147", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605868, "uuid": "982254c8-21a6-47de-a8ef-6e3a41259430", "comment": "Malware payload (Meterpreter)", "value": "3c24599d078deef977cbb5dc4b7d2e142790d7c3bd5a715d1642e7b79bfa3844d05c1d3632a4734dfc17b40a8c3d74dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605868, "uuid": "d485b31c-4a2f-4ee0-8bcf-d113e4442f58", "value": "T12BE100A762265CF7F6392BBD85439B8660FC773443D34B4D0A68044A51A2D19B8A5F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605868, "uuid": "8274604e-3910-473c-af61-48fc6581af45", "value": "c2d02fc98f1d75d7b9457468ec75da0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605868, "uuid": "0dc1039d-e89e-4ec1-9143-6bfa016584a8", "value": "24:eFGSG9wSjUIKMy58XZh9h9ClfAhEsIAJsj4up+:iG+ixjyeXZh9hMluEsJ44b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762605868, "uuid": "302cbb04-ec1c-4988-b795-954af7f93c6b", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762605868, "uuid": "dc3d46ec-efe9-47ff-8cac-ac75b6c34143", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605868, "uuid": "260681ed-6e03-4ad4-ab84-ccf5016a663c", "value": "SecuriteInfo.com.Trojan.Inject6.5094.9205.18749", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1533f1ac-bc64-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762579848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579848, "uuid": "cda74d8b-01eb-48be-bafa-a675ab048d66", "comment": "Malware payload (Mirai)", "value": "b4bf6096e56cb6bbdac03ba717dc34f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579848, "uuid": "700b876c-e9f4-406e-9ef3-f9bc5f55b51c", "comment": "Malware payload (Mirai)", "value": "2ed64a54f7235eba1c8757850564d65a742912d0d76b1c0709f744f87982cd19", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579848, "uuid": "c3c719d8-e0e2-4313-9746-952a2d0e63d3", "comment": "Malware payload (Mirai)", "value": "6751c704013d84166fa8f19d592311df250f9d7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579848, "uuid": "d4aa8503-7ee0-4f73-9cf3-0b99bdb62b9d", "comment": "Malware payload (Mirai)", "value": "5de16c842ee2b18b3aa387145640871353fc0902991c95137af87676208ced346941d1d7deda86b9080e2e4d3f1ca777", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579848, "uuid": "cc1ee07a-2ad3-46df-b814-b8dc7a0920fb", "value": "T152B3E609BFA01EFBE8AFCD370AE9170529CC592626A93F757570D818F24B24F15E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579848, "uuid": "35fe89c1-2145-4c47-a9cb-f7151b7f8f86", "value": "1536:wyiLXtRxWd6Va6NyG2ujw7PEBZYNhpWtWJ9PFYCfZMBPsmFf0IHOQrQNG:9ivgd6Va6NZdopPfPFYCf4KoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762579848, "uuid": "10a198b1-2556-4b06-be05-03f89addb4c0", "value": 118024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762579848, "uuid": "c528dce0-b943-41f9-899c-0620da4c6575", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579848, "uuid": "758b5b90-e744-472a-ae6b-52658c6a7add", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ff5e24-bcdb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762631032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631032, "uuid": "7011bc53-d7bf-4792-8cb3-ca97dcadba9b", "comment": "Malware payload", "value": "bc771ab9b4773a02a239c170e4492bdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631032, "uuid": "d752175c-9573-48ed-b66c-9b3f516058e4", "comment": "Malware payload", "value": "2f99962bca44eb4689971c054a9dc373ccc1765a4d58256bf77a7c026d037b90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631032, "uuid": "e816f71a-e319-4007-b241-10e7819d5226", "comment": "Malware payload", "value": "d1943041a943dec33209d9f69ac5c67b6f3a3da4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631032, "uuid": "dc449a8e-7d68-46b0-b5c6-541b617ea480", "comment": "Malware payload", "value": "40e8f9d8d301bb5114216e379fa59057232448b7f7c6ecffce0344f1207c1c4a987ea6edb375261335b901ed61fde285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631032, "uuid": "afc0f47f-d94e-4f71-97b9-c9c290a83285", "value": "T15383722818646432DF89D933C47AE6F6D6725C4B69F161D10EF72D233AEB18B1CE9702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631032, "uuid": "0f776dd7-141b-4aea-a977-752d260629fd", "value": "fca76dfda0e939436c5fe3ec67748d7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631032, "uuid": "7825a5a2-878d-471c-98b7-27b60f17a492", "value": "768:jEmVsXEIfaw7VSp4c9mdD7sfvGdREKC9Ys/:jEm6XEitJsfvGdRR/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762631032, "uuid": "c11ce917-7bc6-41cf-8344-795e6d56c73e", "value": 87552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762631032, "uuid": "09816172-cb86-4431-819c-5ad1eb352dd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631032, "uuid": "e0423c62-349d-4368-adb2-58e8a8078d81", "value": "Instalihaly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b004eb1-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620767, "uuid": "64236603-02d4-4776-893e-1620daabbaee", "comment": "Malware payload", "value": "06b52cf6588e8676bdb294a1196fb0c0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620767, "uuid": "c9a1339b-b0c0-49d7-baca-16c4689faaef", "comment": "Malware payload", "value": "3079e2e24c5f23ad77ac115c629e40a19968cadd0093175a548a8631894f9ea0", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620767, "uuid": "ff343d9f-535b-4013-b475-5d116fe6059f", "comment": "Malware payload", "value": "f9e7de97265ddd98799ba4e74b0c244a635d7452", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620767, "uuid": "a08249c0-cee8-4b30-9363-60a00a1d6df6", "comment": "Malware payload", "value": "c3829c155b3eb863096ee6730ec6094b429c722d6e5a9b7490fcafddcd9f4076e913764e29e9b11e91ad83b38d2904de", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620767, "uuid": "7519ae12-aa56-4230-aca7-cd5c68869588", "value": "T156243A61CD7002694F4B27DAFD680A22CABCC619552A20F1EAEE470D71065BCD3BD77E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620767, "uuid": "76dff59f-4a90-4f41-b291-610b1fd4a317", "value": "6144:upc6ypc6Vpc6upc3pHpkIHpPpc8pcppcqpc6Spc9phpcpcZpc6YpUpcEHpH:u6NGgpiIHRJKzqmXiiAirH1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620767, "uuid": "9c4e7e98-2108-4610-8f9b-a6465cf3cfa2", "value": 222987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620767, "uuid": "425b1a2c-75f1-43f8-a8ad-23ef5c20794c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620767, "uuid": "59ab832e-c758-4301-932b-280c3afdd3a3", "value": "2025-11-06-1018_001.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c835fe-bc77-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588097, "uuid": "da44b05a-0b82-4f2b-b61e-10800714287e", "comment": "Malware payload", "value": "c152d496e5fa7ee709e94f34521c7924", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588097, "uuid": "1bfb6df6-e54a-4cd4-af9c-a404d9c48de6", "comment": "Malware payload", "value": "30ad596176b9fe35a4f53d589c8612527b5546d2f7d896df5c290a3db0caab2b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588097, "uuid": "79d292b8-5114-4077-beca-e8f10d75e967", "comment": "Malware payload", "value": "323dcfb8c15d5582e2becdc71b569c273c292118", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588097, "uuid": "2059ecec-f164-4a5e-a978-71f2cea502e4", "comment": "Malware payload", "value": "ea3e177b8a546ec8e79440abfa016bb62e12da0479e6cc4b744b75679fe82258a0992ddf9a96cf0cd97a7adf2101df12", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588097, "uuid": "6c5307e6-e53f-477d-85ad-ee7e5afc009f", "value": "T1B38413504DE380E9C7562CB4F39B327BB3CA9C132A071A2477F5965FD6448A3E72532A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588097, "uuid": "2df60969-931f-4977-b873-cc94e95ca5a5", "value": "6144:mrz1gFIJBAWuQw3HeHmC7jSHCcRxm/gc7V8hca/wQxqc+jcDsjbuf:WHBCX3HeHVhclRxAoYbuf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588097, "uuid": "a803c0be-adf6-42d7-b5f5-9a2a57421b00", "value": 372961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588097, "uuid": "e76247fb-7baa-4d05-a099-366002376157", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588097, "uuid": "fcbfdef3-e2f5-4f18-95a8-59fecb416ea0", "value": "PO PUR-2504003.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "549054ab-bca2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762606583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606583, "uuid": "8fa386ef-9ba1-4905-990f-da0c83b377a1", "comment": "Malware payload (Mirai)", "value": "5bdbd966b6ae709e1cdc2d677052635a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606583, "uuid": "1097a4c7-2ac1-49d1-a193-4c9c2fa041b7", "comment": "Malware payload (Mirai)", "value": "31041139829216579d3593135c0028723426783ff812f8043a501750c9cc1139", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606583, "uuid": "5230cc95-902c-4ffe-8f59-c8d914c32131", "comment": "Malware payload (Mirai)", "value": "6a34db3cd1862c52192719044be9633298c51ac1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606583, "uuid": "01563405-0587-45d7-8e9c-b11d84e1ccd5", "comment": "Malware payload (Mirai)", "value": "a7375957c9fa2982b3c902b439b2622d71e7a7455fe56ed38e9dadfc5b3b812e6587206f1f1aab7ec4396f552b9ab80a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606583, "uuid": "7fc012a8-a02c-4c17-80de-0207b58765a6", "value": "T1CFA33A86FCC29A12C5C1627FFA2E618D332663D4D2DA32039D675F2133875AA0F77685", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606583, "uuid": "59c4ac4d-d705-4773-88af-6f1f48b596e4", "value": "1536:pevtU6n7BOiFZkDwVRZHZQ7rcmjr9mgF1NsJ1HP+VtAvyzg:pevtUociDZWnfP9mgFEDRyzg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606583, "uuid": "55c16ec6-f3bf-4571-b5c2-6d992626bc63", "value": 104704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606583, "uuid": "acde8795-2195-4600-9e21-00a0eaa9a2f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606583, "uuid": "30c898d7-8eac-4501-85b4-bd47d4f6a320", "value": "executor.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed600492-bc83-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762593525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593525, "uuid": "504fa912-7d23-47c0-ab03-c3052596dad1", "comment": "Malware payload", "value": "619768cc90051b228aaebce530b57018", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593525, "uuid": "fb61ebae-d1ed-4675-9d53-b0a5dad7f66a", "comment": "Malware payload", "value": "3155a44b3fff616e6d94c50f106e93abf3ab0d680a7992f11f3a5f48f52328bb", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593525, "uuid": "e07a845a-52cf-41d0-80d4-e6aae3d9d241", "comment": "Malware payload", "value": "16e2231690524b04c91024ac4454313314e2dac8", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593525, "uuid": "c6320d5a-10ac-44d7-95ab-7acf5806e9ed", "comment": "Malware payload", "value": "f850ebbe0291772d5e7b3f2ca83d2edc5b919ed9a2a9f896a69be40d149377b0cbc97dbbf9bdb0abbba72b3d3bf5edd4", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593525, "uuid": "7155887e-a806-48ed-b2c1-2032d472c678", "value": "T1DAA602D6F7D8A92FC8375072C5BA52B6514B4D028A43DF836D18770C68BB9D81F4ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593525, "uuid": "28349f16-d168-4bca-98f8-1e3adb854c74", "value": "196608:xEv8sUOdtsSRfFcqVf/FvH+/Rhy3uIPjrDsn50l8zPYO:SfUy9cqt/FvR+2M0+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762593525, "uuid": "a0493cf8-7bd6-42c9-89f0-8acee6e845d0", "value": 9540601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762593525, "uuid": "cee3bd3d-655d-4e7b-8838-4df1b406f425", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593525, "uuid": "02e6f0e3-66e0-4fcc-809d-d05cb44bbf92", "value": "gorabet.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a664742-bc78-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588447, "uuid": "4d70d48e-e381-458c-9040-124547b32c93", "comment": "Malware payload", "value": "6243ce2f1ad96ae662f6c30fcf557ea5", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588447, "uuid": "9ce70e2a-ccce-4f5d-8274-80b3bf110ec7", "comment": "Malware payload", "value": "31abbbc210777b061c1dce736a369b1206e61627f570682a952a37b93a63e53c", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588447, "uuid": "de18fb71-7de5-4cea-84fc-7b4b76edfc9a", "comment": "Malware payload", "value": "549914f408b0ceff66721f8d1c7e7cbebc506c6e", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588447, "uuid": "22d579f3-b8b4-460d-a0d1-ffd790cbfd85", "comment": "Malware payload", "value": "9e1239f5b4d1ffb2308f9abc5b80e72ab7d69dda664919daaee19eadd145c17a47b5f618cb26241caba91b07e111391e", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588447, "uuid": "c1c0ffd0-2249-421c-80b9-f485e22a5b39", "value": "T18B6523202CAE6E394528EA75E09F5DB9574009F0A08DE4C767D2B08366EF6D36B37C5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588447, "uuid": "e4564106-c9e1-45ad-b3e3-bd76b8ac6a92", "value": "24576:13YlkEpL3YxgPVCx+PTvudI2srat8kog6A3sH8fhihzfC0cM7HPGdgsXtc8+wN41:13WVTf9koYkhl7mpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588447, "uuid": "3cd47226-2ac6-4a55-919d-bd259ecf0243", "value": 1418161, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588447, "uuid": "3f5e8d72-914a-40eb-b576-58be860edf33", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588447, "uuid": "176efd9f-8c13-4cf1-9362-f3b04631dcb5", "value": "Invoke-4.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1990e554-bcc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621946, "uuid": "e2bd6273-d826-44d5-81d4-30c4cce493e0", "comment": "Malware payload (Mirai)", "value": "c9d21c6a492f71143cae224dda79de1d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621946, "uuid": "e783efbf-2bab-4d0c-9404-1c2772b4385b", "comment": "Malware payload (Mirai)", "value": "31e5e4cf51f64e8a496b434a6d8a669f9023bd5b0aea9ea6f0b8eb438e96e30f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621946, "uuid": "a0fbb925-23bc-4f5a-b122-023c468afe00", "comment": "Malware payload (Mirai)", "value": "105f806f8a62f1f1cb702b10c39ea904098cdab4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621946, "uuid": "e5480d0a-2dcb-43ab-8875-fb2811843beb", "comment": "Malware payload (Mirai)", "value": "270f88e3d9ffd53a5f1337c25236c1379154b0f385d607603eae74b59f5a76ada60761fbec04b141702666ba04110e1f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621946, "uuid": "915a7d3b-a6d7-4b04-be23-b0a5528364b2", "value": "T18773B309BFA50FB7EC9BCC374AA92712288D651A35A93F35BD34D418F25B21F15E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621946, "uuid": "5501d408-93eb-4b1c-b3d1-fa265352cb48", "value": "1536:aHJtIFGq1QuT+uDEQhKvt191Yi8ZNFDGj:aHJtIM0T+UEQPi8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621946, "uuid": "b90e6656-445d-4f6a-9391-51b074cefc01", "value": 76904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621946, "uuid": "cfe0f90f-a47d-479e-9d8b-4f840b003dcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621946, "uuid": "c191c890-ae3a-48a4-ba84-a77902d7f69f", "value": "jew.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "784962bf-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602348, "uuid": "1883d5d1-fa93-4534-a600-cea735150831", "comment": "Malware payload (Mirai)", "value": "4f497662167b20b9076fee73d9628c90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602348, "uuid": "a0fb68b6-74af-4982-b042-21104629a850", "comment": "Malware payload (Mirai)", "value": "32b8774b10325de830757d63704f64d9bdda8a941df6ebda3f73fdd5048e1f51", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602348, "uuid": "d1f1b302-c4e4-434b-abd1-d31b424ea2ba", "comment": "Malware payload (Mirai)", "value": "ac53f2806f79f5aa79d8757447a0f4599070d607", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602348, "uuid": "cb98f04e-9ca2-4808-b6f6-70ebdda52141", "comment": "Malware payload (Mirai)", "value": "035deb7b6a4ed8728a9a43d6794463eea7a9ed684d65ff818681e0c111cc3e5c483d9482bd6af2ff9534d0b54152c73a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602348, "uuid": "887aaf68-3cc9-4cd9-85b0-a5fac0edb6a6", "value": "T1AC831A52F8818E15C5D512BAFA2E018E331267E8E3DFB2139E205F2477CA92B0E77D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602348, "uuid": "8d2cdc80-ab11-4bbc-a3e0-ebf42d21fd18", "value": "1536:eNn/nK2YU/IjIgoLui60DbA4GIyoD5xv+SnhKik5Ncp2PSd5hsabb1AeB19UcPIP:K4jIZuqb3DHhhKikny2a3sUbWn9+7GSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602348, "uuid": "10c884a3-2134-436f-868b-18e5c89c1fde", "value": 83248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602348, "uuid": "be640b76-91dd-43d8-a621-b82bb249e3c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602348, "uuid": "3db49a79-a15b-486b-828b-75e6efc57b42", "value": "kowai.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afdba626-bca4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762607595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607595, "uuid": "3dc92e3b-6c04-4844-97f6-bdc8f8347f11", "comment": "Malware payload (Rhadamanthys)", "value": "c387662e8f68fde6b0aebc2e291a60f1", "object_relation": "md5", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607595, "uuid": "e1684892-5753-4a46-a9c8-93f3d93e47dc", "comment": "Malware payload (Rhadamanthys)", "value": "33236ddd041327ada61802f22a6f1f3b13dfa89bd8606cc94f92cc086c5ba1f1", "object_relation": "sha256", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607595, "uuid": "1328234c-14e8-49bc-bdc6-5d7fd53fbee1", "comment": "Malware payload (Rhadamanthys)", "value": "b70f1373b0f1801e270dd358393837731f3afa1e", "object_relation": "sha1", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607595, "uuid": "9631852a-2e8d-4f92-8060-d2b8edbc177b", "comment": "Malware payload (Rhadamanthys)", "value": "27d33a592fd385fea64ebcdb778b1a41ea9d78cc6c9ef1affeaff9d053adf884495270c39402d09b0828d4bce61a28aa", "object_relation": "sha3-384", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607595, "uuid": "8c1b1a0b-130a-47d0-aec3-bed626a68dad", "value": "T1985733AD47859A91CABDC532B953592FEAD04303CE04EDD211FE92DC2CBBB674E07A14", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607595, "uuid": "0d0fb5a5-c2a8-46f3-a668-7e505dad598c", "value": "786432:O9JBUuqSQd59HuzGo6KrtMQmzBtt7pYpUHHUHpGPF4rk:O9JWSQMzG3KrtMQstt9wyAlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762607595, "uuid": "faf9e0bd-3cf1-4a04-bc26-c93095598872", "value": 27871828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762607595, "uuid": "758f2187-8ef9-4795-ac9f-67282b18b496", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607595, "uuid": "91755e27-d869-4ce0-934e-f331121eaae5", "value": "setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4245e19-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602476, "uuid": "a3f81ad4-fbdf-4915-b256-0bab9f50e14a", "comment": "Malware payload (Mirai)", "value": "aeae56e975ede538055cd29ad11d48c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602476, "uuid": "719458cc-eeb8-4583-920c-39a099aa436f", "comment": "Malware payload (Mirai)", "value": "332e481ef63875447f1472018745cf473ec15628fcf3e5ff5e00a1d90884a17e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602476, "uuid": "b5e80b4a-f98b-4721-ae8f-c028af221bad", "comment": "Malware payload (Mirai)", "value": "9f611a4c96d21fb782d1054017a063f8b931d18d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602476, "uuid": "fad98ff1-93b1-4d35-b0b3-5254197aa25d", "comment": "Malware payload (Mirai)", "value": "4c7926ffd370883ae29aeb0adddf1d219c5b830afdbb1f2ab0aea1aa9b5119b34e129156d1aa25e0bdc780f4e018aa4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602476, "uuid": "748cc464-0893-4864-8cdb-84c0be03acd9", "value": "T1EB53AF7DF01E6E90C0464238602A9F742F63A5C462736EB79BD189B54047DECF91CBEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602476, "uuid": "49fcd3cd-63ca-45c0-9259-dfe45b99b3d3", "value": "1536:8adDrCJsFFqwt70XmIowVZEdFn7dC+trd:8kOJsjqEINQFn7d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602476, "uuid": "709a893d-8f3b-4ff0-a9b9-79baf33d981c", "value": 66552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602476, "uuid": "3d27cedd-8365-4bf5-95dc-088f9e8c52f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602476, "uuid": "1fcab3af-3d21-4b9c-af21-f4f787a83147", "value": "kowai.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27da6217-bc65-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762580309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580309, "uuid": "a3694fcf-74cd-42dc-8c00-8156ed1797a1", "comment": "Malware payload (Mirai)", "value": "4e75b0866bed7f23f80e56f6bea128ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580309, "uuid": "ebdcad96-5333-450f-bcd1-5daf0a7be282", "comment": "Malware payload (Mirai)", "value": "334ae7c47706b986434c98018561c428ea89f209fd1b4fb3324c2f542e225a6f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580309, "uuid": "24c3c1f6-1a88-4d04-b158-af33976d9f1a", "comment": "Malware payload (Mirai)", "value": "85b53ca20f5d4fafe7f5edbb88a4623007e0b86f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580309, "uuid": "90960e3a-89c8-4977-862e-1b9b606e9dcc", "comment": "Malware payload (Mirai)", "value": "0a2742d3f77c7a28480c485ad50b73979fae7f27fb25ece6a59f136ab3ed6e19179e5a40fe410e4c73ed53b6d29c4f59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580309, "uuid": "8ce6a6c2-bba4-4d5d-8a2f-2c63ce8c1d0c", "value": "T1991301858712C5DDC387A67409482BE93E6B0B265622FD72909AB7C4EF8D0713DB20E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580309, "uuid": "e7125bbb-d26e-465b-baed-de7859d578a5", "value": "768:AzdKT9xPyJWUDV95xzQHsEV9hJk7wPea6q98kfO+Vz5emFbjHYoBYgSZZ4LZ9JgT:y7JWUD1xzmb2ERUkW+zemFHHhy1gZXVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762580309, "uuid": "065ef922-07b4-4879-acd6-0f2018138315", "value": 43064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762580309, "uuid": "6687cb19-4454-4c5e-84f0-2e7b91420bd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580309, "uuid": "0f2970e1-76fa-424c-a50c-213cf83ed420", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a42d4155-bca0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762605858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605858, "uuid": "1514b2ed-6344-4132-94f3-4615b58f14c9", "comment": "Malware payload (Mirai)", "value": "42b426757f3d84a427c52ab3ab758abf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605858, "uuid": "8b36e437-6966-430e-a743-63dac3331e7a", "comment": "Malware payload (Mirai)", "value": "3351fdc4bd185a46d4c456bac08821f4ea1e0095edff7cda511f2ce28d5d7ae9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605858, "uuid": "e50dcd86-d834-4875-9de9-6fee1d4bf2d8", "comment": "Malware payload (Mirai)", "value": "b01371bc95651bf8429c0d2e36317223fc40dd92", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605858, "uuid": "0a0a8cb1-6196-44c9-a3ab-ebaf0c07e24f", "comment": "Malware payload (Mirai)", "value": "5a1fda69e488e4c0a84683742dcf39b7c387b89a6d03befb678009992f4655ee660ff652371fe6272fb4064eab7e9ec6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605858, "uuid": "70a3d5af-97a5-46e9-af95-384b22158b65", "value": "T1D8B3D646BF612EFBDC5FCC374AE91706258C651A12B97F3A7534D928B60B20F0AD3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605858, "uuid": "b28fe4e7-a774-40f4-9cb5-469b292c3b53", "value": "1536:ZBxiywA6alZBX2sQKjLdfqO199wDo+bYthTO+iZjGAfGd:sulZBLBqO1w2fwjGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762605858, "uuid": "0eef4f35-a9f8-45c2-b7f4-78ec184a7e1f", "value": 109604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762605858, "uuid": "67302c29-1a2e-434d-958a-d287c958fa47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605858, "uuid": "0e05207c-0fbc-4a2c-95a8-774bc2cc9538", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd906c5-bc90-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762598734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598734, "uuid": "c74b6692-d4dc-4750-a17d-87f0997290c0", "comment": "Malware payload", "value": "f1570d9f5b696650bca30664d80fdc72", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598734, "uuid": "20509ea8-a39d-4ec5-bf1e-3aba86a4735a", "comment": "Malware payload", "value": "34e192b6f3382a52176583a12bd645b614957eee878b4925b99cbd948160624d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598734, "uuid": "1f949263-1af9-439f-9d5c-c88476f8af77", "comment": "Malware payload", "value": "a548ba27013e8d8a0667d499f9a21b668f1e536a", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598734, "uuid": "ac4bc5a1-f6b2-4518-a591-c2421d6d5a2f", "comment": "Malware payload", "value": "57cd84aea11cbf47621d5f6cec800fdd99fede06aba58b56de07334087ddde21cf29707e20177f9e67675935a5a1c8ea", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598734, "uuid": "be7ce70c-6161-472c-9fef-87d876a7a911", "value": "T17451F0012BF60719F3B74E7959B6A220AA37FD55FF51979D0080844C0CA5A14E839F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598734, "uuid": "c15de5ad-6219-43aa-b9a6-e02b68203d80", "value": "48:8bPLLGe6hfvQT2P3OdLXuHv3FHJIXj4L:87LTU932uvI0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762598734, "uuid": "2a7b3066-18ad-4ce1-ba60-7d0dadcea8fd", "value": 2612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762598734, "uuid": "fef84bac-27be-4b05-9b22-a71271e1c429", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598734, "uuid": "9495a978-dfa9-4b38-828b-50da60d27b19", "value": "my Keywords details.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03e123f1-bcca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623628, "uuid": "b18c7afc-1a2c-4311-bd5c-aadb4b7a8416", "comment": "Malware payload (Mirai)", "value": "bd93c03a658f490dccbc0c60d1d839db", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623628, "uuid": "d2f25087-6c25-49d8-a9a1-350cfea97935", "comment": "Malware payload (Mirai)", "value": "3505ed39f3b9d425317fba08dbfd5d8cf6df23704a50a74146efbbfe3c778390", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623628, "uuid": "3adf2df1-7579-445e-8d7f-5836b68544de", "comment": "Malware payload (Mirai)", "value": "0cb276c68deb38b6ce0ec098de186241bb2bc483", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623628, "uuid": "bf3ad559-a281-4f69-a793-80c7564857f7", "comment": "Malware payload (Mirai)", "value": "3c480f035deaae6cf019233a563ec99334d9cd1495b2a9ad0e6eae5827be5c8c3e1ecae3e114f549c983d15d885fec90", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623628, "uuid": "f70ef989-14ba-45c8-8a7e-2e93cb84fcf5", "value": "T185430264631501B2ED1909300F6B0B9C231F0FFE56937961A15AEBAA9D051FACD13EA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623628, "uuid": "2f428ebb-8583-4407-b4a3-df2f5624572c", "value": "1536:t4kKad2CGj1NUqIpaBotfHathOWSQEbLVJui:yyqxt5B77CLVQi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623628, "uuid": "4136e8ca-0076-4465-bd5e-1a5496f69785", "value": 58232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623628, "uuid": "986de26b-41bb-4e14-b7cc-181992c95b3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623628, "uuid": "73165a1d-294d-4270-a81f-87395ddfc36a", "value": "boatnet.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97d63280-bca5-11f0-91c6-42010a9c0006", "comment": "Malware payload (GhostSocks)", "timestamp": 1762607985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607985, "uuid": "c74de7f0-fb38-4a2b-ad79-a7a5c3410708", "comment": "Malware payload (GhostSocks)", "value": "0f511b8db2b53e7e9d9c86dddc92b9a6", "object_relation": "md5", "Tag": [ { "name": "agos-rappler-com", "colour": "#162559", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607985, "uuid": "232b4ac0-07f0-405c-9070-c3344f95dcab", "comment": "Malware payload (GhostSocks)", "value": "354a72b6274ad1d82ba534bd4a1d6e76cb1e09dd59b28ab22e2b6ec3461468fb", "object_relation": "sha256", "Tag": [ { "name": "agos-rappler-com", "colour": "#162559", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607985, "uuid": "dec62e05-b61d-480e-8e8f-e9d3d07e74d4", "comment": "Malware payload (GhostSocks)", "value": "5c886abe0af22a412f27c6b32cd0be68a949c62f", "object_relation": "sha1", "Tag": [ { "name": "agos-rappler-com", "colour": "#162559", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607985, "uuid": "484fa5cd-82b4-442b-8f79-64e275fcf19c", "comment": "Malware payload (GhostSocks)", "value": "01d6276dabffb8e8a1cf518ff732f1f1b33e8a4bf2ede61c203ee54ea09b40c45173702700f050d7051b1e3c10f3c5b7", "object_relation": "sha3-384", "Tag": [ { "name": "agos-rappler-com", "colour": "#162559", "exportable": true, "hide_tag": false }, { "name": "dropped-by-ACRStealer", "colour": "#C6926A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607985, "uuid": "e0b78447-b258-4d6a-af79-ae95a1ab2079", "value": "T1D5371203F288612ED05A2A37693F9694983F7A6039168C57DBEC3F4C8F791405E3A767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607985, "uuid": "bbcdcb8c-866b-43dd-ad9f-1d0ae40d2013", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607985, "uuid": "b4742a0e-0959-46e9-b4ca-63de75372df5", "value": "393216:nD0b5dcpdqoiPUtbKmREfAON2g6QGE8B3F7T5l23GM/G0mCevn:ecKRD6QTaxM/G5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762607985, "uuid": "1b764fc1-98f5-4690-a6c8-d85337dfbeea", "value": 22753179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762607985, "uuid": "8a3e928d-0369-41cc-a075-d0b9c9e092eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607985, "uuid": "15f55e71-8fa0-49e0-8a0b-f747bf55af92", "value": "hello541.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a2bc3d-bccd-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762625216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762625216, "uuid": "f0338e0d-1040-40b3-a5cf-1ee581e77223", "comment": "Malware payload (Mirai)", "value": "a6e3ad917710abccf261bd03f3219531", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762625216, "uuid": "2fe6eee0-67ad-437a-a14e-2ea696c7cb92", "comment": "Malware payload (Mirai)", "value": "354d614ab78f2fe29127a2aa7e555b782c39ab84e40ffa8dc332efdf32bc9c12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762625216, "uuid": "5a6a2b22-11d0-4f66-aed0-06e7d20e733b", "comment": "Malware payload (Mirai)", "value": "d0a19c754b9a4d8c55a4d9f77139b233a5adcefc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762625216, "uuid": "ffe94341-a990-4246-a2ba-b0e867c1a899", "comment": "Malware payload (Mirai)", "value": "40bf812b303a4cc1dc76d5a31ce7bf976c6b7ea3a2ee26d283857d54467ae3119fc1acccb40ee7699813062c3555c6d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762625216, "uuid": "0ec9cf88-1de0-4e90-9c74-54c068c43e89", "value": "T125A349D7F401CDBDF84AC77B4453091AB231E3A20A831F36626BB967ED351985927F82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762625216, "uuid": "eb83f497-4360-410c-b8ef-9fb611f57d54", "value": "1536:BLnEwq00lZ3JfqVHRYBIu4TLgkQ+b873eHK5KmJ3VUJK6KzL4t2ug18XIr+:sZ39qVHRqaLgkQ+V63V+KZag18X6+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762625216, "uuid": "e52994dc-069a-40ca-8eee-37ff74d869e5", "value": 99760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762625216, "uuid": "b3ff7bc8-3ef3-4a8a-9fb3-9bb1383b1666", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762625216, "uuid": "d9cd9d8b-9585-4d70-aee8-ec8155bf192e", "value": "titanjr.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3724ff8-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602474, "uuid": "1b979f32-6986-421b-bfc1-25a8a217e436", "comment": "Malware payload (Mirai)", "value": "ede679065bac6d1024ee99fbcf3221ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602474, "uuid": "5b02cd13-2fbc-459a-8b9c-1d4b787eba5f", "comment": "Malware payload (Mirai)", "value": "35e5596483e70643bb389c0da98ecb275ea85a64adf0353a87810fe666ac8294", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602474, "uuid": "aa154e9d-a60a-44a6-9aad-b501d75c255e", "comment": "Malware payload (Mirai)", "value": "080e638814f86876af1da4e63b744b8a7df2ac39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602474, "uuid": "71a01853-5d31-49d8-a1a0-a1ed65590cb4", "comment": "Malware payload (Mirai)", "value": "ba53588a808126918e64f7a2b5ea43f0f5e3ba5f120081c0f68752793e13b69872bb90b31b13390eb4f66228f2687faa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602474, "uuid": "cebb4a2f-5e8f-4133-aabb-754576481bb6", "value": "T141532AC0B643E9F5DC020678317BEF325F76F5F6221AE987E3A499326C43502A507A9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602474, "uuid": "15b6715d-b4b1-4e53-a48b-1fcc871e3c1e", "value": "1536:pzqjPVgOSDrmwdSUWVmQXGtre+MaUBLjCIgaDFix050nJjdi:B2PuOSDrmwdIVzXGheBa6e9aDY250", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602474, "uuid": "a7d201f4-07c5-47e6-af94-a21704f43a9b", "value": 63472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602474, "uuid": "4708ec19-9a1b-45b8-be60-7ee08b34c82b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602474, "uuid": "f2b49eb6-5431-48d5-80d6-b4d380386f63", "value": "kowai.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5ad09f-bc87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762595186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595186, "uuid": "c19d13c0-abb5-442b-a67a-9b20112057cf", "comment": "Malware payload (Mirai)", "value": "6dbdfdc39bcfa4bf2f9e8e2713d30807", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595186, "uuid": "c04b678b-a2ba-4ed9-83e6-323f71ec4f74", "comment": "Malware payload (Mirai)", "value": "365e459ac81a3984e79c178130594424fc372c293cac954d41f9a1f4137adfab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595186, "uuid": "c9c41e2e-9617-48df-b8d7-b88bd6ab10f3", "comment": "Malware payload (Mirai)", "value": "480fde95e46a07899f5f35b8a127d04beba06bd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595186, "uuid": "6e62194b-7f95-4c25-b19b-ea853af1f941", "comment": "Malware payload (Mirai)", "value": "d468f030c32a086d569fd6785085b71a704e28cd865784565b51604091263a3ea1336fd18ed0aecea67ef2989034bc8f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595186, "uuid": "23bdceca-bcfe-4583-91dc-b822609d9c4a", "value": "T197F2F1A6D5B0539A844B8038507BBF0D8405AB2DF4D107EA5AE47EB28FCEBB16F54353", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595186, "uuid": "9b71dd58-6f38-4d8d-a4cd-7e382748f590", "value": "768:N3uXQRHFhNk+RgsYQXhcyL1dGy6qqnrVaWX3VnbcuyD7UiyqN:NeXwvteq5fGRXrlnouy8ZqN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762595186, "uuid": "dba4fa39-ee9a-4b7d-aadc-64fc17baaea4", "value": 34516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762595186, "uuid": "cce80a51-bc72-4707-ae8b-60dc3229f7c0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595186, "uuid": "7340338c-8b59-45e5-9d60-1ee8b0df35b1", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fcebd89-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620400, "uuid": "55151ee8-5ef8-4ac1-8f3c-cc60839317bb", "comment": "Malware payload", "value": "68d2910aee3cdbbb19285f9f1cc0b53a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620400, "uuid": "4dbbc1b7-346b-451f-9d9c-966c4a059b80", "comment": "Malware payload", "value": "366dea3b56a7f7a3ec9480d6da777e2beda1f5244fb4c85170552b6a24519ffd", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620400, "uuid": "faa675f1-41da-441c-bb52-146eff379c72", "comment": "Malware payload", "value": "1a7f11412916b18c298447d5d022fa588327f2f3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620400, "uuid": "4caff70c-9ce9-494d-b238-aa1dcf9b756c", "comment": "Malware payload", "value": "7f577b9dfbb93e0c88053238f8c070299f72f1588dc08809dcda3a8dc756583ec5ccd1098d3d6f7009a457ad513c2df7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620400, "uuid": "6e092088-0a8d-49e4-9a72-1d3367182ef6", "value": "T18D15BE7538FC9894F7B531A2F3171CAB4367350AABE0F6765662C40F0DE53C882AD968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620400, "uuid": "5f6c3c26-0eaa-41bb-9cb5-e399797b64dd", "value": "12288:Tc5RI4Icwzvi7HETyTSY4YaCzbbZE4l/FvrNd9MKyEHA4E8OOxlMcyP2sJ5Q0Io/:/4IcJ7zTXRtvrNdWmxlMpDuwCzRz3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620400, "uuid": "6fcabff3-a83f-4ba3-801f-6d7d527a16d0", "value": 927904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620400, "uuid": "46ada921-fc2f-47c8-b25e-33ac3c5321a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620400, "uuid": "a747320f-f7ce-4252-bd55-3e964d9fed01", "value": "Quotation.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3cf5e9-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623506, "uuid": "6e1d7d8f-662f-41fe-b39d-24a996a3098b", "comment": "Malware payload (Mirai)", "value": "cb69e40b3f35e47527e4c19cf29bd4cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623506, "uuid": "72362edc-b057-4d3c-a251-27019e48c1fb", "comment": "Malware payload (Mirai)", "value": "379a9f01fecd2e930a66907b501f28ef582e977a554a3aecdfc706db2508f5b1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623506, "uuid": "ffdf8619-3442-4925-b3e8-4d95b2a7e721", "comment": "Malware payload (Mirai)", "value": "2295b137d80c8d21655a226a15912cb783691f7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623506, "uuid": "f2e25cf7-ffb9-420d-afc8-588a90339ce6", "comment": "Malware payload (Mirai)", "value": "4cd8bedc25f59c371f4754c980a5da5ef70935981ce58dce6a9442e9ffd75f9413a266ded5c1142d2f0f84aa45a3a9c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623506, "uuid": "d373baa1-569d-425a-b6b9-586e0874cc70", "value": "T1AB243A42EA408F13C0D717BAF6DF4245333397A593E7B306A924ABB43F8679E4E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623506, "uuid": "65891516-16bc-4ee4-9958-86d93e7e758b", "value": "6144:VvERpNp86wS0WI3NyaLTsOZWKva6Aqe7TrkQ9M/R5S/wmH2WBLB5n:aRpNp86K3NyaLTsOZW0QJMQG/K/wmH1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623506, "uuid": "767ecacc-28a7-4872-b5cb-d7705de5933c", "value": 225035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623506, "uuid": "68b90d1c-d211-4491-8519-b41da4fbdf98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623506, "uuid": "7e8ad941-36a3-4d7d-b626-06d090b01a8c", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20987c74-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762588887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588887, "uuid": "56886113-cc88-455b-85f4-71f68505ee81", "comment": "Malware payload (RemcosRAT)", "value": "b5d11e05afd3622b8409a8719ce6a120", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588887, "uuid": "597ae224-a497-4988-bae0-728acb980c10", "comment": "Malware payload (RemcosRAT)", "value": "37f29dc9c4be3882314edf6c663e77ef711a719ed7b5d4256ed2423cfbc0ca61", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588887, "uuid": "6131411a-8f1e-4e0f-b728-6888d62669e3", "comment": "Malware payload (RemcosRAT)", "value": "d095bde0fac14249ac0786abb3291eaa3ae588ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588887, "uuid": "ee89ce0e-e5e6-481a-aa2f-d2ad3ca5c509", "comment": "Malware payload (RemcosRAT)", "value": "8fd112264cf9087426f05a0ff372b3e6d68546cba10660f64cc4a8a1702f02b0fab68d0b62639094cc871d9163e24730", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588887, "uuid": "881fd2d0-d2c5-4338-ba73-f91662691bdf", "value": "T1BE35062E4119BD8F827B184C2087556638362AE4E0EF5BF4E3C39856BE1F87D356C8B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588887, "uuid": "86f88e4b-45ae-4f57-94cf-a89fee01057d", "value": "24576:NWlhPgLBotN8KvlN7fcsIjCmy5T9sZCXyItQ29JcEEeIU2kv:EsLB6NlNgxCJ5u0tQUEeINkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588887, "uuid": "6aae5e60-2d27-44e6-bdfc-2f513ac48f2c", "value": 1074133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588887, "uuid": "cf773c7a-f17f-49cc-bb54-893a7dfce52b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588887, "uuid": "bd365a0a-0661-4228-bdb1-d527a30e9959", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851a8a36-bcd5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762628569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762628569, "uuid": "f2db052c-da91-4bef-84ba-0502dfefaeb4", "comment": "Malware payload", "value": "4598d27e29eb1e0aa48584d8cc56d6df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LANDFALL", "colour": "#A421E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762628569, "uuid": "bd655b4c-c2ec-4479-a563-9e5a0d1c5d80", "comment": "Malware payload", "value": "384f073d3d51e0f2e1586b6050af62de886ff448735d963dfc026580096d81bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LANDFALL", "colour": "#A421E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762628569, "uuid": "d39c91f8-eee9-4ef5-bc25-e0f3c2d8eb0d", "comment": "Malware payload", "value": "f70dc3dfe1b442c63607d65afa5935d869fdcd67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LANDFALL", "colour": "#A421E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762628569, "uuid": "7c7ff3f6-f0df-4d0b-a832-bc3a5aad95f5", "comment": "Malware payload", "value": "06132e91cec1726e46438dc53586f45a12a5eb5a536d207fabd560a2eafb44089aee0bb763c36b643f2b7b17d1a93991", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LANDFALL", "colour": "#A421E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762628569, "uuid": "8f7882ee-6c88-44f2-b61f-db89a7370509", "value": "T112A31C08F10CDA1AE6CAE2FC4B494761F712755C939883E53032435DEE8ABEA9E1D761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762628569, "uuid": "6105d99d-254f-41f6-8fc5-ad2661d3d940", "value": "1536:kFnp/kE3+o4lrR67o5H1g13Avmd7yhE3jzN+4v82URU8yKlxTUrCpthnpwFjYN27:kFdMsQsc4nUyoz36uNCsRA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762628569, "uuid": "35f0e663-6413-4ea8-af11-4ae928a73782", "value": 105790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762628569, "uuid": "6be47ab2-3e1d-4a69-b4dd-f1af0f762c0b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762628569, "uuid": "4d3e7e1e-c58a-411c-96a0-9bc478271ba8", "value": "b.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3263d80f-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588917, "uuid": "048208c6-126e-4a95-9baf-067075bec2ae", "comment": "Malware payload", "value": "234e87653eb4e39511206b0ab9bf14d8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588917, "uuid": "acb46f91-e04f-43b7-ba54-ecb101b061e8", "comment": "Malware payload", "value": "392313045c543971db6230d43b3e1bfe202d1aa76c24e22d4e0099ae1189d62e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588917, "uuid": "ca3664e7-90e0-46e0-8779-f2e8adb82787", "comment": "Malware payload", "value": "6d0efaad1d82a83b3d7e07e4968aa7e377b88076", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588917, "uuid": "1f55c07d-f918-4d00-ab98-10961068eab1", "comment": "Malware payload", "value": "8f5af91a1138489a71b258bb820486be743a8a8d3fb390727357195fb032db468c0080bb73f8c12b2d69c085f9c391f5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588917, "uuid": "dcfb8a0e-8cf2-454a-8118-11accf745cbd", "value": "T13A31B5E41E84901CB7FFA23C8E01A81ADD15DC1A91A2A72CBC5ED1CD7FB8224D560DF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588917, "uuid": "77db00a9-10b6-438d-a9fb-25c214a623a0", "value": "48:ksB2ckTOpk78aIT3YGkH0kl2FoKN4fNd2Nm7W6:1B2ckTOpk78aq3YGkH0kQeKN4f/Wm7W6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588917, "uuid": "7c5ac4bc-bb29-4ebe-99c1-5a93377491e1", "value": 1663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588917, "uuid": "317f8223-002c-4ea7-94eb-5264a548821f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588917, "uuid": "fd7d2094-b8ae-4725-be57-172ed1c50a3d", "value": "PO_E002594522.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d40a996-bca5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762607886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607886, "uuid": "af8f040e-df53-4765-90ff-680bf04da180", "comment": "Malware payload (Rhadamanthys)", "value": "e2e2749caac4eabfd797d1dfdcb32682", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-202", "colour": "#7C7E77", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3170", "colour": "#7C7597", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607886, "uuid": "26bd05d2-668c-4415-bf2d-fd01de1ca0e6", "comment": "Malware payload (Rhadamanthys)", "value": "3978c2527343f4f32592a2c1d7d15c2119c517156061cbc5983496fe196c1f99", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-202", "colour": "#7C7E77", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3170", "colour": "#7C7597", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607886, "uuid": "11c5ff17-39a3-4156-b12b-8495ea552ef5", "comment": "Malware payload (Rhadamanthys)", "value": "ac880a887aee5efe2ec95a07b1ce41c1d0dac05b", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-202", "colour": "#7C7E77", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3170", "colour": "#7C7597", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607886, "uuid": "996594b2-354c-4b3c-94d5-3c1df0d01994", "comment": "Malware payload (Rhadamanthys)", "value": "cc874acd5f5af8448042fba68043eeb3caec0c665a8804a028d798a06afab69aabf2d8b804211401bc344c4f320e6305", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-202", "colour": "#7C7E77", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-3170", "colour": "#7C7597", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607886, "uuid": "0fd192de-5ae3-4faf-ab48-9a594a31e60c", "value": "T1B8F533AB0B226D2DBCF175829EF074495C513196577B27C282B68BEF25ECC34522EC1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607886, "uuid": "c6a05b86-4461-446a-9072-5f861548e68b", "value": "98304:OoQJFfYc1gWDsb40Z+MwXADLIjr44N+/b:nQJtYcqWDsb5jLovYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762607886, "uuid": "eaa448ce-7ffe-4647-9313-d995e21c052b", "value": 3578307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762607886, "uuid": "fbd919f8-89d3-43fa-b617-8290b01a8a04", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607886, "uuid": "e7afb945-e942-4e3b-9758-9046370f914e", "value": "file.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff93bcd-bc8f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762598657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598657, "uuid": "34242a84-fc4d-4a6d-ba95-14144d41ddcd", "comment": "Malware payload (Mirai)", "value": "7bd1e77e068bbbd8d30fb2e37b087ab2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598657, "uuid": "1733c809-ebb9-47b5-a4f1-5360dfe57c54", "comment": "Malware payload (Mirai)", "value": "3a4d1bcec7f41199ce1ce8fdf33edb968e1a8c560265632d339128cd89305ac0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598657, "uuid": "e45f3378-e035-46d5-ae8f-9bfe5b88e118", "comment": "Malware payload (Mirai)", "value": "5594ddb6bcb653a5d51e811bda4350e1cb5d2722", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598657, "uuid": "b5a6ee67-c910-41bd-a2f7-6dbfb046d7b7", "comment": "Malware payload (Mirai)", "value": "73b95599f01867a775d394f817b733175498355d871244c4c1c100279059611554eb7b5fbb636da826c97e59a2790cba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598657, "uuid": "8730238e-9c47-4cb8-aacd-177235e79f72", "value": "T196932956B8818B11C5C4237AFA2E128D3313277CD2DFB3169D209F2477C696B0EBB956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598657, "uuid": "4d1b9062-4427-477d-94d7-626f5492588c", "value": "1536:4ZnHb/4VRkvJzi8OYc1xzurUxfT57WZaIT8GWX7vbGiTWjKYRm/E7gsDYHjx:Hms6ohTBWZabbijLRm/EUsDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762598657, "uuid": "a895bfc2-60ff-4424-b936-31b8d6a5c915", "value": 95364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762598657, "uuid": "4c7ce67f-9964-4aa3-87f8-986a4bc2a689", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598657, "uuid": "398f14b2-9f67-42b8-8fbd-9e39315753e1", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d02a66eb-bc6f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762584886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584886, "uuid": "62d645c2-acb0-407e-9976-c190600f0945", "comment": "Malware payload (Mirai)", "value": "054471e9dda5b2cd748ef13e59bc162a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584886, "uuid": "602d795e-4333-473d-95d8-73b53e3d9949", "comment": "Malware payload (Mirai)", "value": "3b4e9af57cbeca26bb1ef915897f1f21a7488c8eb4e69a4313d527f878283de3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584886, "uuid": "8ddb886e-db36-4111-a693-b545b57cb380", "comment": "Malware payload (Mirai)", "value": "0ed47c82606d4bb5365402fc15a2cea68d48da17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584886, "uuid": "9dff9369-8218-448d-bb18-6bab7be8c073", "comment": "Malware payload (Mirai)", "value": "1ceb4adbbf7dfbeed5f0ade84906f63db5c3ec6b44a7e28338057d2d1855d31d3da6cae62914acbb6d6e36626bf25552", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584886, "uuid": "528e5b8f-0f09-4ecb-a729-30e0cf69e18b", "value": "T17D73AE63C4269E64C4455534B072CFB51793788882672EB68E6AC1FA908FDFCF2193F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584886, "uuid": "7c78c4d2-3b51-4f98-9467-2e5f40e490dc", "value": "1536:xlcEQX9mksoCmY3UlMYYp1o4NKt5gdp5ZCb309cUAYU:ncHtmRboLtQ5Zyuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762584886, "uuid": "9d96a7e8-0fba-45fa-87dd-4ab48e89c144", "value": 74944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762584886, "uuid": "5d54a4f9-1150-4038-93d4-6eb2bd7d91ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584886, "uuid": "c36d429a-350e-4a65-9893-86905c61b568", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa6ea4e-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762588877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588877, "uuid": "20734df0-bfe7-4de7-ae1c-814b5b032aa1", "comment": "Malware payload (XWorm)", "value": "db5d4bd17a910eba855994fb7ba37737", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588877, "uuid": "c2298e12-27ec-49ee-bfdd-0140ec0c6e46", "comment": "Malware payload (XWorm)", "value": "3b5662eca92d7837248d35902a9f2f3214f78c10fa3883f78c92a0ac875be452", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588877, "uuid": "70891fa7-f156-44f6-9d02-096e63074fed", "comment": "Malware payload (XWorm)", "value": "f8419f0f5eafd3ae3f3cf4c5b136e4f6d7172052", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588877, "uuid": "f472571d-5638-4873-b238-78192a41dac3", "comment": "Malware payload (XWorm)", "value": "347e508f5eda5401ea733d9b68ec7cf9dfdef0d3d242c496204c3c89242c80efe3849aa4301efe356ef56690dbc982ea", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588877, "uuid": "52ab15a1-80fb-4ebc-98e0-cf4a7fd501a9", "value": "T1833450EFF24404C32AF328766142A6CA20D9E53AFF1E1E3AF1B635A1DD547102759B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588877, "uuid": "fd83f574-54d3-4802-b414-64c5710e4655", "value": "1536:WEhpK47rs52VDunqjzaibs1fa9wUNlMgMITNOhpY6bTalR0VNjY96F1p6m:WEhZE5QDunCbf9pZMITNCY6belRaHqm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588877, "uuid": "b6ea9a75-67c2-4aa5-9146-f9149ae45e42", "value": 245916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588877, "uuid": "fdaaeeb2-a117-494a-90c8-5f3d235139e8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588877, "uuid": "b1b346ee-5678-4b97-ae35-80f671e25c26", "value": "Aviso de pago.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a7299cb-bcfe-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762645999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762645999, "uuid": "1e929592-0b7e-49f0-bc49-3a125724def9", "comment": "Malware payload (Mirai)", "value": "5293c0c3f20f7d3e06cb95525bdce0fa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762645999, "uuid": "b349e59c-bf32-4b84-b0a7-fd41ac9b5ad9", "comment": "Malware payload (Mirai)", "value": "3d0c83e0795c934d581fe460df746898387d264a2996bb079e30847e98935383", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762645999, "uuid": "01c55cb2-bad9-49f2-9582-34ee06f3677e", "comment": "Malware payload (Mirai)", "value": "959fe5a34ed0887bc1bb77c07f149b33dfc99df1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762645999, "uuid": "bac47e89-6eae-43a2-befa-5822b143c004", "comment": "Malware payload (Mirai)", "value": "efd95a42e48df211818a4e671498f5a0341fa20651a9091e81d16a82f9da5755897fa9b3c708006e65b2c36b5f8d1918", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762645999, "uuid": "199e3cc0-5211-4bc8-9480-f33f50de91ef", "value": "T1B5C3D71D2E329F7DF678863447B38F21A799238226E0D6C5E2ACE5145F6038D241FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762645999, "uuid": "6943b0b0-3d4c-4f1a-9deb-f14cd56a528d", "value": "3072:quP/rdTMpqX9Wg3sOIJf36o63q4AlkY+HanhFpZ5iAh0+:t/rdY1g3sOIJf36o63q4AlkY+Hanfh0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762645999, "uuid": "3cdcf279-9791-42f5-b0d6-3371f7d2fca2", "value": 119688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762645999, "uuid": "e8675ed7-39dc-4ed4-aaa8-acffce8f0ddd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762645999, "uuid": "b6532adf-1e90-4f5d-a47a-0485e6878eb0", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84c3902-bc87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762595181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595181, "uuid": "cdde3c2a-6956-4105-863a-a2c9ef16356b", "comment": "Malware payload (Mirai)", "value": "842d14e824077d79c934e41e6a412a68", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595181, "uuid": "ab2cacf4-c75b-42fa-a737-45b03558f68f", "comment": "Malware payload (Mirai)", "value": "3d2701642592b96fd13734b23ddf0d75b6c4857262d91f904f3393cf7a3f52ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595181, "uuid": "8ef2b1db-681c-4c34-bfd4-6ef5bf56b713", "comment": "Malware payload (Mirai)", "value": "425d692d812327854e4831100b46990872e42ab6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595181, "uuid": "f85ee61b-0ed8-4692-8295-07197c2d600e", "comment": "Malware payload (Mirai)", "value": "399bcd15b8c20de782a49b20a6190af7b0c1d8e20b7e8e8f0c5c2d6a064f6e0c3387d0fea6b8fa0f99a6d32fd93972ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595181, "uuid": "62100209-bea5-400a-bfd1-d481b823b3eb", "value": "T149F2F02612680AE8C89D7C7D63E917A02D2F1A329143BC4BFAA2E151D783470F467DF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595181, "uuid": "763e4bff-507f-4ba7-8da7-50b3b42b8fb6", "value": "768:2ML0U51CY9H7ScaZPnW3TzkekWXulLMSPtYdqrClYr+bwHumaHCJgGlzDpUYsR:2iTLD9HYPnWDYek203idqrCOkYuJmVqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762595181, "uuid": "97e4caa5-0072-4882-af51-c8ac6a660c64", "value": 36392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762595181, "uuid": "0f91fa03-e8f1-42ff-821f-c75674367900", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595181, "uuid": "dc91d0fb-a31a-40fe-a9c7-37258bbea549", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c79e9e-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623502, "uuid": "8fe9c6b6-3be4-4790-a233-4622f6a5d1f2", "comment": "Malware payload (Mirai)", "value": "40f544b4560eb3d56ecb73597a189a70", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623502, "uuid": "2617d09a-8aef-4c0d-897f-73ef5b0e5394", "comment": "Malware payload (Mirai)", "value": "3f4dd56dc974ae2fa697ec59b1959726633ba00d06d337eb7ca1076b461e1e30", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623502, "uuid": "c112d255-7953-4180-8fd5-05b2e0d15fbc", "comment": "Malware payload (Mirai)", "value": "50122887e7d0b20f334f87972f3932b4ba4e3423", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623502, "uuid": "10e5ac0c-f736-48f4-9b9f-b0e72460c709", "comment": "Malware payload (Mirai)", "value": "57bc57bc6fc678675c0c76594932035e87f2163f9f206bc1c06bf332f101de242a89f5dd0ecc0a7afcd8459dc26dc671", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623502, "uuid": "af7f7072-da86-4af4-874d-2fb383229959", "value": "T14424E80A6F510EBBDCABCD3702EA1B0129CC541722A57B767274D518F54BA4F1AE3CB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623502, "uuid": "bdf70d82-ad20-4d52-8fad-01bb38641e1e", "value": "3072:B2JZLxaR4/EUIxmKxY8LNqDcdE2+J6hh1PR0s:B2JZLoR4/rIa8LYGE6R0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623502, "uuid": "68069ac8-aac1-4088-ac6a-b7c6baada961", "value": 211956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623502, "uuid": "f29bdeba-f1a0-4519-b9ff-2ec44b02c599", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623502, "uuid": "8b8611f4-b92f-4cfa-b832-d6e6639b2296", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e69a4da-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602359, "uuid": "657e9789-12a6-4fd7-a369-c5b51457c5e0", "comment": "Malware payload (Mirai)", "value": "500596fc33670c3328145683732a96bc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602359, "uuid": "28b8919d-9a58-46ca-b5d1-24d591c57e3b", "comment": "Malware payload (Mirai)", "value": "3ff1009d5cfb956be35ab98068accd65c60c9485d268a2718a52e0dbd6b1c2b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602359, "uuid": "46655c65-5910-4a36-8cc3-fd79da11727e", "comment": "Malware payload (Mirai)", "value": "b26a936b1f06bd409b41010e3ca7d5bac302e9a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602359, "uuid": "37170cda-851d-431a-bfd8-2fa39cff60a8", "comment": "Malware payload (Mirai)", "value": "32387c72f74eaf1e26f1be908c4837a0899b720d5509a88a708c3439402cdb6329c89f75fa697ad1bf66b5aa4956ccb0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602359, "uuid": "3992144f-2b34-4ba2-bc25-df590284def8", "value": "T1D6635C4271280A47D4A30AB4353F1BE197FFEED021E4B6843A5F9B5A4635E372086ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602359, "uuid": "8760a4ae-9652-4030-8ed7-4785458afa11", "value": "1536:TScr/o1TQDzh+sWLkP/IwaLb5gcUIlLrdZ:XDzhJXezUI9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602359, "uuid": "143334ff-b120-40c1-8239-72dd39bb4ea3", "value": 69296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602359, "uuid": "7cc82fb6-93b3-4826-a03a-a087b97631d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602359, "uuid": "9ccd60e9-8e3c-4fce-aabf-36631b228f49", "value": "kowai.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c51cda8-bc92-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762599751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762599751, "uuid": "24e977ae-5dfe-4232-963b-6089b0ae7346", "comment": "Malware payload (Mirai)", "value": "084107f609353b4682e1981f3ec6e450", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762599751, "uuid": "c3bc336a-6340-42f0-805d-07818f0d7785", "comment": "Malware payload (Mirai)", "value": "42919c7b2e3c6e69b5ded83c74759c352004330c95e9a17f0d7015fe715bcf0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762599751, "uuid": "75791bd4-367b-4a6d-9cb4-fc5ad60e0be3", "comment": "Malware payload (Mirai)", "value": "f2d5de114339abeb4df6d9b8d6b8900ac29871d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762599751, "uuid": "43e6014b-51f6-4ccd-aa05-a3092ccc8e52", "comment": "Malware payload (Mirai)", "value": "80f973df4e9313206f37fc813946172f94a94f64dea66f7dc06d0cc6c8a244ee9effa25768662962e6e02b604a1cf784", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762599751, "uuid": "0f59c65c-b1ef-42df-9e8a-1112eb4b44c1", "value": "T1A8F2E1D1C0826961A5B1D4BDF83A4506E6BE527062B33BD70304C256FB42DFEF97CA46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762599751, "uuid": "c3d97336-b12d-4bc8-9846-1f0911e85ee2", "value": "768:lgVPiO9uIb1nPfG0k2/k/2q1QRN9pSaSn57GPohZ5R3UW3:uV3blPfGb2/kdQRvQ5CynB3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762599751, "uuid": "213f3fe4-0df2-4ba2-b114-134ba8341dc3", "value": 37204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762599751, "uuid": "73ac94de-c6bb-41f3-9100-2697da9c6779", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762599751, "uuid": "a90c4b9b-2ac6-49ab-a0d1-b884c6079829", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ce8b9ce-bc77-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762587995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762587995, "uuid": "8ce4abf2-ad87-4ea4-a4ac-ba8d2202e91f", "comment": "Malware payload (RemcosRAT)", "value": "977b693ae0cb8cc4405595517eded793", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762587995, "uuid": "03191472-2174-4092-91d5-b1b10e1c4a74", "comment": "Malware payload (RemcosRAT)", "value": "42a95a895792daa5cadf26023d3413a7586b2bb064ef0ea82896d5e6e641e37d", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762587995, "uuid": "0cc7f391-bbe3-40ac-ad1b-2cc43767df7f", "comment": "Malware payload (RemcosRAT)", "value": "06e3a81bca24e1ffecc31dd1e2e131287c4c46ac", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762587995, "uuid": "009f6e3f-1412-45d4-ad6d-55d5e447ead7", "comment": "Malware payload (RemcosRAT)", "value": "f7e58450b596996255a3602b4cb954dcce57d2046a71130bb9ac83dbc04c54541ce544759a8e81d0e1d050c2816aad06", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762587995, "uuid": "bfaac263-30da-4636-9a8a-98507b99d363", "value": "T14B2503634924895CC39533E52CE6F89A0FEE3D5D913CE92D56E212097F353C8E2BD628", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762587995, "uuid": "d33ba219-91f2-44a5-a593-6823ecb1cf45", "value": "12288:BjfUdXeixhuKm+HvuTREag0e/vFfZF+DF1VpDZYJ0UWJB/+3itvvLBP8+GP5UU2A:IXemuK7WTREaJGUj84/fcMFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762587995, "uuid": "253750d6-3291-446c-b70f-d32a7260f447", "value": 1056618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762587995, "uuid": "fb7f1762-56d4-4829-9d37-ba8754c9205d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762587995, "uuid": "d023c3cd-3588-42a5-914e-65c56f0ec5c0", "value": "Estado de cuenta.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1273b2-bc83-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762593552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593552, "uuid": "234f1ef7-9cf4-43f9-8122-3fe2c24bc8ab", "comment": "Malware payload", "value": "fe2811796470d9a085b172602fed9793", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593552, "uuid": "76328275-c7f6-4a21-bb45-0b7d585f4f39", "comment": "Malware payload", "value": "42daa3cb520f43efac1f9724956ae793ce81c322d5935f6a5a1ba8dbf88b13bc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593552, "uuid": "77a73c48-4acc-4b81-8948-c7a13b6f83e7", "comment": "Malware payload", "value": "f5bf974b5d2b7a0804f4dd1d778aefb39ad20bf1", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593552, "uuid": "a8879c0c-8da8-4cba-9f34-17c50dcbb380", "comment": "Malware payload", "value": "b7bbbbf06e256dafd22b04a3dafa9a4c6dfd8673ebd135a041f43446b33d9d2524b9046767c80a4c23191e6bb1017df9", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593552, "uuid": "c9fc9ffe-112c-4642-ad8a-8cc2a4427892", "value": "T18646F1C6F7D8A92FC8775072C9BE52B141874C028A839F836D18760C69BB5D46F5AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593552, "uuid": "e483edff-6d7f-4a5b-a30f-ec4e025de3f3", "value": "98304:cPToTwrYpKjofsros5OrsbxYfc0D1BWoz5qPvrEZC0vPqmYZnXrfLR/mpClt2:ccKMfyaIbaciAFvrEZpXqmY9XrF/mpCq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762593552, "uuid": "15ad86d0-0e94-4c0a-8d23-3b9ef756dbbd", "value": 5881914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762593552, "uuid": "b42a9268-2bfe-4ef6-9132-2aa31ce7d277", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593552, "uuid": "a2692dad-28cd-45cd-979b-76dde21d3b8f", "value": "overplay138.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12176bb5-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762588862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588862, "uuid": "03b6c461-ea83-4c2b-be17-5172bfe121f4", "comment": "Malware payload (AgentTesla)", "value": "55929754107dfb1bd94d080a8fce5c6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588862, "uuid": "b06c017f-1f85-4d5a-9780-d4683f857701", "comment": "Malware payload (AgentTesla)", "value": "44ac81dca89c722e017d8b30bb278bce1734977a73eaa4ac1a7fee10dda81d80", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588862, "uuid": "850a110f-e1b2-4b9d-8e02-2a9903aa8c5f", "comment": "Malware payload (AgentTesla)", "value": "516e341ebf6ef135837df74aa10b10175639c181", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588862, "uuid": "acf8c8e2-3d21-45cb-a2c9-31c816bb5bd9", "comment": "Malware payload (AgentTesla)", "value": "7cbf551d521faa337ba24cbb4b9def31bcafa24c356beee0a81a0b7838472eb559053a432829e222ce78dcaeef495315", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588862, "uuid": "8efd8596-c9bf-44a0-8d2b-653c89eeaf3a", "value": "T1B933308523C0684643472B7B723FB0F5FE6E49D939888547C208BD90B5B670FEAE5A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588862, "uuid": "4b3705c8-e7ce-44b0-9e26-bb8f810cfd06", "value": "768:U8NMvEnXArDjpVFVetm2nr5U3yvJpi3EluPWFMRainxZlePfXS9clX4ntuyZYAMs:skh6kvGB6Dccb2LzBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588862, "uuid": "b0e902f9-e4fa-45c6-9577-2e0436346775", "value": 54529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588862, "uuid": "bce0992e-00d5-4699-b139-9895da5f2ce6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588862, "uuid": "55bfc1ae-9083-442f-a37e-847079d07293", "value": "RFQ-Compliance sheet.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103a9a00-bca6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608187, "uuid": "1106700b-ac4f-4b22-b6ca-a28e63554cbd", "comment": "Malware payload (Mirai)", "value": "6c4878eedc6ce50c9fa60acf02fbdbee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608187, "uuid": "f1f5d1cd-2a09-496b-8692-71ac8737df8a", "comment": "Malware payload (Mirai)", "value": "44e86db4db1d2108a7a6411f5f56a7bd400da3ab38c2c50070b169ce8608b2d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608187, "uuid": "9104df2e-5ed4-4c62-8bd8-fb225e8a23cf", "comment": "Malware payload (Mirai)", "value": "032946ef2fcb057a9078f780cd2e5fd8e4e16a10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608187, "uuid": "75a241e4-6be2-44d9-84fa-ae185d27e006", "comment": "Malware payload (Mirai)", "value": "64fccf6f82c41d62383cff03fa400c3214e48cdd6aeef45d4e9b8d2e3110fd5585b7bc7c543e915b8b8d171ba7546f54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608187, "uuid": "bc2ec2b4-e201-450e-9951-91918cbbc6f5", "value": "T127736AC5F743C4F8FC6606706137E7765632E53A1126EF4ACB29BA76AC22502BB1634C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608187, "uuid": "23e770b9-e128-4c7c-8a06-91b140c3fbc1", "value": "1536:ZNyB+aI+oNDi32JSf8gRYqwMKwuehj9wCLfgfHSy:Zs+DPSf8YYkXuiYay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608187, "uuid": "8146ab95-b5bb-4419-a12c-0f1f2cfc8030", "value": 79764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608187, "uuid": "8b3760a8-ab17-4c70-b580-75f10463e61a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608187, "uuid": "c34f8168-c240-43cc-bc1c-72401209fce6", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2cdf96-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620748, "uuid": "27d785b9-13a7-40d3-9b8b-7b629409871f", "comment": "Malware payload", "value": "f0a4dcc10fff9c3ddb3cedf3d9bdc319", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620748, "uuid": "78dd71c5-6161-4984-b445-9b65ad0bd178", "comment": "Malware payload", "value": "44f718048d73c82fd70803d73a08b345daca6a02e94c5f23a3cf350b0b750032", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620748, "uuid": "0eea208b-017d-4bbe-b2ef-aaab29bd0b94", "comment": "Malware payload", "value": "81270f47ac80ffc5c211a7419c635c06535ff301", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620748, "uuid": "3ff6e66e-0818-4d12-96b1-479eb21c35dc", "comment": "Malware payload", "value": "cf8f5d8a3407977406d5ac8622cb641d7ba8c80d1c425e68ee9d070ca978f14d79f8769920e0f65c298fdf819957323f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620748, "uuid": "bd596be4-0007-49dd-82a0-83841a6c831f", "value": "T15344A4B9380C98A6923B5C22B1FE5AB67733F95973E3323C814187157A3C2E5264FD85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620748, "uuid": "ec89f33b-f59b-4564-a1f4-6b5b9787e92c", "value": "3072:fA6pCA8XvjcTxZeqVAsAec9hzKsv+hy/bEQdMeluDS5:fCnDe4ghEKDS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620748, "uuid": "97b1fefd-ca14-4f63-821a-7c786e213d4f", "value": 271225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620748, "uuid": "218affc3-6408-4fff-8349-9954cee94afc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620748, "uuid": "d2e17432-aa2e-4e1b-921f-9b4b7a9ead9e", "value": "Invoice packing 20251028001 (Air).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd137204-bc37-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762560910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762560910, "uuid": "ead43c7e-3910-4aa5-871d-b2eebedb1908", "comment": "Malware payload (Mirai)", "value": "b55d294ea72addb9284ff4125844fe47", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762560910, "uuid": "6be18250-7140-484c-b091-b0398e4bf992", "comment": "Malware payload (Mirai)", "value": "45273f945f87bb88459860fe7f41fef8a3893c5f49c59ebe22bdee0d46e37659", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762560910, "uuid": "cd4d0c4b-9f79-444c-af7c-a230fd619510", "comment": "Malware payload (Mirai)", "value": "5b12d88b5941d6aa28f0aaaa92435522d25cec60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762560910, "uuid": "cbd2a6ca-cb64-489f-97f7-c4d7de45128a", "comment": "Malware payload (Mirai)", "value": "cf2796b33fe69c440f2fca4805be6c2b3dacf00b09fadfd03ca7ce312b6d520868e2a5b6cd9d3059187167bc207a65e5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762560910, "uuid": "a47ed346-5c94-4a90-89ba-fa124516859b", "value": "T1DB933C01B3080F43E1675EB12E3F23D6D7EAAED021F0F6492A1FA64591B6D325596ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762560910, "uuid": "acf28f13-b089-48df-9905-ca413a8dc0d9", "value": "1536:4crUBklD54WlfBOIXyOFvu00KF3PeE6N94E/qJkptpFem2rx:XrPvlfBOIfh3mE0Hot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762560910, "uuid": "c7cec89d-7ebc-47d9-9364-cb75a66cdc46", "value": 96304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762560910, "uuid": "83f6b75f-c273-4e28-8231-ee52938aa493", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762560910, "uuid": "f0ea3850-545c-49f5-912b-f1a53bb81425", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b9840f-bca4-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1762607689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607689, "uuid": "3a3f2796-d524-4aba-a2f8-23529e5da95c", "comment": "Malware payload (ACRStealer)", "value": "3216dd2ae90e47baab96a79d4c2b2bad", "object_relation": "md5", "Tag": [ { "name": "188-34-179-226", "colour": "#43EE90", "exportable": true, "hide_tag": false }, { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607689, "uuid": "f0a56ccd-3839-45f3-9832-404179d877e4", "comment": "Malware payload (ACRStealer)", "value": "452fe491f3c82e6bde8cadde7fd4e6081a8d1e0234ec649bbb0c9d7cf6563526", "object_relation": "sha256", "Tag": [ { "name": "188-34-179-226", "colour": "#43EE90", "exportable": true, "hide_tag": false }, { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607689, "uuid": "d55d0d6e-36ed-46fe-8ddd-dba519cb6003", "comment": "Malware payload (ACRStealer)", "value": "c846ad53a59bea9339665dc921c704dcf9b4b2ee", "object_relation": "sha1", "Tag": [ { "name": "188-34-179-226", "colour": "#43EE90", "exportable": true, "hide_tag": false }, { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607689, "uuid": "bf701ca5-fcd9-4d8e-8641-2ba9357697d4", "comment": "Malware payload (ACRStealer)", "value": "8a0ca85cf537997c6d6572b5aced7e090f2a964620004610a27177b75b5584bc3e1c8631492cf10d381f3deb4f7132a2", "object_relation": "sha3-384", "Tag": [ { "name": "188-34-179-226", "colour": "#43EE90", "exportable": true, "hide_tag": false }, { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607689, "uuid": "ecaeecc4-83bf-4d04-9930-4662194e1cab", "value": "T1604733E485EC2E6ACAE272752DF180E4C667D021D8D0B50BA0B076371DE7FE6455FAC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607689, "uuid": "c784a31f-6fa9-4512-a878-a2b29a2bd2ca", "value": "786432:3xA7DHhvXR7qzXjqLjR4VDZL3T1XFxVG50cyoo:3xA7zdZqwjKL3TS0rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762607689, "uuid": "9a0756e2-48f4-4e81-9424-e3101c3e42a2", "value": 26139070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762607689, "uuid": "f0d60bcd-b83a-4747-bd37-56635e78ccda", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607689, "uuid": "134e8045-053e-411a-bf5c-cd1571f6786d", "value": "Full_Version_Pack.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33b99752-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602233, "uuid": "98e4987a-3197-4b07-aeab-b1ef8737e2ee", "comment": "Malware payload (Mirai)", "value": "1e9188701c6b5b2bd8425fb7c29b875e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602233, "uuid": "6c1ecf02-7e0f-4e1f-8d2f-11cab91e0399", "comment": "Malware payload (Mirai)", "value": "45d8b5391353fbc0cf66db67d767da32cb15a2eac79e46b37c4d45b0955ce6ab", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602233, "uuid": "126ee4c7-b3a3-49da-832f-704b28c07e6a", "comment": "Malware payload (Mirai)", "value": "f3f2a4846c8e1bc12def31caa4d7676f15623738", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602233, "uuid": "738ce921-b4e3-4ea4-a6a9-26d36cb83541", "comment": "Malware payload (Mirai)", "value": "ffa2b6ded57e4564e9f2117101aad64a9ef820b49494c72a37d53d58c3954dcf2d78de2a2e37887c952e316c33cb99f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602233, "uuid": "ed09c905-54cf-4adc-b20f-2f0129803a6c", "value": "T138537DF4261E3D81E2C7D37DCF558E72711FB571C66582E47E21022DC1EA8AE9AE0911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602233, "uuid": "bed75378-8cf1-4cef-8d26-a11fb2d13a24", "value": "768:9CvtNbKSpS8TgAoAc/KwMwhdGNohy4KRYQT7xTi4ouY8eBp:9CVUyV/oj/NNytSQP9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602233, "uuid": "e8b4e952-85d5-4f38-8425-d935c72402c2", "value": 63376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602233, "uuid": "6b022175-1e91-40e0-9eb0-48ae4c79cafc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602233, "uuid": "6a0d80b7-566e-4fdc-9e3d-4caab69fb4a5", "value": "aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "819f2f72-bca7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608806, "uuid": "99ed4ec4-39e8-4ecf-9164-a276150e30e1", "comment": "Malware payload (Mirai)", "value": "d2f91a7be8acf3cb7d83cbacd8eed4f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608806, "uuid": "52d98afc-cc7f-430f-9158-7e253ce6b135", "comment": "Malware payload (Mirai)", "value": "46e6066f23ac5c40ba2c4e106e9e34f65729b21e266e2a88c396310030928691", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608806, "uuid": "e23dea55-5d1d-48a7-96b1-7333aadb5592", "comment": "Malware payload (Mirai)", "value": "c57b2f623abb83dc18cf02bc1bace4a4d0f234cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608806, "uuid": "56937d48-2543-408f-bacb-ceacd78302d1", "comment": "Malware payload (Mirai)", "value": "8b155f5f568f754876f1d3aa00c399ab4b8cbf72466908ea8a5b697848c7183e5ba61915fa533f7b60e81e01c768068a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608806, "uuid": "d67b963d-6e6e-49ef-b3e7-eda5406c6e3a", "value": "T1F203F150C21669D4DCA7AEE10139FBD327314F92767BDF4B1048A73BB09753A1288EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608806, "uuid": "737fe68d-0d20-4ad2-8dd0-cd9510ac8793", "value": "768:qMUkUr3bac12aVUkhq5IiEIUXxaf8T+l9sfJQaxwEtK034uVcqgw095:AjF2aVhq5JEbAPlCfKbE8034u+qgw095", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608806, "uuid": "76a56897-855a-4fb2-a3a2-069f9808a362", "value": 38172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608806, "uuid": "f352b9d7-c215-4348-b568-fb4187627093", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608806, "uuid": "aad3d0a8-a6a7-4b0e-a878-0e562594d6b2", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11070ef7-bc3e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762563520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762563520, "uuid": "6a16e155-7f39-48bc-bac3-c517c47648bc", "comment": "Malware payload (Mirai)", "value": "d61bff828665eea2d888bc8920990790", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762563520, "uuid": "1c24ea45-2784-4616-bc58-1c57072c4d44", "comment": "Malware payload (Mirai)", "value": "47d61977f0cc76324bb56ead1e8fae0aeff44c738ef3e78736a667398244bfb3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762563520, "uuid": "f69cb701-4f8d-4b5a-9c60-95f9b8ca2513", "comment": "Malware payload (Mirai)", "value": "53ed7352ba1cac0b1640ede1aee9b07e30e26172", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762563520, "uuid": "1a1c9b94-1d60-4f7c-99af-2d5e4c3fd78f", "comment": "Malware payload (Mirai)", "value": "a8be25b9a61be8b51d28dc5e525eb604e709a3ae957ae6239e17656abdd4ed32a9170fb346db0b25277d08d920acbafd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762563520, "uuid": "b311f730-5229-4fc9-9e59-6359fb62afe9", "value": "T1B7C31956F9419B01E5D335FAFA9E414933536FB8D3FA71128D20AFA0138A9DB0F7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762563520, "uuid": "46e21556-e589-42ba-88cc-4b673488cd2c", "value": "3072:nqlAI9e/KmSaA2mLHnGdkCvgtY9+AzdIGuCb7:nqzo/rSaA2mLHnmkCvb9BzdRuCb7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762563520, "uuid": "f4af9968-5cc3-42ca-bf13-ebe86fa496f9", "value": 124168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762563520, "uuid": "31809d90-b668-4534-8cb2-a8509693290e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762563520, "uuid": "eca86030-1eec-45e1-9397-f8718645c992", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9b521de-bc87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762595183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595183, "uuid": "7ea237cb-3817-4fec-b2ff-8353f3c66cc5", "comment": "Malware payload (Mirai)", "value": "c797845a8f717b81512e023b94a1ea93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595183, "uuid": "74c490bc-ba2a-4de4-bb0a-e9c72011d9b1", "comment": "Malware payload (Mirai)", "value": "4839e008a86735ffa6213074e44db1f4361cf1ae00e3feb1933760710d2e40cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595183, "uuid": "a4cf5135-4dd0-4db9-9725-2d2a0daf5ea0", "comment": "Malware payload (Mirai)", "value": "bceb07e0a5ebd8b466bb7e87fd06a38ea4895d43", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595183, "uuid": "fc35230f-a288-4e98-bef1-bbd9764da95c", "comment": "Malware payload (Mirai)", "value": "434a8740a3eeb66907a2c79a2aa32b88c4b6b66483b335dac762499228baad61081ff47e58da84ff20fbd6fb3fb765b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595183, "uuid": "1f18d1cc-d06a-4d47-9487-56324995cab6", "value": "T16BF2E107D1999ED9512F403168AFB539FF3C613A0D888A53FFC9251785CAB442FE8681", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595183, "uuid": "d15e9ccd-7010-457d-b0f4-5f5e4461c927", "value": "768:GJ0zm3YYnAN+sZglsvcJ4+AjvvT2KgdTJNOry8pkTuQo7GursbnbcuyD7Ufyq8:Ga4956XjvaldzOrQCv/r0nouy8qq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762595183, "uuid": "84edb50f-21bf-4368-971e-02d53f342d2a", "value": 36468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762595183, "uuid": "c799c1f3-5fd6-47a7-8ffe-d189dab51bef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595183, "uuid": "319652ec-2299-4d41-8cf3-408a294ed8ff", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320383e4-bca8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762609102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609102, "uuid": "9637a4af-af14-4e05-b627-59983f842e94", "comment": "Malware payload (Mirai)", "value": "6c2ca75560904295a16d1d7d66650205", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609102, "uuid": "b891f632-f930-4509-9f2c-5bbe37832573", "comment": "Malware payload (Mirai)", "value": "48bd2827c54592ff6da9eeeda215975535f18c0257727ef3da2caf8617a83471", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609102, "uuid": "d82ac9b5-e768-4d49-b55f-eec5ce32c303", "comment": "Malware payload (Mirai)", "value": "612ec1ba1781accb67be1e4d7755768caa901438", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609102, "uuid": "99e40c03-bf66-4ef7-b3f7-a68a442d92cd", "comment": "Malware payload (Mirai)", "value": "a0b7c6edac615da92412c3e9620df57e219e42e2349b3f800911875be27075a973818044b4676858669fac3df44af125", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762609102, "uuid": "e75eb6fe-88ca-4f65-a88c-0cf69b8363ec", "value": "T1A26319C2B8C2891AC1D0637FA76F759D3361B3E1D2CA3517D8970B11338629A4F66B89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762609102, "uuid": "30131598-13fe-454c-94de-641f6d9486f6", "value": "768:KyvcXhrTXDFvnTNN7frEYkYSXINsRo5XzxFZIXqjAGJl5TSYzGtkA/PoBvRi3DMd:YZvTNVy7INsoXlFZkWJjzGtb/203Dd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762609102, "uuid": "73b90924-15ec-4ceb-9826-8ef3ff49869e", "value": 68476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762609102, "uuid": "9fda98bd-bfe6-4084-82fb-26ee5187fc4e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762609102, "uuid": "a103a348-6c70-4a0a-93ed-21577eeda146", "value": "executor.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96a7fc72-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762620438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620438, "uuid": "ba702304-9858-446e-bbaf-7d4f1c656fb9", "comment": "Malware payload (AgentTesla)", "value": "38807bf12f870800f95203210b54ec0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620438, "uuid": "efda884d-e7f1-4b51-a56c-93d0eaaa99f1", "comment": "Malware payload (AgentTesla)", "value": "48efe9fdd2abc194fee45224c3952d935ca06d91e2b8b06c7493ff6269cf599b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620438, "uuid": "77822d88-b8da-4919-8ddc-e6cc7d9e2baa", "comment": "Malware payload (AgentTesla)", "value": "90ae7c33f1b48dd269fe84470e5ab6f65ca316f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620438, "uuid": "54cb7e1d-1d81-4d7a-a11e-c65d9cd706d2", "comment": "Malware payload (AgentTesla)", "value": "1897471c90e1908381d6a6b0b3437e566e40a4fb0405685f57255017e4f179d296ffe05a733444be3c8aa5fe4c0decc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620438, "uuid": "b8429d1e-9c46-4462-adf2-3b9d7517874e", "value": "T1F772027A955CEFF00F3E21F0118B7D0560619326B93A8C6CE8DA8054BF2A7514FA78EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620438, "uuid": "7a84be46-7212-4eee-996c-2a625435c9ef", "value": "384:XXeXJFstghrcr6J3DET0eDn3uMeB0Pe0bEr0Rv99C+wPtpNrq0:Wf++o+ELW+mCEYRnO1jrq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620438, "uuid": "2154ce89-9a60-4564-813c-eebd5c183b81", "value": 16142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620438, "uuid": "4920c531-41e4-423f-8775-978fbd41c37a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620438, "uuid": "3b194815-16d9-4ace-becf-4812ed919a76", "value": "Reservations.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b6b756-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623477, "uuid": "6791cb6b-8ee1-48eb-bee9-1d4b572d4aaf", "comment": "Malware payload (Mirai)", "value": "4db60f269d1ef77f1daa9c7989a3d377", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623477, "uuid": "e4da119e-80e0-4131-91e2-dbbff61efaad", "comment": "Malware payload (Mirai)", "value": "498757216f31c94cdc98705973f1eec68072b3fb1b5c2a7c42b74cd5dbea5e56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623477, "uuid": "8178a195-405d-4cb0-bae4-197a17906c89", "comment": "Malware payload (Mirai)", "value": "d8bbbe24982e2e2fee1f63b5fafa2d5fae9f2667", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623477, "uuid": "c3c94b25-f2cc-4840-9a64-da43bc5656f3", "comment": "Malware payload (Mirai)", "value": "d695bcfd97e73bd2a560b84c3f38cc1a927748ec772a020403693e7a2b1e9364537d36cbf9ed6a8115643cd8c8e2ac1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623477, "uuid": "6c920619-d143-4766-ad58-84b5becda82e", "value": "T1324302E05DB33467EFB5C93672B080C93B1505F6FAE6A4775DA4047809A38AB3FA5842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623477, "uuid": "ed3b0b89-3f08-4427-8a8b-5e8570053851", "value": "1536:1TR9Bs/K6BXx/E/kP4Dtn1WcVlXViWHDiLr:UCWxE/okjPk2iLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623477, "uuid": "4224979f-94f7-4155-8f43-a8a5cecda367", "value": 58996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623477, "uuid": "4e6127c5-20e9-4be3-bbc0-682afa793915", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623477, "uuid": "ecd3ca5f-63ca-421f-a00f-31517384e4c6", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b66036-bc5d-11f0-91c6-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1762576807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762576807, "uuid": "0ecfad6a-8057-4000-93b1-0fd5a2afe2a0", "comment": "Malware payload (DCRat)", "value": "eb5ffc0353dd604ff75fea8fa96dfb19", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762576807, "uuid": "cd377b68-e258-4baa-a530-878721b0ecd5", "comment": "Malware payload (DCRat)", "value": "49f4ceb17f9e44be27e065513a036f22da0bd0688a9a5d9c479b8aa70b7f3110", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762576807, "uuid": "a174910a-4863-4d54-b4dc-bfe161e7bf02", "comment": "Malware payload (DCRat)", "value": "d68457b6dcf917bc151fbf8d7ed7eaa68399f9dc", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762576807, "uuid": "5f000430-b004-43f1-a7b9-0038cd996913", "comment": "Malware payload (DCRat)", "value": "a9cf81022b36f742032e0f01ead8634cc3dbbb4b6bae3117aa567c52171e8465b1ec25a09a39bfe93c9d2124239aa178", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762576807, "uuid": "ab8fc701-19be-4f2d-9d5b-d140cafd60a1", "value": "T114C5DF1965924E33C2641731C663023D8395E72A7662EF1B3A1F20D3AD1B7F1AB721B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762576807, "uuid": "87dea520-b1d7-48f0-88f0-5bb411487c9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762576807, "uuid": "ce81eb05-346d-4b52-aaf3-4ee563314e5c", "value": "49152:u2Fthjj8Nm/UKZ47LA/nO9ZqnVPwimNhKKs+yWx:u2FthhUEiLirFIRx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762576807, "uuid": "bd47884f-d7e4-4f92-b010-5d2d9577ae2c", "value": 2537984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762576807, "uuid": "aac76719-aca4-4f90-b5eb-b36935066f47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762576807, "uuid": "9f0204cc-bdf5-4959-a071-82877099c869", "value": "EB5FFC0353DD604FF75FEA8FA96DFB19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1be007-bc6d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ngioweb)", "timestamp": 1762583969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762583969, "uuid": "4d9b2b57-6bdc-4d43-b630-d3dd61144555", "comment": "Malware payload (Ngioweb)", "value": "08f6ef6eca372c7a95dcb3e52896bd6f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762583969, "uuid": "fbb34524-c36b-430e-bdc8-7269cc78523e", "comment": "Malware payload (Ngioweb)", "value": "4a96f132025ca1ec8c7efa747c130bffb7e39fb1992e8d08db20926e9f494dbe", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762583969, "uuid": "c5e6f282-2bfd-4255-a84c-12d046287595", "comment": "Malware payload (Ngioweb)", "value": "6dc94d7e6e722caeb477eeebd921d9ade9b72b85", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762583969, "uuid": "4194a65f-8c02-4710-918c-4ab4ffb5765c", "comment": "Malware payload (Ngioweb)", "value": "eb8651fca292388143755b08a52c62e77535eb3175c0e7b3cd2097ddfb505f50f985cb9d73438a2b4f5091879abf7826", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762583969, "uuid": "8f78228a-50c0-41b3-bce7-e0cc03662968", "value": "T1710165AE31018993870CC700BD6EF414F119825748C3BB6886AD0E39C6BA915BB51F75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762583969, "uuid": "f41d924f-5f86-499a-886e-7b85b4b0025a", "value": "12:78CN7cTCI7cTC37cTCB7cTCXq7cTCJ7cTC7bE7cTC7kE7Q:pNoWIoW3oWBoW6oWJoWvEoW4E0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762583969, "uuid": "f47c1e34-ee8b-488b-b9b9-8df9fbd5eda3", "value": 832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762583969, "uuid": "06bd7086-69dc-42d4-9346-bc76982b4931", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762583969, "uuid": "6ed2056b-f1e0-465b-8e23-b8d2699f6671", "value": "router.lblink-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9955671-bca2-11f0-91c6-42010a9c0006", "comment": "Malware payload (ACRStealer)", "timestamp": 1762606753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606753, "uuid": "377b2a49-c101-4efa-9f60-dc5a749f5431", "comment": "Malware payload (ACRStealer)", "value": "62a4a7115995b52d9d2f04773676adc9", "object_relation": "md5", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-4405", "colour": "#2DD7A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606753, "uuid": "2efa0a99-5aec-4335-bfdf-237eb8e51ab7", "comment": "Malware payload (ACRStealer)", "value": "4ae7549d216931a6414b8427bbd8ed2e2e79d3a61ba5cda8e2e0006e7cd6002c", "object_relation": "sha256", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-4405", "colour": "#2DD7A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606753, "uuid": "404c5ae4-b412-4887-b23d-20b92f2b7b78", "comment": "Malware payload (ACRStealer)", "value": "6488c8f4b40ff3567ddbc90a4d6e66e04e9d6f59", "object_relation": "sha1", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-4405", "colour": "#2DD7A0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606753, "uuid": "6d899193-d452-42eb-965f-ea70a78e98c5", "comment": "Malware payload (ACRStealer)", "value": "71f6a84431043894a9bdd4d1797e9167661607ea973eafbbcd921bd393d4797c39f9e99abb5146bf1ccde943f6fa7b19", "object_relation": "sha3-384", "Tag": [ { "name": "2265ca", "colour": "#F045B3", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-4405", "colour": "#2DD7A0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606753, "uuid": "968aa2b4-e6fa-405a-830a-36b9d04362f9", "value": "T1F0963393439C53AA5CCE26DB07A5013738BC1B9053A5078E04EFBDD435DFB6224ADBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606753, "uuid": "144ab8b6-b2ac-4f56-9710-01af0e619c8c", "value": "196608:QHUewirlVxtBD1N/nSFfoWyRgdAw6tBCEvYk7BIE4yIh0h:kwirlVPbU5ZdeXrwY/cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606753, "uuid": "7bc0d4f5-1255-45e0-8742-5a85433a5809", "value": 9101597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606753, "uuid": "38427a2b-42c2-4a8f-8242-4f2731fad15b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606753, "uuid": "854cf47e-3820-4c4d-a704-0494eef406bb", "value": "\u00ab\ud835\ude88\ud835\ude9e\ud835\ude9b\ud835\ude9c\ud835\ude75\ud835\ude92\ud835\ude95\ud835\ude8e\ud835\ude81\ud835\ude8e\ud835\ude8a\ud835\ude8d\ud835\udea2\ud835\ude730\ud835\ude86\ud835\ude7d\ud835\ude95\u00d6\ud835\ude8a\ud835\ude8d\u00ab\u00ab4405\u00bb\u00bb_\u00bb.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "528630df-bcb8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762616029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616029, "uuid": "7db36974-ecda-4805-8fba-d02de592da9f", "comment": "Malware payload (Rhadamanthys)", "value": "4492d4cdd43a2c95a1493e2f1281e5a8", "object_relation": "md5", "Tag": [ { "name": "176-46-141-40", "colour": "#92F19C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616029, "uuid": "94b0b29f-8e08-4757-aec3-97359128f524", "comment": "Malware payload (Rhadamanthys)", "value": "4b6744f74e10f017b8ae93237c233daa977c61ca5e2b54b3d71a008644a495bf", "object_relation": "sha256", "Tag": [ { "name": "176-46-141-40", "colour": "#92F19C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616029, "uuid": "abe9db71-9699-4afc-a56f-354f30747ab8", "comment": "Malware payload (Rhadamanthys)", "value": "60bd81a5e915fb864d872b0cad253863b8e2789d", "object_relation": "sha1", "Tag": [ { "name": "176-46-141-40", "colour": "#92F19C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616029, "uuid": "3d8e142f-0ba4-4b0a-8245-62ffff89c897", "comment": "Malware payload (Rhadamanthys)", "value": "5eacb58a29c1999ebbb27a842b2d355df2f5a5926e7f9e20a97164a4d21fdd7ec1afcb61f79774206d8f1c8a47aa87f9", "object_relation": "sha3-384", "Tag": [ { "name": "176-46-141-40", "colour": "#92F19C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616029, "uuid": "4668ebc4-36c4-4a1a-a15b-7fc6ab8bd7e1", "value": "T15EE59D0BFCA158FAC0A9A27189369196BB61BC452F3113D73E90B3782FB2BD05D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616029, "uuid": "a8e1c9d4-9aef-476a-bc6f-f67d2a71bcc4", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616029, "uuid": "e60151a5-ec09-4107-bfab-94a6581db63f", "value": "49152:pSX5+0Kx3UCLroB6sjBOVn+rIHTu0RvBgEEqkh1dUmd:pSJQEB6wBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616029, "uuid": "1b7e69ea-c78e-452e-bf2f-83bc96f1de42", "value": 3077632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616029, "uuid": "6b191f39-e655-440f-b775-f3de03f924fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616029, "uuid": "c095f6c1-4f84-4f5d-88ce-69d088b78968", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f15dd3-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762620628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620628, "uuid": "52d6c21f-6620-4545-bd9e-142bbf35e555", "comment": "Malware payload (RemcosRAT)", "value": "85b8e7d0581d0b9d185f496872f1a0f2", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620628, "uuid": "1d489157-e890-4a5e-819e-9a4d36690c6d", "comment": "Malware payload (RemcosRAT)", "value": "4c799d06e05ed575524fc6fc718bd8ff1814d66bdc96cddf93bd77a7d47131f6", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620628, "uuid": "1ac32fd3-ef4e-4816-9a84-4413a1cd4999", "comment": "Malware payload (RemcosRAT)", "value": "b69de6ac57d345b6edace6095190a5b3ae15b86a", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620628, "uuid": "2a968f7f-df0a-4c7e-8ab6-72156d5ee6cc", "comment": "Malware payload (RemcosRAT)", "value": "f296f1f371f1a117bcad8bc058dd60d8e67304555349e1abed4e2e66159e05ee380d987dd6861094913e322ae9bd0d47", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620628, "uuid": "7d7b487e-7e8a-4726-ae3e-f1ad899ffb59", "value": "T12A72333A965CDFF00A3E21E4158B3D052061A326AC3ACD7DE8DA8154BF367518FA78DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620628, "uuid": "8052e730-3fe9-4b91-9f21-c6598373530f", "value": "384:XXeXjG8nDUhHclgiPmcHT46hLjvbGQLcCqVKq2Al1yFQO+wvipNrq0:WXD68ltc6BTgCqxvLwQ66jrq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620628, "uuid": "11e57de5-4922-4899-90ae-2b18baf4deea", "value": 16109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620628, "uuid": "c941451e-7914-43c5-bec8-732ec53b16d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620628, "uuid": "c13b3cb4-5a66-41f2-a4ed-3ed9c1874558", "value": "SWIFT PLATA din ordinul.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c5a96b-bc78-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588458, "uuid": "7ea6e3e7-da4e-40ac-85c1-965ef1ea251c", "comment": "Malware payload", "value": "663780286276763cba6eefd02626a5c7", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588458, "uuid": "57439de1-465e-45b9-8be9-08d5e97f169f", "comment": "Malware payload", "value": "4cb4c21be994d7f6fb5e3e55df609c866946b41797cbd9c42be9ed4f5105ad26", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588458, "uuid": "33be4759-04a0-4de4-a002-afba0eb19dbc", "comment": "Malware payload", "value": "3d53174362117d0b02b594d1abfad36ca7024a8d", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588458, "uuid": "3d937bea-e06e-4884-b513-ace9108ea722", "comment": "Malware payload", "value": "b4c17e519df94f7683e1f6a1d2ccda416affe3b29c2fe4a710363a7e999f1427c84e77ddc998de9d66d0c710ae222c39", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588458, "uuid": "3a72276e-322b-40ba-8a27-90508e7744d6", "value": "T1D06523212D1E5C5E075DC4B622EAEE9F15C48EE1505CDA4F2BE5B1C349EBB93432BC22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588458, "uuid": "5caec574-b46c-4a49-842d-cdd633ee650d", "value": "24576:RH3ijtGjKTJ1/Mdi0CumTa1hiXqRPfCY4zGFEof2eBhJzFdCvA4:d3BKTJF0Cum1XqxE1QFQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588458, "uuid": "74fa091a-b19c-4b8f-aeb1-5155c8483579", "value": 1511413, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588458, "uuid": "5f127955-d8f5-4915-84fe-e22344c542fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588458, "uuid": "9adc08a3-ca17-4954-8241-2847fffd81bd", "value": "Invoke-DFSShareSync20251031183017Inject-3.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae2b81c-bcc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621948, "uuid": "22f0f585-2ea2-47ac-9918-634fbec9b4e4", "comment": "Malware payload (Mirai)", "value": "26bc4760a4a6f83002d3a507aa87df85", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621948, "uuid": "10add9c8-df17-4f4b-8863-19c6068e40e3", "comment": "Malware payload (Mirai)", "value": "4dcbc56d7c057e7a4e9e3256ff191d9665c674e3dda2719a67d0b2f02af48108", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621948, "uuid": "997e4888-9d89-47ba-aa96-1096717e7893", "comment": "Malware payload (Mirai)", "value": "1d0b3ff63e3c1535f1e35262b4cac7678d4738b9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621948, "uuid": "1e92d1f4-121e-4e88-862d-760641d4101c", "comment": "Malware payload (Mirai)", "value": "bd5196375e1dcb1e0a580f38a11f03ebc189124acb4f8fa7ea0317c1b3aab82b1fe6d2b0b71648a1598e1871b9e3a76a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621948, "uuid": "1a2cb6e4-e2dd-46cd-b74c-2ed7e26ff706", "value": "T1B833D79178D15A2AC6E423BAF9AE408E3321B3E8D1DF7217CC241B047AD552F0DA7B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621948, "uuid": "2fc1f6e2-7ed0-40ff-bf11-d85d061ac521", "value": "1536:YGZh1mxMBEfiJo25+J+KEwrKdqnKKUWhK9RP:YGZ++tS+KEwwKPh6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621948, "uuid": "0d8c96a8-6ecb-4d31-9add-8b840b1f954d", "value": 51172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621948, "uuid": "a1358a14-5c66-495c-bfa7-8bbd9a7ab908", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621948, "uuid": "d99b61ff-ad66-4be7-9a6e-4727fbaeb2cb", "value": "jew.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35fd2d95-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602237, "uuid": "b79ba687-107c-4b87-81ed-11e442a5a992", "comment": "Malware payload (Mirai)", "value": "53ec9aa77eb14c746ea548d4836389cb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602237, "uuid": "a33f3224-0772-4cdd-aefe-4c02d0b2f144", "comment": "Malware payload (Mirai)", "value": "4e8762e0f653934d38fb5c04a118acd1c63a1ba0bdfb9b83be78d3d6bdda5f72", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602237, "uuid": "7c892f2e-dc30-47fd-9674-e1a37309867f", "comment": "Malware payload (Mirai)", "value": "4378257b64831257ff6ee4eb7a954181454faffe", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602237, "uuid": "2895916c-27e6-40ce-8def-f0d4dc432196", "comment": "Malware payload (Mirai)", "value": "12b852c7070ef83f893b62e642047d440b66b823e8952b644b4cd3d92a6ef575e0a7db82bf09a2d0db125acdb04ab0a4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602237, "uuid": "8892b8f4-0883-456e-b176-f6c46f0d185d", "value": "T1F95163C61153CB353CA1957275E7012CA886DA9178C97F36FEFC78EA928CD0C31A5A53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602237, "uuid": "8fe893aa-cd8a-4e91-8274-3a3e1ec1e340", "value": "12:q0FaH8cPFKX0FTZdBxCMFKX0FJicpYFKX0FmAeFKX0FrLtHJFKX0Fni/8FsFKX0L:vGT/XCWJLE2JnZ27vCpWoo4ofj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602237, "uuid": "f5276512-ae63-4f14-aeab-306b80b9b1be", "value": 2483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602237, "uuid": "78861f87-be75-4b2b-8e10-7e870ec53277", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602237, "uuid": "e602f750-b014-4a5d-affc-85c0cfb939bf", "value": "0x83911d24Fx.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a927287-bc87-11f0-91c6-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1762594916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762594916, "uuid": "b42f8772-0310-4659-bb36-1448267d708e", "comment": "Malware payload (njrat)", "value": "e3801332a9bbd86112c8e16712db574c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "SilverRAT", "colour": "#B3A936", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762594916, "uuid": "0a3c79e6-8d99-49d5-8290-c65e46327a81", "comment": "Malware payload (njrat)", "value": "4ee54727edf5fe9162dd079eddc75580c47a2059971eb31a66bce18354907aa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "SilverRAT", "colour": "#B3A936", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762594916, "uuid": "fe8c5cb7-fca7-454b-b019-51adeab02e2d", "comment": "Malware payload (njrat)", "value": "08a8d633df37d3b93bc782fdeae7c0ea6db39ed6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "SilverRAT", "colour": "#B3A936", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762594916, "uuid": "99871d99-7483-489a-aab9-4a807997e032", "comment": "Malware payload (njrat)", "value": "081002ed81735634849b7a77cff6d25f8a4e90fb15cce63bdfb4eef490e8425e7384d0ad2d329dd772498149a3e40818", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "SilverRAT", "colour": "#B3A936", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762594916, "uuid": "0178b10f-a613-4324-aecb-406de0b3b257", "value": "T17B134B043BE9827EE7BD4BB899F1425946B9F1632513EB8E1CC840EB1D13BC946427F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762594916, "uuid": "d7ea18b2-8c6a-4297-81fe-0d676153b98e", "value": "768:c3PSeQvkrfI5/w9LSGEAgLvRUTw9Pf5VlcB6SjcdBuveVAf:c3PSeQtqSrGk9yo1umVAf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762594916, "uuid": "44a833fb-a350-4500-8b06-52eadf9ca3d4", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762594916, "uuid": "8fc600ed-9bd7-41a2-8255-9858d8a52a34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762594916, "uuid": "3661302d-7d46-4d59-aadc-abc26d983da2", "value": "Servers Cheaters Cheetah.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f184cd8-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602360, "uuid": "4fd80b9d-5969-4496-81bb-0adc9b3cd13d", "comment": "Malware payload (Mirai)", "value": "680e99bc383b92c37bdaf6720c4eb104", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602360, "uuid": "29823012-5883-431d-9405-6b910a95de2d", "comment": "Malware payload (Mirai)", "value": "4ee9eeb85a80dafa55ece7252d17c28830c3948ef2301d09657e1a0a34879696", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602360, "uuid": "ebf0df51-577a-4a30-9103-578f05ee3cfd", "comment": "Malware payload (Mirai)", "value": "8d5f7bf87fb5e7a7116561810b68aa29b521a9fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602360, "uuid": "162b89ed-682b-4e64-a90b-cd8f3ef224d2", "comment": "Malware payload (Mirai)", "value": "6cc1a8c3ddfa58c87f3da89ee2628e394dbe0d2c4b1ff99bf642cc0dd90801ced3551eb8e3b9c51feeae66d91e07c36c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602360, "uuid": "168f32ef-5e34-4f79-b12e-3b76a3308942", "value": "T103B39DABF6071591C8A346F007CB4FDE6E1722C29F57C4E36C6E253E58750DB1A0AB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602360, "uuid": "69a78f9e-2b4b-407d-990e-63a80c1d9c67", "value": "1536:Rg4uLcytbI96efY2aye7tcOiyRLqlqOgb3a10S/LWmoo:e4uLcytU96IY2JatcwRLqlqOgbWTqmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602360, "uuid": "e5ae60eb-55bb-4783-8f1d-72cb4e835f6d", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602360, "uuid": "715b3162-5002-47c9-90d4-9250c2ab20c8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602360, "uuid": "0f20a8fc-ea59-40a3-8aeb-715e288d15ba", "value": "uYtea.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700a30d9-bce6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762635835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762635835, "uuid": "e7921cc7-fc2d-410c-a491-eab8d42dcfc4", "comment": "Malware payload", "value": "3dc6cb0ab3cc03b3ea6077c46dd77223", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762635835, "uuid": "c0337bf9-f643-4ba0-b5cd-6d4db4615cd4", "comment": "Malware payload", "value": "4efe314b3ef2de0406754664e6fe12a3bd9c25965fcff10a76ca39dc4050212e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762635835, "uuid": "c0dce4cc-b27c-477e-9127-d7259f123f8f", "comment": "Malware payload", "value": "e7ba18d9531ccf39fde74eb19e78d49e504ccde4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762635835, "uuid": "c793dd50-6ddd-4cc1-97c6-97e813c241c0", "comment": "Malware payload", "value": "ec8a84ec35f1bb68086c63796cbd2df8276cb5d8948e2609f4f4c91daf3b438024812d0773a8c0a6aced55ab532a2f19", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762635835, "uuid": "6b097125-4e87-4ed3-8515-8cc9e353eaf1", "value": "T1FA15BF5473E54207E1FF5BBAA4B309440B77B852D936D75F198CA1AD0EA3B80CE603A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762635835, "uuid": "f5e0fa9b-a0bf-4485-964d-455a04d659e7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762635835, "uuid": "68f4e475-a0f2-474e-b388-ce9126723270", "value": "12288:yMen0tWfOzAXvQyg7oZisqtksOtgg+WLyDrQ9/7WxdtbiLNg1O+zPzFdw7jETdsX:jDtWfOa4yclOoWLuyWfaN+OWu7jyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762635835, "uuid": "9adc84d8-2064-4a07-93cc-c7db65662d15", "value": 889344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762635835, "uuid": "a6957fd0-0a4a-473c-82e2-7de6adf33236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762635835, "uuid": "1c709510-58b5-4bf1-8bb4-f6e90e4a9abe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302bee27-bc6a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762582470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582470, "uuid": "89c78653-0493-40fe-a3d1-3d2cefe75b6f", "comment": "Malware payload", "value": "85dd1cd4ede712b06a9c6a3ef02b2193", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582470, "uuid": "6ad58eec-e24c-4203-8bb2-672905b13d6b", "comment": "Malware payload", "value": "4f47caa98b3a8f6fe007e1bf400aa120afd6bb699341b3a96e5f473565da2a5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582470, "uuid": "81abeb34-44e8-4da0-8984-8de91b6381f1", "comment": "Malware payload", "value": "4e8b9107209d54c24b93a5c35bd5c3b2e7025044", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582470, "uuid": "cfbdc6d8-6aa0-4baa-97ea-fbd6baeb531e", "comment": "Malware payload", "value": "2805ea907e84b6198bb5df6846bca29a687e5b11dfc8582539fafb3b9d61bce7ae6e8f87df022cdfa73e1588084b213d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582470, "uuid": "49580814-9643-487e-bc84-9c814b118e2b", "value": "T11763A50AEF550EFBDC6BCD3706A90B0535CC651A12A93B393578C92CF54A54F4AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582470, "uuid": "f4a0a13a-b704-4f11-9ecd-3f1b50e45180", "value": "768:52PcG/QdVBcyqnXmjeOqLFe1pgouodRETxw5i7yEYJXZUhxIXidX8/NecxR3JqQM:52cVqnCjqLFgpgonz0KBZUTo/NtxRJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762582470, "uuid": "d019a864-eeea-4adf-a3fd-b62152243d7e", "value": 68468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762582470, "uuid": "afa77120-db44-4358-a27c-9f9518d37332", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582470, "uuid": "93fbb877-7533-4789-b88c-486ed0ea519c", "value": "wewe3.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca65e7ad-bc87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762595185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595185, "uuid": "3e04e50e-9298-4a85-8918-0c59b40d238e", "comment": "Malware payload (Mirai)", "value": "db0693faf2c14b8244130879dee6c93d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595185, "uuid": "19b9c703-b31e-496b-baea-dc72dc0830c0", "comment": "Malware payload (Mirai)", "value": "4f5a6a0760f51a95280ff228111c5500ae9112a0d190d593cb12215c782fc180", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595185, "uuid": "21d727a1-8281-4c93-9088-561ea4cffec7", "comment": "Malware payload (Mirai)", "value": "636bb7dc8e9b64894ee0661e4997328c819667c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595185, "uuid": "dfc1d356-c250-42bf-9c6c-c1e6c244c5dd", "comment": "Malware payload (Mirai)", "value": "b2bda81343099af197cb5b8339f193b7244e667e2df44eb324ec8b7cbd2269afd3f5d8b1174716d2016cce57f3cd276b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595185, "uuid": "f45f51f7-e4f1-419a-93f1-e5232e7615d1", "value": "T136E2C170539BE4B0C2E0647FAEEB8689A3801727FD19F6592B5416E9F8D109309F9DC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595185, "uuid": "1c8c7864-84f8-4ce0-8096-c443b676ead7", "value": "384:Yh0S77PN7bE900C+EerFOvxDPqRJ/OiA+GKGyu3Yrm8/KU1jNLzvOmdGU5Ezu:Y6o7dzAEDqbA+GKGyu3QKU103Uou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762595185, "uuid": "c4af7d3b-4934-40a1-8a80-7342a0db499e", "value": 31292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762595185, "uuid": "b15bd70f-30dd-4698-9c25-9c6087c39be3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595185, "uuid": "41504d3b-d95b-4ece-87ee-67edcd9561bd", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463b14d7-bc77-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588091, "uuid": "14b85859-c7ad-481b-8396-dfbf2014a97a", "comment": "Malware payload", "value": "7da396d5f85cfe19eb20e9273d8cd5b3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588091, "uuid": "520ade1a-11bc-4763-ba2e-8c377c94c8bd", "comment": "Malware payload", "value": "4f8a96cbed7b7b85df044df253a7117da21d2eda5a94b353ecf8e66eecbd4f67", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588091, "uuid": "c7f76d7e-d524-408b-9733-32a7c004fa0d", "comment": "Malware payload", "value": "56cc947c5ac7e8feee5eda786bb2d364071dddc8", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588091, "uuid": "de1cf933-02ea-44e0-86bc-4380b48d6013", "comment": "Malware payload", "value": "a6843e150b2b27fadd9b6850ecc78b84d72fe25043ba0ae6b74ba8c393abf0ce488e27a28ec8391210572c3a2019dea4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588091, "uuid": "acbc53be-e91f-4e00-9661-70f53be7592a", "value": "T126356B15E3C38522C15D027BF459FE0E5438FEA3573491E7BAF5399F48B08C1A2BAA52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588091, "uuid": "34d7fe4f-ce36-4d87-a265-a943f3965de7", "value": "12288:WgM6Q/N5INoPkO+SuPgAc8+MjGCCslegDTwX5/OCmR+dulkXU:WgMx/N5WSuPgAc8rGxYwX5mCmR+dul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588091, "uuid": "41d9048a-f569-4875-9ce2-42c7a9877227", "value": 1102336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588091, "uuid": "32cee20e-098f-4b23-969e-649654cbe84d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588091, "uuid": "17f6f384-5cbe-4313-be07-3d7b89d4d1d5", "value": "d.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b8c4497-bcc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621950, "uuid": "1ecb4301-9a19-4509-ace0-8e02d755fabd", "comment": "Malware payload (Mirai)", "value": "5f11fceab0ee237557db38d5971b19fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621950, "uuid": "0e162cda-746b-4dfe-9eaa-9aa1872ac60d", "comment": "Malware payload (Mirai)", "value": "4fa6773efc343d745040a3c96ee60290ea55126fe3581fdc74a93b8229ba9433", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621950, "uuid": "7eedadac-ce0c-445a-b2e9-242096ff3720", "comment": "Malware payload (Mirai)", "value": "4fc4c6c90568565d7f93b257e038e008dafbfed9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621950, "uuid": "7a3eaedb-88a8-43f6-a80b-57f12bc94654", "comment": "Malware payload (Mirai)", "value": "71a739ed833edea20a6e84bd604fbb13505790bd2566b9e5ce40c8e19a8d7bdfc1951f0a0d0508c93f497d01a7261d51", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621950, "uuid": "ec1f4b04-1efe-4fca-8859-71d90d88bdc0", "value": "T14343185178D19A16C6E423BBFA6E40CD372563E8E1DF32178D212F1177CA82F0DA7A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621950, "uuid": "e04c8b9f-938e-4c91-bccf-531c9a903159", "value": "1536:saEJMzL7BC+nfbXq/5XqbFJ9WhKvriEALd2:saDD2/kJQhYbALd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621950, "uuid": "3cc56b25-d707-43b2-920b-52c3fb2a4c2e", "value": 59988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621950, "uuid": "2a1d82d7-b092-4132-8e30-efab169ad5d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621950, "uuid": "cc4716aa-7dfd-4e06-90d4-d5364ba93012", "value": "jew.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b8acb3-bc8f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762598477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598477, "uuid": "9a124385-c4c6-493d-ba2e-1d5d7d33222d", "comment": "Malware payload (Mirai)", "value": "aae17b5e4a00b3649c6a76498b5a21f5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598477, "uuid": "dd52b42c-8181-48cc-b538-c4fc05e58347", "comment": "Malware payload (Mirai)", "value": "5018af466aed5512b8fb20a9c055943ff87b84f6ec95f85cfa974847941bd0e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598477, "uuid": "91a06019-85f4-4dbc-b0e3-f19c9e09a67f", "comment": "Malware payload (Mirai)", "value": "11138bac76c2597e894e38cd15682f89b855d6ca", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598477, "uuid": "fb9905e2-86bd-439d-876e-07abd745f920", "comment": "Malware payload (Mirai)", "value": "149231d11bad00658e564104fc4673fd88ae253d7d2b2b7b7c14171ef40c1dd6d68dc6e2d1cbdf04aa2ae0783b0b6522", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598477, "uuid": "eb62e0c0-ef67-45e4-87b5-3d22e45c5e15", "value": "T189B3C709BF611EF7E86FCC3709E91B0128CC692A21B97B75B534D518F24A64F1AE3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598477, "uuid": "fba72625-9788-4da2-ac38-2ff4cbb7d102", "value": "1536:UKHGTVO/dXfCAbQddEWslAswt1jUj9mlwNiZ52jDuANF7e1BGYggkkR:UKiedXfCAbuEW6IlwNi6fbEDkkR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762598477, "uuid": "4a94fab1-139e-4d7f-8070-03f38170e6f8", "value": 113856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762598477, "uuid": "b3372fa0-3532-4221-b2af-39323aa87ace", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598477, "uuid": "d7f42d2a-8899-451a-8397-c8f89db082d1", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f36417b9-bc93-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762600407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600407, "uuid": "c04771da-1801-4da1-a1c3-d9c94e9b9f05", "comment": "Malware payload (Mirai)", "value": "9275b4d75c65edd171e048413478da01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600407, "uuid": "c82162be-a689-45a5-8dc9-3e446c947cde", "comment": "Malware payload (Mirai)", "value": "515d159bee465a48f25f3fac2248d08303a999479fcfba8ea2ef63287244402e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600407, "uuid": "788d586e-1228-42c0-980b-960cb9c687e5", "comment": "Malware payload (Mirai)", "value": "73439b9ee14e1b8c3770fea31981d0d6e478e920", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600407, "uuid": "35934395-cbd8-4272-8836-cd04e7ceb58c", "comment": "Malware payload (Mirai)", "value": "e9203cbae062e4d40ce32969002371674a99f34030381ca510a24d42f1512f422c908412844bd444c10386e6f2a2cd26", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600407, "uuid": "ce31cf5d-7037-4784-b8f0-f60ed80e7024", "value": "T11F935B59BC418612C6C165B7FB1E428D7B2743BCD2FE72038E265F62638E46B0E7B142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600407, "uuid": "da9a50d9-93e9-4150-a4c8-ea57631ea45c", "value": "1536:pwN3UcF/MA+fPMMfLlItKzUyhGwsHj5xuwqv6Qemf:pwNEcF/M9fPMkLStKzUHhUx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762600407, "uuid": "462708ea-edb6-4cf3-ab4f-882f347987e9", "value": 92888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762600407, "uuid": "61bcc33a-0016-438d-9391-06e48e1a8717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600407, "uuid": "2ce9c0f8-59c1-4046-b54a-a94365d5b7b6", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec3912f-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623512, "uuid": "e7bc0b84-06f7-49f5-8028-2ff0c6bc45fd", "comment": "Malware payload (Mirai)", "value": "09a50ec57121bc525cbae430407d0a17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623512, "uuid": "08ac8936-284e-41c4-99fb-fcfd5ad85cc3", "comment": "Malware payload (Mirai)", "value": "51b4c669d6f7370479c494158d479f7a2ed44d565653255d69295434523225e9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623512, "uuid": "88bb3e3b-c011-4f9b-812c-9bf0caba67bc", "comment": "Malware payload (Mirai)", "value": "793ed22cea432c1a76b4ba7b984b2ee4a03c95f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623512, "uuid": "875dacf4-9b73-464c-8a26-a2bd6413f38a", "comment": "Malware payload (Mirai)", "value": "9ffcc3d231c625079f2b3224ae3185d1612117297ee97704cc9d252ac175f98f20a8fb604074223f7a7ccbf884c94377", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623512, "uuid": "ef9ac784-676b-4ae9-b637-af455b5a902b", "value": "T18B531A92FC434A2BC1D402B6B5BE5A8D376123F9D1CB7227DD214B407BC591F0DAAEA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623512, "uuid": "f97d07df-5731-441f-adea-2013cdf59b33", "value": "1536:I4v8DrAJ9yYPw4+960GgVfkRqcxHHmc1cE4sLxe2IymQY2AUm6hh1Z/C/C:IE8DrU9Do4hHq6hh1ZKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623512, "uuid": "5419cc7f-6966-42f4-bbc4-5ded1bd773ab", "value": 63816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623512, "uuid": "3474e48f-9a93-4103-8384-fde890bdbbf8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623512, "uuid": "89e127a0-ce0d-4177-9a79-ade6fe628da0", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4612fcab-bca2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762606559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606559, "uuid": "94a12fa8-07ce-443c-927b-cabbde9b7787", "comment": "Malware payload (Mirai)", "value": "093c3f87d0bc376ee06567f5630bcbdc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606559, "uuid": "11606d88-90e4-46e6-a822-f08aea65ba22", "comment": "Malware payload (Mirai)", "value": "51f04e244086764c8dce6639a2eea1115e036a4128d3c26422535322325d320a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606559, "uuid": "c9eeb6e5-24e9-42a1-a726-fe554a585836", "comment": "Malware payload (Mirai)", "value": "646183dbce3339ec24f33eaea03da039390b1b91", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606559, "uuid": "7faa2772-ac99-424b-bd2d-1be810a38714", "comment": "Malware payload (Mirai)", "value": "101b5aa9ee62feb1d86ca863363fa0f839380d913873b8a74dd8a15811d95415f82718f80ce3a2881c3f4051df3e02df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606559, "uuid": "c171f7d6-19ab-45e5-ade3-b289994530b8", "value": "T1EAF2E18A42C01858C1470D31975C9B8E614F275F9BEE3F22213848E9F941D76BEFE95B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606559, "uuid": "d58548e4-e553-417e-8e49-0998dab2c92f", "value": "768:wbro7KA58HETN+5Xz1zDEwBtnee67L9RZ3UW8:wbromAioUD1swLnHmR8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606559, "uuid": "244a2a99-deca-4b56-bfc0-d84936eb090f", "value": 35552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606559, "uuid": "9aa64f2b-2632-4d6a-bc6e-ef36bc4bc405", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606559, "uuid": "d77981b9-5b67-4d42-b2d2-931e8b515076", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be45e127-bcfd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762645845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762645845, "uuid": "bca8108e-88e0-483f-9bda-2aa1ccf13f36", "comment": "Malware payload (Mirai)", "value": "60fcbdc035569d6d9eb597a58d7f4669", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762645845, "uuid": "4c4df4c2-c783-41a8-aac1-c1ca78c9e320", "comment": "Malware payload (Mirai)", "value": "51f91dfa7a47fff04970d2c620656dda43bf40e841f51d3527fe3b13f334904e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762645845, "uuid": "68e10f7b-ff7d-48ad-9d64-c59f980db9de", "comment": "Malware payload (Mirai)", "value": "2f1d05cac6c451dc263afd52a067792a01ba4b9d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762645845, "uuid": "360656ad-23c2-40d9-989d-d41744468576", "comment": "Malware payload (Mirai)", "value": "bff8ca7cf8af695efe8c80987b1a7db4001ed23530b28884000ba6e0ce88910f992fa55c46079d691db0493e27600e8d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762645845, "uuid": "cc927d4f-df75-4525-8f2e-0927bff5fc4f", "value": "T117934B01B3080F43D1679EB06E3F33C6D7AAAED021F4E685660FB68991B6D325186DCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762645845, "uuid": "8853bfa1-2920-45b1-a1c9-20cb864413b5", "value": "1536:C0PgopRvU/1TpX5ZfG7gkfkn3qxCEmNVGHdqJkRYF2em/F:CgfbvSTprS63xEoenF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762645845, "uuid": "dfce3c04-182b-427a-a6e3-75c42a211948", "value": 92400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762645845, "uuid": "85c29d1e-5cdc-40d5-9ecd-3f8111034e8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762645845, "uuid": "de0099aa-7300-4771-b118-8a92e58c9935", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "988f9819-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620441, "uuid": "05c834bd-002d-43f1-b31f-47329e0e3b95", "comment": "Malware payload", "value": "70de631578c9791e5e98483d2b803e7b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620441, "uuid": "901f3a45-006b-423b-9ec3-1806630fcee4", "comment": "Malware payload", "value": "5257b2c917b5835837b9917fc9255ae575f5e7c4c3c6c831317822b05f394847", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620441, "uuid": "e94cadcf-c1de-4218-a4ff-1dcd6905f163", "comment": "Malware payload", "value": "0c84fb9c376f63658c51f78f54a2f2e1cc098990", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620441, "uuid": "b3e5dbc6-8eca-4c96-a9b1-c54e6f06cf17", "comment": "Malware payload", "value": "3e98e4c5440c61fbe341ac65b66d886dd498d037c7242bad5232441d66585e45226832abf39a7a19dc89ca141534436c", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620441, "uuid": "17cff13a-a129-4d9a-92a7-6cba79f56d18", "value": "T1E0F32D7725164E25ED32252A746DBE03EB104B9F43E51827F86E3BC78FA8F47D062249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620441, "uuid": "b8e1c881-5f9d-47ba-ab4e-9c2ec082549e", "value": "1536:bps/LzVnE75KfLafFUeOVZQA5PGqH8v7VR00GfNNLsXe9biBIypY73:yjzFE75Kf7zQA5PGxpY73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620441, "uuid": "bbcd3705-4d81-4d8d-9630-6beeb1489545", "value": 172929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620441, "uuid": "584c5f17-50d0-4d1d-a8b7-9050fd863960", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620441, "uuid": "1cedf066-c111-420c-96b3-f2f25c058898", "value": "RFQ875665,PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdc8dcc-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588959, "uuid": "eb455cc9-ecb9-4e3f-9559-5763fbb5f4df", "comment": "Malware payload", "value": "0583bcd46e3d2072f07c62d806411efc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588959, "uuid": "d5e82a08-ed6f-4e08-823c-c06e1e7d41ad", "comment": "Malware payload", "value": "52664a99296f612127487d67dce29ae449e8461010b30cf299a846fab747ef6f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588959, "uuid": "2b74fd67-1457-421e-8cbb-190e5b5ce2c0", "comment": "Malware payload", "value": "3212940e8cd9c491e6cd8ebdeab7487164175028", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588959, "uuid": "c8c7cc74-9f46-4e47-9691-cc80542d19b1", "comment": "Malware payload", "value": "9dea4c725d2560a160f3a640c5996bac22b703880ed0648358847043ace88046efb8c9224946af832ed5e88b18af3e27", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588959, "uuid": "f840d75c-e621-482d-9da9-3a7e4e1f6cc1", "value": "T173E2F0CD3FC2B175527370735E2BA46EE26A2CD9764C9158D3696890FD21318CAF2B2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588959, "uuid": "1a98610d-31be-4713-96d0-e7f11b5048d6", "value": "384:xiTMDtAx3J+AJP3fS09xC2j9qgF1Z3kWym/k3MOs3ZdWDLE1jxMAkOAlW:xhDk3Ta2jIS/kcOYz2AkJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588959, "uuid": "752c0adc-f21d-4b5b-a682-e4beaa83cf13", "value": 33895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588959, "uuid": "8dd90e35-0807-4dc3-8979-7369cea62fba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588959, "uuid": "ce845217-9b64-4253-b342-1873d770e268", "value": "Bonifico SEPA EBM-18-12.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7caa1f1-bca1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762606320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606320, "uuid": "8b8de3a3-cd78-4098-8f64-9fbb051f3ad4", "comment": "Malware payload (Mirai)", "value": "4129f3f65769f631113ccf1403877be5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606320, "uuid": "8a5305fb-66b7-4f05-b471-bfac660bca66", "comment": "Malware payload (Mirai)", "value": "5282d05cdbc83312928aa8783dae4051a77ac1616be3415ddf3abb1885650dbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606320, "uuid": "780a4398-9262-4618-b7a6-22596df86079", "comment": "Malware payload (Mirai)", "value": "9e47dcf44ff581db28f0932f0155b1ef97847424", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606320, "uuid": "8f19eb81-4050-48c4-93ca-2d149ba9e9db", "comment": "Malware payload (Mirai)", "value": "82510915be4e32690037a84d7bc883c005fc001c7866cc6f22ae5c5fed3348fff605bab346ef3145e998097b61772889", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606320, "uuid": "d5111b43-808a-486f-8854-e52ffd64eae2", "value": "T14103E1E81F01491BE666C6B804A62342F9F01FE06AD6F854B1A4E7A1CA57EF47CC75F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606320, "uuid": "9b74b7ea-02e0-4506-9421-07aa18c4ea32", "value": "768:7uwbKSzoqYQgAkrAuTHD8yWIafFACOD+9HEvGNLW6dVzchJgGlzDpSO+aJ:7ZbHDFgtrAuTjqfFACDsGN66dSVSaJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606320, "uuid": "5387461e-165a-4ec1-bd22-5c150ab46a5a", "value": 38468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606320, "uuid": "35df8e1f-2f34-42b1-942f-85dd46a3b0df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606320, "uuid": "9d749594-9a42-49a5-9c5b-70feb3c9277f", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d66ce85-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588908, "uuid": "f2132e14-a48c-4d97-8eaa-e2cdc6f56351", "comment": "Malware payload", "value": "dad5d46c0eb79dcbfb2951dac1e1f32e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588908, "uuid": "6621922f-9eaa-4a5f-a97c-4a2640bb675f", "comment": "Malware payload", "value": "54bf56de4988153187ab3e6ff4bb25bed31bbdd51a67e484620ea70294512ae3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588908, "uuid": "54e7fdac-2e85-4266-80fc-38da9a08eca6", "comment": "Malware payload", "value": "8aff33bb1009b8949b4153002fe4d26d8f3c9dbe", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588908, "uuid": "bbf2a092-eeb5-472d-a262-0556c00ea3b7", "comment": "Malware payload", "value": "ec796167b6aeaafbe1371bf5f85c85b7f6631454f188995193a9cbc7e19b107dfcfea995e86807b6d7949dbcacff8b7a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588908, "uuid": "acf74f3a-b575-4afc-8657-498c720718c0", "value": "T10531E708527FA720869545B4FB0C729CFC3C441395A2492676DC54D2DF7E0AC83EAFAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588908, "uuid": "e0f54420-c911-40e6-8fb5-481e07ed8b91", "value": "48:kJC1CK1CmC7QCRQCGCKjCPCMCbQCvCuCWCcCQCiAV2BVeRkv6:SmHpLlJJwfrARJ7pkV2Bas6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588908, "uuid": "d20de647-2e1c-46b5-8c9e-f37bfae535e0", "value": 1588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588908, "uuid": "032fc238-1483-42de-9a09-23b382eacb19", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588908, "uuid": "29969095-f3e9-431d-a509-02405a6df243", "value": "CIMB-Transfer_Advice-2025110060857173.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3f037d-bcb3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762613903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613903, "uuid": "8c123752-e79f-472f-b606-79ef7972d68f", "comment": "Malware payload (Rhadamanthys)", "value": "d2d07f603e7c4b8212f6baabf99665e6", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613903, "uuid": "ac54a828-72c2-4648-86aa-7e5f5f45a9fe", "comment": "Malware payload (Rhadamanthys)", "value": "54f2ac23b773789a411dbc870422e5887ed955754e0bfeb9e0ef91f057ec46da", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613903, "uuid": "51df4adb-f51c-42d6-8f21-736613c9535f", "comment": "Malware payload (Rhadamanthys)", "value": "28bf58f1796161bbe993c41eec77a1c520bc733c", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613903, "uuid": "a795c102-b491-44dd-a61a-440789fd61a7", "comment": "Malware payload (Rhadamanthys)", "value": "16417cea6553e1c234d3bbc41bceaf69fd4102231e7c9e0a10c4090295cba85db37c943427a72855fd1fd7d9cf4c7178", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613903, "uuid": "76e60371-c419-4af3-ad39-35cb83c14892", "value": "T11F863310F97012D7EE5792B3A20BC2C67A129D2D0F292572C1EAF2165577F3A81F82DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613903, "uuid": "cf4bc2f8-f912-490d-b90c-829be297e506", "value": "196608:v0DXFSB764OzN5u7Z/Jy7BiOMb6ICZSpHq:qIOru7HYBiO86GK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762613903, "uuid": "dda66664-2774-4244-9a63-d41ffa93f8ec", "value": 7880704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762613903, "uuid": "c599bb0c-5828-4994-8527-cc6d410d5e52", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613903, "uuid": "f629c4c2-ccec-4e37-a856-04aa442ba241", "value": "Set-Up.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8956efab-bcf9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762644038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644038, "uuid": "3deab6cd-9d53-4356-a30f-b1f6a74e325f", "comment": "Malware payload (Mirai)", "value": "ba5ed2d5af5888fc39f83706fe53382b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644038, "uuid": "6e4485b9-9adb-4bca-8b91-1d2d9e6bd1f5", "comment": "Malware payload (Mirai)", "value": "55153ac8d1c681ee19432b2c774cfd78fac25e733b09b4606c41e28b7916dd8c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644038, "uuid": "c6a6be2c-f983-4b49-8103-60d1c436ca5b", "comment": "Malware payload (Mirai)", "value": "9249078655c199e978363ff645eb5d0448f9d515", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644038, "uuid": "319bc1fa-8c8d-49c1-9102-6285b61ca93e", "comment": "Malware payload (Mirai)", "value": "2a0ab723ced1b61246b88c1cc1f70d3a60ec8637587763e2f5ac5f1717d60657e31a512b437fa96f668dc11396395e8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644038, "uuid": "95ff4034-2e1f-40d4-80a8-14498b8af415", "value": "T18113E1238367E730D43A4A33576C9180F6169889EB66976F8D8165FF0CB0B94FF21D91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644038, "uuid": "56d69937-d0a1-47d0-922a-4103dfeaed54", "value": "768:mVhDpTfk0venOm3Xs2EINC4FHZtC4RRy/fpe2ypT0UcdYlP/C/kLxN1Tx01v:mlNvenO+X1rbHHCc0phyl0UHDjRiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762644038, "uuid": "497b1b4d-ffa0-4d75-802f-cc9acf362982", "value": 42864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762644038, "uuid": "42258028-2440-47e0-8527-8c1c872151ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644038, "uuid": "95d43b6f-c688-4c98-8917-7aa160ae884e", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f00e20-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602480, "uuid": "0dbfa5a0-0511-4865-95b7-de5fdef0f47d", "comment": "Malware payload (Mirai)", "value": "02c619294bdab17a5eb46f8313596c40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602480, "uuid": "6b2c6187-a688-4d34-b9b7-1b91ced06209", "comment": "Malware payload (Mirai)", "value": "56731616838e32e1fccf6586ac215c29d6be43c426549ad2660f8f002e363287", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602480, "uuid": "9e86386c-6a64-4462-8ad9-b6fb72dddbc7", "comment": "Malware payload (Mirai)", "value": "2c94409f984f4674087a2210964a04bd97e23635", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602480, "uuid": "177f6b24-47da-4545-86e9-0b66bc721a57", "comment": "Malware payload (Mirai)", "value": "e790cdec8d98823c135d8bfea5139f34132ea7faf127df087f3433d5fbbe92197199ae296acf06b92130fe26e941e4f4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602480, "uuid": "c26a2177-dcb5-4550-9235-5f119dbf7224", "value": "T17B732A91B8819A13C5D023BBFA6E51CE372553E8E2DF31179D225F24778682F0D77A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602480, "uuid": "af878727-e5a4-45a4-96c8-a91746979507", "value": "1536:6VaDlYj6Kj2v6NeKgz1Pe85hwkJxb33L5omM5m+fOGNCmrd:uaDlQ6Z3wkJR37mHUGOG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602480, "uuid": "8e4e2a1b-3f70-4c3a-b564-aa930ea83cad", "value": 74748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602480, "uuid": "98ec9be0-3edd-42f7-b911-22f190b87c7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602480, "uuid": "e1923530-586f-45f0-810e-830131ea0058", "value": "kowai.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1ef1d3-bcdb-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762631055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631055, "uuid": "3a342f4e-89bd-48ba-b1e8-3a6739816b2c", "comment": "Malware payload", "value": "d7c1768439c7a233dc833496641163f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631055, "uuid": "14c95de8-e81e-4607-8502-b1d8e87ea07c", "comment": "Malware payload", "value": "5719192d0743cb95716dd9ae819f7f8051d4f4c37e7c2dfb2a41c81ce7ac8c7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631055, "uuid": "e66fbb5d-54ef-4800-988b-df92a68174da", "comment": "Malware payload", "value": "f3c9d21300dbe058473561497686da3b6b529fa0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631055, "uuid": "72a26dee-465d-403b-a282-1060b20e3dc4", "comment": "Malware payload", "value": "c5393c2f71b40649f9254225dc21b8033c79823cb99e49090d99ef94f17ad4d937d401280fc2d31ba241ccc630fe75fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631055, "uuid": "4a8bdf1b-c740-4385-96c9-e30ba7a1bea9", "value": "T179B3FC2964206476CF99D833C4BDD6F2D6316C4624F162D91EFB69233EE728B1CE9702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631055, "uuid": "63527bca-c4e0-40da-89e1-f8cbb186a684", "value": "980b67dbc22395e4ca2f2a12fe49fa9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631055, "uuid": "3bbd0ef8-f671-4f7e-bcb5-e9b2c65c62df", "value": "768:ffkcKztKki7kFAxkZ0kXNkbkgftJOW9TExh4bkenx8kzke7u3tAnejD7fD7T5dRO:p0pQvw4bo3tAni/9dRR/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762631055, "uuid": "78b549b2-6456-4f24-b78b-a2b1899bf66c", "value": 107520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762631055, "uuid": "7337549d-1a59-48ce-b6d0-95a05a98e50c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631055, "uuid": "e4187455-7e48-441d-9ac0-003fc14965bc", "value": "Instalihaly.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110e7e9e-bca6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608188, "uuid": "a0a3dcd6-5096-4e94-9224-55d28e493ba0", "comment": "Malware payload (Mirai)", "value": "ba178314baa53df269c660a0c9d9576e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608188, "uuid": "73988f2e-a3c4-4115-9745-8626962a0fd9", "comment": "Malware payload (Mirai)", "value": "576412a5010ab0c426f581f147fbb7dc7fb3d4660ea8aa684cb70859a1042bfd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608188, "uuid": "e980f40b-3765-4a15-91ab-2a5b194ae13a", "comment": "Malware payload (Mirai)", "value": "17bb23829a4bdb434974ea8bbf982150d03a7413", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608188, "uuid": "14fe4e4a-bc3a-4b3e-add8-93f1a5f24878", "comment": "Malware payload (Mirai)", "value": "22e6bc887c72cfd877bed4c8384563e82c6092a8b81b6085ece1c0c8398c2bed117f1c84c47966e3e8f223d621b97fb2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608188, "uuid": "a4c7e354-fe9c-46f2-8a0e-c5f05d0cd6fd", "value": "T1AB13F1A73169B9B7D834F97A28ACE7D03993D8498155033B13EE9FEFCDE89800611B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608188, "uuid": "2f64b644-59dd-4ef1-a53e-27ac46752a6d", "value": "768:7jDC8mwds9SHj1rSg3CXtFuQ9My17EZy0tYZrwxS4vcYdKzx0bF:jVHmIZv0zuKoZy0orwxVvIsF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608188, "uuid": "13e1b549-a7b1-4ac6-96ab-6ee9f93c78c4", "value": 42864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608188, "uuid": "69e9e888-08e2-4bf0-b1e0-db5aec8165db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608188, "uuid": "aa4b9f77-3a17-4f2a-9b8d-242b0e72b1cd", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48340818-bca6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762608281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608281, "uuid": "8c1f6248-6c77-4e4c-ba49-35cbd4d033dc", "comment": "Malware payload", "value": "6e501d38d97973a4ac78365dae9ef7a8", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608281, "uuid": "b8213a1f-bc5a-47e6-bcbe-f21588a50468", "comment": "Malware payload", "value": "58e6ae41d0a146d12edeb12bab9c702a19c09b3ccbdc8f93d2a209977d3cb917", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608281, "uuid": "eec42422-7b29-4555-8b2e-8f98352d321d", "comment": "Malware payload", "value": "cf7f2261ef99d81553534621543f5f701b496b42", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608281, "uuid": "409a3dbc-0671-43da-bafd-cfebf395cdb8", "comment": "Malware payload", "value": "aefee54e4f8f2c472ba2b77638ff5bf66c39b511b6f9c7225cb0a0ee65e0ef4c5eceea90ced35df6d2e8f4296080ab3e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608281, "uuid": "d7539d81-85d3-4093-98dc-7d95a3851c2f", "value": "T1AE7355595DCF42E89B27786885DF9C82FBE48503061CD6E5FB5DB9E02F01438A1F89E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608281, "uuid": "13ce1514-0aaa-4036-93dd-ec796a2fc446", "value": "768:MaZFVemYwBuggXZQqx0UTC3LQQhuChte6zJrFjvvyHoEO8W/VYsDOn17Tn9fmbrH:0TodvteitTto5ZOXyOA3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608281, "uuid": "df461b73-9f02-45fc-9c91-825997328a7f", "value": 77195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608281, "uuid": "5f4cc71b-6a9b-4501-8ab8-91bdac041a7c", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608281, "uuid": "d0bf5b17-4094-455b-b847-061c7698ce9b", "value": "t1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeee1b2b-bc83-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762593528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593528, "uuid": "36fe8c78-9464-4e1c-97e6-5d5db585e071", "comment": "Malware payload", "value": "2467ea2175750c310135d0132273d2c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593528, "uuid": "0a365a3e-4d63-45f3-8a18-00be1b4bb145", "comment": "Malware payload", "value": "59892acbe5308ca3b7825098a8466db9bdf93658f30ced0a08b9fe3393fe3058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593528, "uuid": "9b437c1e-324b-46e5-9c50-43805f906e73", "comment": "Malware payload", "value": "3baf8fe34c66b08ba054a86a15ccf5a504155891", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593528, "uuid": "74f22f30-8c1c-4d17-b135-58a85e053193", "comment": "Malware payload", "value": "4a6ab3aba2206e2f23c15dec21e833a87631f395ac066a0ec157b566e2ceb6899ea0d34eb7f1133de359499821e8e20c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593528, "uuid": "89e35328-71fe-4367-9061-3766501afc1e", "value": "T1AD56BD13BA4851A5E4EEE0358AB14152B3707C584F313FD33B116AB71EBB7D88A35B98", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593528, "uuid": "85df619f-f79e-4847-823f-6569b397e1ca", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593528, "uuid": "6ff92e9a-c8e1-4d86-8b6c-03a01f8359ae", "value": "98304:Tb3TeVZ31HUTA74ul4Yf8uidLiJT+xd6aj6qMvOewH:TTM310Ty4ulpf8LLqqEE6qM6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762593528, "uuid": "560343d0-d542-432e-8f60-23f85ab224da", "value": 6262216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762593528, "uuid": "3dbe425c-c009-41ee-aa53-3f48fcb5525e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593528, "uuid": "f7018027-b3b5-489e-a48c-d86e210a7401", "value": "install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecbca578-bc87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762595242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595242, "uuid": "db5681bb-b69a-461a-83cd-aa4e65d57d33", "comment": "Malware payload (Mirai)", "value": "34e6b1b23bddf23c8e0c2a3c4d1b2e21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595242, "uuid": "8f5df6fd-e362-4eca-9673-8dcb1ccdb7e7", "comment": "Malware payload (Mirai)", "value": "59e574f4e37bfd8b26ef3b5f9882061deaf5c59ea16b3a4d6365205f8ee17702", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595242, "uuid": "6eade7e5-845f-42c1-a4b2-0af0ab11928d", "comment": "Malware payload (Mirai)", "value": "87a10b036de1641f93eb1b0b6b4f728a7f52fb10", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595242, "uuid": "e6ed8d94-2407-41ae-ab4a-9fa340f672b6", "comment": "Malware payload (Mirai)", "value": "a82671db1ad046198cdd276bbf6ea9ca8964fd416807801b072e0cc050f3708afbbca0b55159e037d24cbd47eab06988", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595242, "uuid": "5686604f-59d2-4de8-80ce-bbfdbadd36e6", "value": "T19A831880FD8B45F2C5074D30A197F63FCA31E97A017196ADEF999F39DA23A01920724E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595242, "uuid": "dd38b20b-5e0a-41a1-80ab-d443b9ce0dea", "value": "1536:g0YeXm9NIBoLaFuGMgEEgnthgid0qiiKWBkmHLkDA4Q3:g0Yv9yBoLaFuGMt1Di+WmHLI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762595242, "uuid": "14397c45-001a-4d96-b34e-25851d879910", "value": 86896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762595242, "uuid": "67211625-2a88-44ae-acbd-6ed4bb1b3078", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595242, "uuid": "8c1f2606-7643-4a60-966f-088788678dc7", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0927c45-bcbf-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762619166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762619166, "uuid": "ae150923-d0dd-437d-a93b-005e79c9e718", "comment": "Malware payload", "value": "b8aca3e033bc47ed6f01d9e8775967ad", "object_relation": "md5", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762619166, "uuid": "d44e168c-7348-495d-9f2d-5c38df83f81d", "comment": "Malware payload", "value": "59fff7d9ca2c8181c967f6f6e1adb3d4b8c7fc675767ac5f6ee4f4fd400c0c5c", "object_relation": "sha256", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762619166, "uuid": "ca50248f-624a-4fc4-92b1-20bde434bdb6", "comment": "Malware payload", "value": "44b5bc189db657690400ccf1b84dc2dd64f74cc7", "object_relation": "sha1", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762619166, "uuid": "0cd89635-91fc-44a2-8a1b-e2dde4fc59d9", "comment": "Malware payload", "value": "c492ae2f0c7f9c074fc900b52f09def7c4e3a328c2b92f56a8f9cd038bff8cda14e6dfc4c935a2dab24a06cee64599b3", "object_relation": "sha3-384", "Tag": [ { "name": "backdoor", "colour": "#D18BB0", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SilverFox", "colour": "#76AC5B", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762619166, "uuid": "70073f98-05ef-4d6b-971c-37ff109644d1", "value": "T164773353E18D3EBAD06A45311D76AA00143FEB69641A4C63AAB4491CCE3A1D33D7FE4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762619166, "uuid": "9785fed7-3849-4197-bdcd-f58fad0c7eec", "value": "e8ac1646024d52d1534a88da2e8037cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762619166, "uuid": "c9156c15-73de-4255-a311-8b1a90315d75", "value": "786432:IZTPS0P54e2QMsHq0YFpgxtTin+J3r/8CXad4ewaWnVgUS:Ib4HhiYFi2grW7waWnVgD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762619166, "uuid": "45bb1f28-f393-4265-b2a8-3abc90d7df2e", "value": 35068196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762619166, "uuid": "fbe8a968-f434-4ed6-a221-5a27c906ea27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762619166, "uuid": "2fb3ef2e-778e-4f6e-a6e5-7ca2d865f968", "value": "Spoqspocrpeament.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7b50ae8-bcc7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762622722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762622722, "uuid": "a336ea41-02a6-48d2-b3a1-4d36109e8844", "comment": "Malware payload (Mirai)", "value": "b60626b997721afc040db1837dab7b97", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762622722, "uuid": "1ffd4c37-462c-434c-85c8-65eb326fefff", "comment": "Malware payload (Mirai)", "value": "5a03042b6bc872c93b24d004835481947b9e91453ff5b2d90310523589c34d2d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762622722, "uuid": "46c8b1db-60ef-4f81-85d5-3af95e3d20a7", "comment": "Malware payload (Mirai)", "value": "e52cbdbcdeb75574054da9dd57a871ff8aa5df0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762622722, "uuid": "e06fdb97-ec49-4f05-9e83-98c116e7e1d4", "comment": "Malware payload (Mirai)", "value": "3340bc60476e77e76ac3017fa378fe68d4e7198e805fa7aa7611e38c68f7b31ceb242fd1bd52eb0f6b8828d9b3f1ac5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762622722, "uuid": "c516ac24-7586-4877-a7dd-380d0cf17e7f", "value": "T18513F0579BD16748FDFCEC785A622A8D7B804AEF70738E9221D0AF53C950BA1F900D19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762622722, "uuid": "14a46d7e-876e-4685-82ec-1268bb3577a2", "value": "768:hGOtcmFd5Z1H7zFU8Cg0UQe8fBTK2MY3gYHy/YFWXf94jOE9SDZ/IxiszgJHQ4uQ:02FdtFRCRemBPMzYHyAFWXF4jHYDZmAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762622722, "uuid": "14a8f6fe-532e-41cf-8560-0c98ddb7a3d1", "value": 44196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762622722, "uuid": "f779abd7-56da-45c9-acf2-4ef42ec3a6ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762622722, "uuid": "bd44576a-4e60-4b48-b267-b2accfc4b363", "value": "executor.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b228e67a-bcc5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762621773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621773, "uuid": "53a2ccd4-f75c-4c58-955d-cb18f3950f80", "comment": "Malware payload", "value": "a2d2ddaddd667577c06c259ea65a1447", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621773, "uuid": "38113175-5df6-4abd-b0d6-07b56134fabb", "comment": "Malware payload", "value": "5a4b38802ce59185df1fa14d20c94b3cd0baf0125896c2f5a17bcdac07bb5a5f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621773, "uuid": "72faecec-2acf-4746-a277-e1da907c6407", "comment": "Malware payload", "value": "63b86a2a687ea959df1017d7dd7127063c4f6e16", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621773, "uuid": "bad94031-1afc-4560-abfb-0df767b591d0", "comment": "Malware payload", "value": "03a424b4931d96faae5fb00765970499846f99038c5ad3c55e8bb224bc71f436dc438d7ef5fab36aa2d100e76902eaea", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621773, "uuid": "8ec1de52-249b-4dd2-b9fd-e7e281d1dcf5", "value": "T134E0C299FC530837B8B58CBA77DB2455A54B924B6E06988A728B520EEEE4960A060453", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621773, "uuid": "3dfdbd9f-85a2-44d8-968e-53a8db24113d", "value": "6:hftJ+pUKUF2RVYrV/jkOYf53ICUH3FoF/fkVKhOXqIKXD73IKX+N1IEWYq1IKBKW:ZtJ+jRaV7Y7F0ghsOTh4WYO8W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621773, "uuid": "5303f3e7-1b08-43d2-a698-27d64cf5fad2", "value": 298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621773, "uuid": "083a1caf-cbe3-49cc-9498-b22e4f91b91c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621773, "uuid": "14ca6798-4891-409b-84a8-8da940a6c39a", "value": "res", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84bb5ad2-bcad-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762611389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611389, "uuid": "a70c0a84-2511-450a-8480-86319431fd91", "comment": "Malware payload (Rhadamanthys)", "value": "470ec1398f08fc6da080142ff17ef583", "object_relation": "md5", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611389, "uuid": "07f3fd05-c598-4413-b94b-9d28eea3fd5c", "comment": "Malware payload (Rhadamanthys)", "value": "5a8b05f69b2fc792786fd0f2c1346153fd32678ae3e90dadf112db98093d2da1", "object_relation": "sha256", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611389, "uuid": "c5d65d73-d402-48d1-859e-c7a80c24914b", "comment": "Malware payload (Rhadamanthys)", "value": "6de824b9985d6f0e05280d4709cb26e37e3cd372", "object_relation": "sha1", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611389, "uuid": "fa56c649-7bda-488c-83ac-a62a8b12aac0", "comment": "Malware payload (Rhadamanthys)", "value": "8be7871c14040bb9ef8e6408472445d9490fbf593d91182105fcabd6341ede5de5028f0565a20090089bb504b9664c44", "object_relation": "sha3-384", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611389, "uuid": "54848af8-3b87-4534-85f2-4ec94d9662bc", "value": "T153A533828F34C131CFB806B16079675725BBFC348B6292E73794FE26CAB16E114B8B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611389, "uuid": "ef823e76-7178-4f70-b310-f3e32d641f57", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611389, "uuid": "a4ba12fb-bde6-4777-ac25-dcb6604ca18a", "value": "24576:TyyH3F5zqHvN6Cki43w/QbtLZBGkZUq6g72FNEHSw/ckNWyZ0KO4tcsNbgT3NgVB:NvkpQ3BtzLSbRNIxbgTqCEU6VKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762611389, "uuid": "2b8e6808-05d4-48db-a1a2-a7763e44bc27", "value": 2074784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762611389, "uuid": "c7168ad8-762f-4e52-9253-ac9957edaf0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611389, "uuid": "1519bd2e-92e1-4b38-8990-eb8f25359139", "value": "activate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d870c28e-bc4a-11f0-91c6-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1762569009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569009, "uuid": "04e6c2f9-1e1d-4f13-9b2f-21c5983147d5", "comment": "Malware payload (GuLoader)", "value": "0c10b7cb0b368d43b08453a7a3681a64", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569009, "uuid": "15d69897-afd6-47d3-af2e-6c50b9b2a791", "comment": "Malware payload (GuLoader)", "value": "5ab88a2bb3e22d24ab925725bab87d58969d40e0335c309a8c88869f1bebdb18", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569009, "uuid": "c7eb5f08-969c-4477-a2cc-538a782bd9e1", "comment": "Malware payload (GuLoader)", "value": "2482342b212f5cabe450b5e9af0fdaa9f3a339a2", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569009, "uuid": "a89d6c42-893a-48a2-8866-93e74d3ce34b", "comment": "Malware payload (GuLoader)", "value": "9c8660a4b73f59547c018600a049fbe91fe77f6b1b1afca3297eb10756d537d08fec1f9d3f5cc63ddea19610ab92ce5a", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569009, "uuid": "b3c80a02-bfa9-4636-a27b-873dfa2c4453", "value": "T1E6E4232B37B33D1412A28C8639E8E4C164FEB49D346E1F64FD8A9A0E931C77E5E44352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569009, "uuid": "9e1f158a-be86-4fbf-a071-c54c713d97eb", "value": "12288:MkcFGOVW9JKfSR+dpXtbdp2nVn1N0QEMswutkZeGeLX4uKWXY0uG5:M9pVsJKqRspdv2nVnkQX/utkYGeLXQW9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762569009, "uuid": "9e29e5b8-ffc9-4033-bffd-43cbaa23f58d", "value": 662863, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762569009, "uuid": "62055974-fd9b-4332-aebe-297535c2b6be", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569009, "uuid": "9fb30679-1ce4-4366-9394-579e56945032", "value": "Nueva orden -202505055, 202505056, 202505075, 202505058.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa34764-bc6f-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762584635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584635, "uuid": "d6f475f0-24c8-4fba-b667-b90ab64647e0", "comment": "Malware payload", "value": "25bbcbd1b9cbc023b8201348d9b41e22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584635, "uuid": "346ea65e-cd42-4506-99ef-d39ff28b52e9", "comment": "Malware payload", "value": "5b349f43df936e5281a344781032642fd93d53ca6525690f550e96fcb12c325c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584635, "uuid": "6f53a94a-6dc6-4fd8-ad54-e51f58a287b6", "comment": "Malware payload", "value": "25e7363c7d461e00e1ba02e2a11214be96c22822", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584635, "uuid": "7440634f-4c2e-469a-b0ac-0fd23baeaf65", "comment": "Malware payload", "value": "e395ed8986563c12c4163602c2023de6063fe8cddd34fd7e28a529c39ab5c362938252a65e4a582cfcd19d586cc1ac18", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584635, "uuid": "58205075-6caf-4bfa-8c20-9cf3c3aef042", "value": "T144A3825E7A218F7DF6B8C73497FB1B34A77922CA2A91C580D1ACD5012E2434D981FF68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584635, "uuid": "20aa2dc7-a66b-4b10-8aa1-7769110bf2a8", "value": "1536:fmdurU07J8MtqHxqGPkncW/RVi/wJz8H6xVRFOr4kpKmHIH:fma7JLqHxcncWZViTH6xVRFORKmHo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762584635, "uuid": "c1101dd8-e779-45d0-a92c-b0d99670f109", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762584635, "uuid": "60ab6e75-0908-463b-8903-ad943afa2682", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584635, "uuid": "e8b0c749-d616-4a68-ba8f-4e88375596c6", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "315f9a69-bcd2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762627140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627140, "uuid": "593522c3-a132-442a-8f0c-1b0ad241c0e4", "comment": "Malware payload", "value": "1efaae5c5b9c761f38fe3028fd5a107e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627140, "uuid": "6bbf6704-a2b5-44f6-9279-39d26ad70af3", "comment": "Malware payload", "value": "5b5d30ce0854edba215c967e9845f034e1f35be2b1c72552e27eea2509590bb7", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627140, "uuid": "40321728-e6ac-4993-9b8a-d2980d8ab3ac", "comment": "Malware payload", "value": "b121fbddbcdb30ed1aeb854e43f091a011459683", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627140, "uuid": "b4a86b79-588d-4aa7-88e2-de26fa04fe70", "comment": "Malware payload", "value": "a3be8955e8e22703f485bd6c876d0293b7d411535b12312c88401098ba8720ad0efb088b6b59982946ff3ff21d1ed867", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627140, "uuid": "0c77b799-861b-4c66-abf6-b3ee134fc350", "value": "T1C541AFCA016A5134EC99D4AA22B7481C678A58EB4ACB1F7EEDD874F7804CC147DC3642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627140, "uuid": "865d8b2a-ca27-436b-af7c-21c3d6facecd", "value": "48:N5sX5lnh55R5jzJ52L50b5875Th5t554Qv:NEBBPKk8n1Dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762627140, "uuid": "77630842-d9d1-4d5a-9424-9b233834ebba", "value": 2142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762627140, "uuid": "1bff1c7e-6411-42bf-9fec-b53c33fc7235", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627140, "uuid": "ce22954e-d1b2-4587-9740-72962951a290", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d91da6a-bca6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608209, "uuid": "34de780c-bc10-4f4a-9c04-a8515d6ec138", "comment": "Malware payload (Mirai)", "value": "ad525f3f07749a6a1ed5e9be402a955e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608209, "uuid": "6e5fc864-8c9c-4a49-9bca-42d93c5635a5", "comment": "Malware payload (Mirai)", "value": "5c37784f81072aceb208d20934a76db021d8c3482ab6da864e4c58fee53eb0c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608209, "uuid": "54ae6158-dfe8-4715-8913-54685f81c5f4", "comment": "Malware payload (Mirai)", "value": "6cfce30b54a470bc2fb11d4aef2e195d24cf9cba", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608209, "uuid": "7da581d3-324a-4d07-b665-508616dc3603", "comment": "Malware payload (Mirai)", "value": "c2187dc374c734bae207d1e0239a9e4dd750dca40e73fac35887aca0c3f3d671276e409f3d1b18c9decb73cbd4edfcaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608209, "uuid": "77400214-a7a7-4837-bbcd-6a425d459d8a", "value": "T1C1B3D64E7F329F7CFBA8C23447B35A21A65923D227E1DA85D19CD6011E7024E681FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608209, "uuid": "ab915051-684e-4160-800f-8bb139310a20", "value": "1536:SkUa7xt8FyhmfAtOhNE6evz6qPt9/vEXSiy7APk2PK6e/BdHZyNZ:sa7xRwI2E6eL6qPt93EXSiy7OkAKBZyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608209, "uuid": "2f7f3f83-afe4-43f6-92d1-546d9e7e6766", "value": 109760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608209, "uuid": "28acffb8-5960-4683-ae3d-9bec7f537874", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608209, "uuid": "3835fe5a-93b8-4faf-95c1-5b11dd9b4deb", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b9c1c4-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (StrelaStealer)", "timestamp": 1762588890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588890, "uuid": "de5d6eba-515d-4a0c-85b2-2d9a81c3adab", "comment": "Malware payload (StrelaStealer)", "value": "00889910b59f7d1dc6e7a00ab95b77f6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588890, "uuid": "1a6f47b3-37dd-449b-9e4f-e6e2af6b44c7", "comment": "Malware payload (StrelaStealer)", "value": "5def8cb991ee28ee39148751461c1c521b408271a7363a067346db6e1799f2b5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588890, "uuid": "137e4213-7681-40f9-a4f3-dc1607bbd733", "comment": "Malware payload (StrelaStealer)", "value": "37021d7512104cc6c6c8320b2d936de6a297c5d1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588890, "uuid": "bd2e600a-009c-4a63-9c5c-c6631f8df568", "comment": "Malware payload (StrelaStealer)", "value": "f55c309ffc37757bbab1a3a227c305af28b27e07feac95786849a6c606e1c252579cd542f9a3719c486bd618a39f8ebf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "StrelaStealer", "colour": "#32F389", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588890, "uuid": "a1d880c7-a6b0-40d6-8f2f-fa6686230549", "value": "T17541CB44E41FB14FC9A33E53A513A05CADA3B09528179A253CB54CDD9F25C078A6FD37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588890, "uuid": "7f2ca655-d16b-4dbb-86d2-ac283c46bca0", "value": "48:k3QpaxmCREVgzy28/IhIjjowt+nCUVxrdhUM9hQbrdh6:raxmCREVgzyLwhIjjowt+n9VxrtE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588890, "uuid": "399e56cb-1afb-4f79-bad4-6b64e63c5772", "value": 1911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588890, "uuid": "c8599b98-a7f9-49c8-b582-cf565a2d8396", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588890, "uuid": "25aa7ee9-480a-49cf-98c1-4828a2d52fab", "value": "PO_E002594522.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf7d09e-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762588906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588906, "uuid": "ceeefa11-1dd7-486a-a0e2-c874f74a421a", "comment": "Malware payload (PhantomStealer)", "value": "755b61c336945b1e13ad22d5f5ef9c9d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588906, "uuid": "b7e4d318-4bc9-4181-94bd-7319ce8aa491", "comment": "Malware payload (PhantomStealer)", "value": "5e04a262b212562ef80301d1bb151ccc5ccf675c78e65d56c447962f6bee091d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588906, "uuid": "e632422c-57e1-4d08-86bb-8d5606876e73", "comment": "Malware payload (PhantomStealer)", "value": "f0cba9ad7ca93f15535c431b86056d2a1320ea1a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588906, "uuid": "39aba73a-4e73-4684-9f4f-7ec39631a4fa", "comment": "Malware payload (PhantomStealer)", "value": "740f097e3b5bee73fa2601e49a50000310c570f2667fc68e6ea1004e3390c1b66647b6ae00c80decec90dd9654b31f40", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588906, "uuid": "08bfb323-d9cb-46c1-9b94-9826281cf65d", "value": "T13131D2D3220A8B1AB7956175CBBEDE61C43584631929DCB3F4CF21852F362A43174AFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588906, "uuid": "ff3c9a11-d575-4760-a60a-8667bbca665a", "value": "48:kgoUsHT18hSTi5gVaG5lNe1Lg9YGd14zc7THOgw0zNml8lTH6:/DsHT18hSTi5gVailNe10OG/4zc7THO5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588906, "uuid": "6c2a455a-3428-41b0-9022-01f36c7f513c", "value": 1862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588906, "uuid": "e96d8082-90eb-4fef-a906-b95ed8ff20c6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588906, "uuid": "54fe87f2-642c-4769-afe5-930d510a089a", "value": "PO_E002594522.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdca9b2-bc93-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762600316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600316, "uuid": "dc5ae13d-58c6-4ab9-a3d0-acbeb0da0dd5", "comment": "Malware payload (Mirai)", "value": "ad2f6c2894eb141958fb45fb33994b04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600316, "uuid": "4e18a032-787c-46f0-b732-9a68fb42b62e", "comment": "Malware payload (Mirai)", "value": "5e6870bff5900c04ca65a6bf766a609ef684154f2294d6be2f257aa3e9ca0bde", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600316, "uuid": "31f93b80-3d36-4e74-8c92-0754d82f6d16", "comment": "Malware payload (Mirai)", "value": "2db203e6298dc90a1bdaa68eb3932d3b41c84f5c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600316, "uuid": "22b1f6f8-99df-4b77-9335-3873782ea949", "comment": "Malware payload (Mirai)", "value": "5c7dd96853be716bb30d1916961c65fba028fa9eef376530cefa7760fa2a6b97ccf497018ec506c0c86b1649b2b3db54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600316, "uuid": "cecc36d5-c503-41ed-929c-e95d7722b3b9", "value": "T11703F18D6452A050C477483D98BEBBCD2605D84FB695C9E28ED87A2448CDF84772C77F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600316, "uuid": "a9b618f5-a719-45df-a997-4b00f4eb1ae2", "value": "768:o83zCK+kSPH02uQlug3dIlDhX5VApj73x/MALrUx+JS6lnbcuyD7UHQRjn:o8QuQ332ldJVuNzkOSQnouy8Hyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762600316, "uuid": "321edec4-1c4e-4577-a05d-0ad8a7979665", "value": 39392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762600316, "uuid": "5b56f4c5-0708-4c81-bab2-1d3c4923f039", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600316, "uuid": "e2439f9d-72ec-4d02-8a51-1311f8c48719", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1362f870-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588865, "uuid": "3c00ab0c-889e-46f5-b8d2-ea07666bed7c", "comment": "Malware payload", "value": "1226f5d47bd91c45df3e932cdeaef711", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588865, "uuid": "c4adaf79-bf10-420f-a208-694ae186e06a", "comment": "Malware payload", "value": "5e82e46a7e466c1f668423d42355be51e99b7a99901715d122556b832ef2d7f1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588865, "uuid": "7b502cce-820d-479b-8777-c735a4fc08a7", "comment": "Malware payload", "value": "ff6906aab1e7739cb686cf6dfec2278e577d779d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588865, "uuid": "4ea1b474-a4fd-490c-be85-c2e0f96ec5ac", "comment": "Malware payload", "value": "02cb20cf2125e80e72dc828e1fb79dab20635a7f8a7d5b5e9861a790290f5fa298f78c05696a97e5be2c904ca18229e1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588865, "uuid": "b5cd094a-2e95-4c62-bca5-eb7fd66776ca", "value": "T161243B61CD7006694F0B27DAFD680A22CABCC619552620F1EAEE170D71069BCD3BD77E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588865, "uuid": "5ed976f9-ddcc-4bd6-bbbb-a0a0bdcdc4d1", "value": "6144:upc6upc6jpc6fpc3pVpJB3bp9pc8pcvpcqpc6SpcLpmpcpcPpc6LpPpcHHpj:umbXgTXBLjJkzqKwWmTZ2Ht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588865, "uuid": "04a3ebde-2ab0-4929-ad7c-88cee36969ff", "value": 223604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588865, "uuid": "195e7bd8-2d9d-4940-ab64-6c27636164b6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588865, "uuid": "87594185-384a-4e84-b45f-1d8b8a7a1709", "value": "Lepingu tingimused.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d097743-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602356, "uuid": "9712b180-3720-4054-852b-a854f2af13a1", "comment": "Malware payload (Mirai)", "value": "55156082e32efbd84bdf4bdd77a81d67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602356, "uuid": "53dcdf15-19e5-4d6f-b297-b926229bd249", "comment": "Malware payload (Mirai)", "value": "5f917f1a829c902f3aa2f8a968b33a6249926a1fd71f8a003fd24fb3e322fb36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602356, "uuid": "74f3a72e-ffd1-4351-8caf-e4b23305edfd", "comment": "Malware payload (Mirai)", "value": "9a60b06c9e4ba72d815ea142f3b41b17b5f4b71c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602356, "uuid": "832258f4-2eef-477a-b331-10aa1ad1b061", "comment": "Malware payload (Mirai)", "value": "cc5149dbc9ebd21516686da41ce127066ce221e559d0c37e63839ee8dab056de1e1a56065702863b2726dd2142f685b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602356, "uuid": "438702f4-ddd4-43e7-9541-ef4f70543c65", "value": "T14DE35D46FA818B13C4D5177ABAAF424A3322A794D3DB330799245FB43F86B5F0E63905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602356, "uuid": "bf33dcdb-3188-48f0-8223-125f928c8902", "value": "3072:fbipzQLWGgmm24PXYyBgb0Ex0R2LktGqWvghdmX9yUM/9iELUZrnK:jipzQLWGgmm2AXR7R2LktGFvbX9lM/9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602356, "uuid": "c9b6bdc3-b567-4a3b-b346-ede2482b1fe2", "value": 147890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602356, "uuid": "297f36ab-f0af-4a31-be13-10821a8bf67e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602356, "uuid": "eddf38a5-b243-4d9a-81bf-1118037b0e00", "value": "kowai.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6633db-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623510, "uuid": "6c0fdc12-996c-40ed-9048-8c6605c52a57", "comment": "Malware payload (Mirai)", "value": "21adcf2f1b78def032910b8a6c6235fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623510, "uuid": "7d0866f4-6e3b-446b-979b-8c79bfbbea7f", "comment": "Malware payload (Mirai)", "value": "5ff91709d70ee35c87b7db2d8fae8f6f3a2a4684f414e6f7fbf18eefbe85e49b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623510, "uuid": "0125680f-6c64-46c2-90f9-c48a7c6d691e", "comment": "Malware payload (Mirai)", "value": "35a8c9537c48313074826f49c251a6c6e80a4047", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623510, "uuid": "eabcb936-65e6-40bb-b247-9f4500248448", "comment": "Malware payload (Mirai)", "value": "225786ee24fa189f93605f3b9d71991ba1330c45aa06b26afe11c654e5999928691650d217778a33671bd04dc2da0f1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623510, "uuid": "9a65a1df-0d1a-407c-8892-cc7f20a2cca2", "value": "T1BEF31B42F8418F16C5D211BAFA1D128E37131BB8E3DF7212AD245F607B8A96F0E3B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623510, "uuid": "178cd50d-ca0c-4ab3-8e62-1a93b31175f4", "value": "3072:nkGROPfU3yLPrW10QdY4uXfaNGwvO0JQByZFIVmP6hh1zmJ:n3RgfU3yLPrWquMXfaEwvTZFIVm+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623510, "uuid": "7ebf927a-d020-4e22-86aa-6f3f8d9dd4eb", "value": 170940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623510, "uuid": "4f55ac75-4468-4af1-942e-53c931135ffa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623510, "uuid": "dbac5623-73ba-4ba8-85b3-e57fcc7e9e1c", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80710e48-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602362, "uuid": "22ede6ac-e438-4803-9260-1d42a1720708", "comment": "Malware payload (Mirai)", "value": "09f770360b5fab0ec539a989ebdddc4f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602362, "uuid": "c6de1de3-979f-48bd-9ca1-565871c379a5", "comment": "Malware payload (Mirai)", "value": "6065a1badd5314a83bfc7ae6ceb79931d14640c7992fd26e7c8433ca8c8fee09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602362, "uuid": "7e18215c-b804-4263-a550-a137baabc1f9", "comment": "Malware payload (Mirai)", "value": "ab23ac5ff60fa0b72b793e3d8830c09e811a063d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602362, "uuid": "e26cddfb-2057-453e-a86c-9db064bf28e4", "comment": "Malware payload (Mirai)", "value": "43f362165f196e62bfacee290ed65cc7c22985ab45dc918f9a671fa7fb68f45c82d1bab5acdf6f31fdfcc73f01d5bd4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602362, "uuid": "fc629069-5e18-4465-ac3e-120c807c140c", "value": "T1BD73F819BF610F77EC6BCC370AA92B0529CC954B22E57B367934C528B60B61B19E3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602362, "uuid": "6d900142-125c-46e7-a413-f5c74fa8a85e", "value": "1536:7J5dbFB4x92nKoIFa98M26ofWU+UZ9CYXzdJa10N:7J5dxBu9uKoAIUXd4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602362, "uuid": "32c714f1-6baa-4fdd-8cae-20f738cdb1b9", "value": 77320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602362, "uuid": "f1521f2b-24d2-4010-83e8-843da45e25ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602362, "uuid": "1911d97f-2909-4ab6-b261-6b5e8f6f4227", "value": "uYtea.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779ec620-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602347, "uuid": "ee87daed-eb6a-49e6-b1c5-600177af08a5", "comment": "Malware payload (Mirai)", "value": "11b8ce517f703b402f56fc7d22268892", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602347, "uuid": "fcd82329-07c8-4059-b4df-964454c84911", "comment": "Malware payload (Mirai)", "value": "60ec2cda4ccad3471690fc0564ea1a57764d2beb3ec590f40b2358dd9675eafd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602347, "uuid": "8cd8f748-ed47-46ef-bb59-e1624aeca283", "comment": "Malware payload (Mirai)", "value": "c282d35e1e852e609ef9f07af894bf97beb73c31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602347, "uuid": "b1676407-249b-498f-80c3-0505affba385", "comment": "Malware payload (Mirai)", "value": "454400637f1462caa30d1362b9703813965d2299837797c9f50239cbc28f10e9db2fd053b8f2536a680da9d1e11a4023", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602347, "uuid": "d9526e40-fb39-4a6b-b650-e6cdb0887122", "value": "T1FF434AC4F143E9F5E84301741026EF37AF72F2EA115CDD93D3A9EA226C92A12E446D8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602347, "uuid": "76ac4de1-7d2d-4a45-8f68-76b055dc5492", "value": "768:FmnthEsW5qnF15RY1dhPe7oXTmcxDj5gk9vWnTI4eBH+4sToQLDLFv:Yn/EsW5qhSh6amelWnU4GH+dNLt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602347, "uuid": "eb1f0577-061a-48eb-901b-972ec05c6435", "value": 55348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602347, "uuid": "31bbf7bb-75a1-477c-9b7d-e3f362813034", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602347, "uuid": "bf41db71-03ab-4e8c-8f45-01d48b234767", "value": "uYtea.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b060e36-bca4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762607373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607373, "uuid": "ac6bc07a-2e30-4d27-a920-8be0ca1c5465", "comment": "Malware payload (Mirai)", "value": "c98946393e66c03dd89ac57b5a208499", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607373, "uuid": "01588e2e-9e89-44b3-8b11-561c7e06ec1f", "comment": "Malware payload (Mirai)", "value": "610b997ecd67ee118157f58b297981cc35871bf3fb513e27efbbd28f94144866", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607373, "uuid": "c5115613-4edd-4d1f-b493-a3392cd98d22", "comment": "Malware payload (Mirai)", "value": "f0374ec91fbf97b6171c0531244994c319a82922", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607373, "uuid": "af914395-202c-41fe-9b01-d2f4ae122d5a", "comment": "Malware payload (Mirai)", "value": "272bbe2a268a44be004f15f2286651ce931b909b8de9c3dfc83ca5f64f4f0b68dbbe3a8a14de88e1bed87191c7512a4b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607373, "uuid": "5bc40497-585b-491b-a10a-69ba36824a55", "value": "T156737EC1E653D8F9E9560AB01136BB338733F539502DF6A7C794AB73A883A40D61639C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607373, "uuid": "27bee157-18d0-4d23-bd3a-059e9cc43464", "value": "1536:+LaR4V8RpYB6T/2ZV13rrAJ0gDLbzA3vUHbdB4VopSyCGK3SH1Stgk3Tj6vkld:+LaR4V8RpYB6T/2ZV17sJ0gPHA3vUHfc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762607373, "uuid": "bf9d70ee-5cab-4ca7-9fba-7f09f8817b5b", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762607373, "uuid": "f22c0b80-a8a0-404c-ac48-de8a7363277f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607373, "uuid": "309c69bf-34c4-4de2-9d61-62d1aa7ade82", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a574e0d-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602352, "uuid": "f423e1ae-48ec-4c4d-847f-22797fbdb9c3", "comment": "Malware payload (Mirai)", "value": "ff85c1f37037f1c427431513fb34ea98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602352, "uuid": "9a4164a9-5619-4820-92e4-b2886faff55a", "comment": "Malware payload (Mirai)", "value": "613259fe6f4eab9e3f5d64b3f2781c9429104c2ddc3cd259274a1da74bf77e7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602352, "uuid": "6a32b797-57ff-45bb-b9fe-23f9f892f550", "comment": "Malware payload (Mirai)", "value": "b5466456620d36d6651cda4ff0509d92133cd24d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602352, "uuid": "f35d518f-0a28-479b-beb8-51bec7aec843", "comment": "Malware payload (Mirai)", "value": "1b83ed6ddcdba658c11d64307ed6c824058a7249c45e36b928358cbb126801bd49e90fcbf5b959482a0336f9a4c5740f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602352, "uuid": "f669cd28-878b-4080-b032-ae32b9a02164", "value": "T1AB438EB4E42A9D54C0850174A8748F750FA3F2C883621DF73BAA46B1540BEB9F60DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602352, "uuid": "71d4075e-df7d-45d7-8027-e192c4d979b2", "value": "768:f3Dm+BLr3pN3b3xMmWQZ7YnYhJ2wGQDmhMOfYA1eCHo1Y4dbC2WwJZY10U:bm+JDpP/Z7VrGQDnA1eb1dbC2PJa10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602352, "uuid": "c9510b71-0409-4780-aba4-bb2fda68e2e1", "value": 55568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602352, "uuid": "8872a234-3bf5-4920-ae17-2ae2e048592b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602352, "uuid": "3073f8a8-a000-4fae-9708-c9e19e991cba", "value": "uYtea.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c45ec51-bcc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621951, "uuid": "7e6221f0-336f-43ee-b84a-b5a55969bbe4", "comment": "Malware payload (Mirai)", "value": "95eb3327b116bd5e18213466cb9efa4e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621951, "uuid": "ba7c4bb5-0f11-43c3-b057-d698552d8211", "comment": "Malware payload (Mirai)", "value": "61841a04d571923ac29349183eac85834c3975a3bad27b525a4156d3c1e364e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621951, "uuid": "c0ed3f66-a502-48a0-bc0c-04b90619babd", "comment": "Malware payload (Mirai)", "value": "f1801be8f03172d5817979d2e2ec53ef3576beb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621951, "uuid": "f62d5109-bce2-464f-870f-96889ded5bde", "comment": "Malware payload (Mirai)", "value": "c92c3d753721016d1c15f1760f2233dfdc0e1a8a371cae340f80aea4ef7d788003c2211d6144ae0ba77836e61933d5b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621951, "uuid": "c31a5e6f-c43d-42f6-937a-af167f737dbf", "value": "T13DD34B46EB808E13C4D5177ABAAF41493322E754D3DB730699185FB43F86BAF0E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621951, "uuid": "207510fc-229d-43a0-a977-25e1c0c5be03", "value": "3072:ho9lg+zhz3sJu1NHLL8XmiC/glLCZToHHlOM/9d0Yj:W9lgahz3sE1lcmiC/g1CqHHcM/9mYj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621951, "uuid": "607a3603-5412-4813-b690-af7e9438893a", "value": 131898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621951, "uuid": "2b6dc9c3-34b9-4a05-8832-847eed9ff9bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621951, "uuid": "e3bd901c-46b2-495a-96cf-f9cf93f6bdb9", "value": "jew.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bb1a30a-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602354, "uuid": "3a24118b-c934-4fbb-bca5-c65a89db2975", "comment": "Malware payload (Mirai)", "value": "49b6b819d5a252b3e75bbe6d035237f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602354, "uuid": "b19a9b38-595f-43ad-b895-dd6d09f19899", "comment": "Malware payload (Mirai)", "value": "61cb5f6a330f80275906faa7a32ac5a88105d34fccd139c545ca5551cdf28bd8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602354, "uuid": "a3118aec-1788-4325-8ffe-debc10035790", "comment": "Malware payload (Mirai)", "value": "40539c1600530bf39ffcb6962c02cfc581f5f252", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602354, "uuid": "47f5eff2-26dc-4f5a-a89f-1784236b8b0e", "comment": "Malware payload (Mirai)", "value": "357ceab11f03c26ead2046f016a03476a587874dae0919d7f7f02b34c561855ef49e364778ac0713065dbfcb8db9019d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602354, "uuid": "ef376c55-f5cc-4bcd-ad2e-ce73e17b1a74", "value": "T140431917F94685FDC089C234177EBA3AE92331FE1229B26A67D4FB263DC6D611E09D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602354, "uuid": "d9c17081-d4b7-4d01-87b8-60c197abc0a8", "value": "1536:1XIY73si3qEToSRhINKQ/K6C8u50pfEHwNLW:2Y7H6ETRhIv/Kn5qEHw1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602354, "uuid": "2dbf03ad-65ba-4312-8035-76dbee2a7733", "value": 58480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602354, "uuid": "df2f7bb3-57dc-41c5-97fa-c59ee33353bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602354, "uuid": "1ff231d8-2290-40cb-947d-430068fd1c0d", "value": "uYtea.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05216c6b-bcb4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762614181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614181, "uuid": "dccf12a5-9110-40d6-b4ea-215b85a069fa", "comment": "Malware payload", "value": "4255b2303034c230ee628e9346d59d36", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614181, "uuid": "6abf1038-1b30-450c-aa3e-572d50c49794", "comment": "Malware payload", "value": "62f5b3d718f71f39efc6615a5c0999825dd5c4714806793a87730ca557f777e3", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614181, "uuid": "40deece9-7c81-4c24-898f-4c58b071d805", "comment": "Malware payload", "value": "11271c7fa012da0b20166b497e8ebbef17fc0a44", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614181, "uuid": "30b8181a-f922-451e-b364-c357d6554e1e", "comment": "Malware payload", "value": "79c86d084501ac12015dfc4cba398f27fb33b72d5ee123a7731c8254365e678c0ab7796dc9a79fad6ade7e0127116e4b", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614181, "uuid": "188affbd-d4f0-4cc6-9810-34be4762dc66", "value": "T1F35733F2CA918F93D9BBC53AC87C5D2F45666D448A43583331AB33B155F7F90A1BA028", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614181, "uuid": "575d0a3b-5312-4687-8827-a1b8c2437baa", "value": "786432:ahfK4+dcQQ52Jnd1Xflijc/9kZ+B3LMpm5vZ:kK4kQ52JnvlijcWZ+ViSR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762614181, "uuid": "48771d7a-f908-4061-a934-2cdb76474086", "value": 27750400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762614181, "uuid": "8428bc69-167f-41b5-be1f-5956a8044f90", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614181, "uuid": "57c5833d-dc5e-4fcf-b30c-405118ffa1a5", "value": "PS_2.9.0.11.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4885035-bcb3-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1762614153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614153, "uuid": "4e872bad-6984-4c50-bf4b-2be6cffcdf89", "comment": "Malware payload (SalatStealer)", "value": "883e7b63e22442664da7040ee3e284b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614153, "uuid": "fe9f9424-76f2-46bc-bbba-3438bc677b53", "comment": "Malware payload (SalatStealer)", "value": "64295bfea8802b57a314984aa64c52253ec3822625caaa8027b1d30deb02f5aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614153, "uuid": "b5d1ca67-285a-4313-81ac-f3de47809d34", "comment": "Malware payload (SalatStealer)", "value": "00236bbd0a1971342af5e2ae4574ae877e3b219c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614153, "uuid": "94ea609f-243c-4fb6-b667-8d0ad17b1fe3", "comment": "Malware payload (SalatStealer)", "value": "d62db626538d3a4a4a07172e188f3d1143a33a8fa53ed20649cdc9995519567fc887697fc6686138b56635896f2da321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614153, "uuid": "4d1ee04b-ac8f-4841-be14-3b76d7b15f9b", "value": "T110F53314C23E39E1FE0FD8F156C28205266688C75D390FBE4EDDD0A91FBB89672166E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614153, "uuid": "44435c81-8a84-4a1c-845e-d2bc1169aedf", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614153, "uuid": "07857a9a-5891-49cb-98b7-e940200dcd44", "value": "98304:ceQJF2AuIvsme9vxO5vh2HLal41R/Nwhp0:ceQL9cLEsSj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762614153, "uuid": "b8a9eb58-e0a8-41e7-ba44-7f5a251b8df6", "value": 3552256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762614153, "uuid": "b7e03f5d-fc21-4531-8baa-86f432ea8be2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614153, "uuid": "51d1b347-567a-49fa-aedc-721d54fd82b0", "value": "ExtremeInjector 3.7.3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b910fa9-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602220, "uuid": "28807e70-4aa3-4d2e-898f-7ac9133fef04", "comment": "Malware payload (Mirai)", "value": "b7ca0bc85bfd1ddc00e5c56e2c072a90", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602220, "uuid": "82fe12fd-4834-4eef-baca-a0303ecab4ce", "comment": "Malware payload (Mirai)", "value": "643ccebfdacf6019e4ece7d787bcc4a99642c071a5f405da5e414d26850cdee2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602220, "uuid": "44b41944-773b-4bf9-b769-4c64a4e9aaca", "comment": "Malware payload (Mirai)", "value": "28c683bc0cbaac9607ffae708b8d60b306dfe4d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602220, "uuid": "19d475c9-71ea-41a1-9299-997e0d40cea1", "comment": "Malware payload (Mirai)", "value": "0c3154223f40c71245fc6d006b8372cb3ebafe3c9ae186e6b4f2b4d098cfbda6a1f69bc08f089cf5fe1fa7c14b7a0910", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602220, "uuid": "1ac83694-8f6b-4a50-8f08-093a9a52af07", "value": "T1A47301042499E110FF110776C8A918CD8441A9D5D0EEB1EF312A5E29D9CF9A32DBFE97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602220, "uuid": "68ddf10c-edda-44ab-8b00-226abe5fe179", "value": "1536:6r8IHq+kgs7VI83wgrzlEFSPO/hcoiisjuq5Z14CRRDgGLtBcGXUqh9+sadEO3dI:ZIHq+kOQwgrBEEO/h7iF6q5v4qTL05D6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602220, "uuid": "0c2390bb-787a-401d-87a9-23b455b8e872", "value": 77272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602220, "uuid": "69382089-eaaa-4c40-9caf-f6bbdfb44375", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602220, "uuid": "c68679e2-230f-428a-9333-b52f13a7e04b", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53838362-bca2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762606582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606582, "uuid": "7badb512-ae6a-4293-b920-128c290a7522", "comment": "Malware payload (Mirai)", "value": "2e33c70bd54aa831cf62ff24108a6350", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606582, "uuid": "32e1082c-ee4b-47dc-ac6c-f07f2e538bea", "comment": "Malware payload (Mirai)", "value": "660850a4cebc5b821678ed6cd92f855593d13c22d1c7e02bdc164ea9214e66fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606582, "uuid": "d0d1e36c-46f0-442c-b5e4-d37380da80ff", "comment": "Malware payload (Mirai)", "value": "68c5c67fc5c03ae574b302d2bced80855d2c0737", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606582, "uuid": "2af1a713-a037-4ccc-b0be-f95c0b941740", "comment": "Malware payload (Mirai)", "value": "795bd63cba78bab0b7c905cf978cd7811946d8999d5becc9bf54a87e8177d4e414c3a6323a386edd91e86f51c953f882", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606582, "uuid": "de1c53a3-4872-42cd-840c-9ea98d202378", "value": "T1038329917D416622C6E1237AFB2E428D332653A8D2EF721BDD226F107BC691B0E77741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606582, "uuid": "5afd9f36-7259-472c-a292-3162b96c880e", "value": "1536:HvHqDgv7rYunj7cMaXC3TGzBy26vHpvqv2+jh1hbmDeVctFZ7TVO1aAqaUkAocKL:HvHvMKPBOoTn26x8jhrCiVctTHAzAo50", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606582, "uuid": "da8c838c-1f66-426c-b054-d77dd1a71d12", "value": 83564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606582, "uuid": "b595a2b1-03a1-4584-aeb4-ead1888d040d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606582, "uuid": "d527ca4a-2334-4d30-9942-270bd90b9dc9", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc6c595-bcb3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1762614011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614011, "uuid": "8dce45bf-eb74-43c8-97ae-7048fb9ee27e", "comment": "Malware payload (Adware.Generic)", "value": "b1bb24fd382c19d80f847195051c9f09", "object_relation": "md5", "Tag": [ { "name": "91-92-240-18", "colour": "#B85A5C", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614011, "uuid": "9c01dc6b-02dc-4376-8487-5c1cba052422", "comment": "Malware payload (Adware.Generic)", "value": "6646da7b7bb6a3b622cdf7e59c321ced493423c23a5f13a0d826792ed8463886", "object_relation": "sha256", "Tag": [ { "name": "91-92-240-18", "colour": "#B85A5C", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614011, "uuid": "0d8d9ba1-f44a-4aef-abe1-27f621cc9839", "comment": "Malware payload (Adware.Generic)", "value": "89c6faea45e82742011eb27230d785e1376566ac", "object_relation": "sha1", "Tag": [ { "name": "91-92-240-18", "colour": "#B85A5C", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614011, "uuid": "d848dbed-780e-465c-8727-6af1f9171658", "comment": "Malware payload (Adware.Generic)", "value": "d41d6beb636df5f217af44be14e42a9d4b0e08a0c3e4a1a8439ba6d7a13729f6638797ff1ab0c44301075f0fe364894d", "object_relation": "sha3-384", "Tag": [ { "name": "91-92-240-18", "colour": "#B85A5C", "exportable": true, "hide_tag": false }, { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614011, "uuid": "876fa3ac-7a9d-425f-9787-e75c8b5d2559", "value": "T11C0833C89E4C624BB7A1635B9053BC25C01FD8F6822BEE3B07F41083DAD96771A359B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614011, "uuid": "b4071a48-fd90-4f56-a238-7cd32052040a", "value": "1572864:jeQH0BNyPPhHzWDcQt47FPr0NT9x3iRhqKXQgBKDWjuQtues:eyBHKDcQ+Br4mLXTBKiL0es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762614011, "uuid": "0ec74cf4-7361-4437-9b6a-1204931826e5", "value": 79136270, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762614011, "uuid": "4543a16c-2fe8-4aa3-a662-2852d7b09221", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614011, "uuid": "aa1f7a46-2a45-4b92-9ff1-b68653838126", "value": "Lic\u0435nce.L\u043ead\u0435r(\u0420A$S.- 2025).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2167dd91-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620671, "uuid": "2cf8da4a-7b02-471a-b9e8-f9c0b75a4e97", "comment": "Malware payload", "value": "ca6a17ad4f3fe80912424371d8e67448", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620671, "uuid": "47acde31-af37-49c5-8aed-4995d0a7d5b2", "comment": "Malware payload", "value": "66bfeec31ae784a09287c77924136fdf4308b3bf34757fadae49420961b7ca35", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620671, "uuid": "95d35832-ef52-4cf2-9d10-29fac793b111", "comment": "Malware payload", "value": "4304d57ba82476de273b80d2c75c7ef8ff59b38d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620671, "uuid": "12314b12-9dc5-4dac-a7de-bbc9d6de4685", "comment": "Malware payload", "value": "72fd5ddec55f15d0f6f93c2bcc6e7581b106bc2d0a426c616690fd8dd2ff6339aaae0a70db235dad3c54100fe6268a01", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620671, "uuid": "d2346dc3-3df7-48df-91df-bfbf33e084e5", "value": "T1DBC33A3A0968597DEC972BF37A256C2E18BE160782605A1FD52BD05C4F2272CD3FA2C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620671, "uuid": "4326287f-7a30-4576-8649-557bbe4923af", "value": "3072:Cro3EZB41fGA1sgN38fkLQoaB1lR9OQtK7agIGHr2iSKf57s:CrUEZCQA1s838fkkoaflR9OQM7ag/qig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620671, "uuid": "33e329e9-1843-422b-9d20-d02c3d4030a0", "value": 119087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620671, "uuid": "9caa752e-1bfa-4298-8438-95f3ff4965b0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620671, "uuid": "7337eac2-074c-4780-8757-441f06fc2db7", "value": "PAGO_039384_JPEG.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc39ae08-bcd8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762629950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629950, "uuid": "e7fca37e-4b10-4cd7-8f5e-0cd6d5a0901f", "comment": "Malware payload (Mirai)", "value": "dcd62c0b37670d624666fb706968b768", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629950, "uuid": "c8272565-3103-4a81-b2f7-372dcf09e8fe", "comment": "Malware payload (Mirai)", "value": "678e839b27ccd1ecdf9e469eae783d25494146b92261834286589929d1757ffa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629950, "uuid": "f04b5691-2fae-4fdd-84ed-083cbfc01412", "comment": "Malware payload (Mirai)", "value": "e0b347078ced17f64e3b718059d749187b2a5e7e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629950, "uuid": "98ea67b4-a486-420e-b9b7-6e7ab6bc5d34", "comment": "Malware payload (Mirai)", "value": "1c86c419560a3e376ee589276ea69f90c66f063efafb4d1f911484d6df32935fecbaa23bb66aaf6a79990ec402f9dda9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629950, "uuid": "391801fb-0631-4985-b201-4afec2f26469", "value": "T16603F1B9FC85DA93DBBC3DF418C2E6D93FD28D55237B4DD257882B820A060612B98CD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629950, "uuid": "422d00e1-e54d-4ff2-87f9-6b8ab281f338", "value": "768:z0fFWT5+Av7VhCeK8qz6AqWLdE5idgdD0t3f5e94cHL8cYCDoGuiboJiE0R+DHKK:yE+Aj3CYa6AqfMdIG5r6L8lliWi+HKMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762629950, "uuid": "0af1e8cb-02cf-4e35-9fba-ca3a4bcbcb91", "value": 41072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762629950, "uuid": "732bd9d2-1429-4c48-9ffc-a66aa8cd24e1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629950, "uuid": "e205d509-22ca-4657-b3d1-cecb303d3b35", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f84979-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602349, "uuid": "c5cef71e-1707-45e5-9edc-00f465284e52", "comment": "Malware payload (Mirai)", "value": "a34bec520c46e5fc67fcd292fa929a4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602349, "uuid": "dfd8638f-46a7-4d6c-8a06-653f72574070", "comment": "Malware payload (Mirai)", "value": "6846aa1e9388b89f017847b83e526fbab01d6610d86fc715c60da999c8bda75a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602349, "uuid": "3a1f41cf-cbe4-4e78-962b-5d655f8e19c7", "comment": "Malware payload (Mirai)", "value": "b7268fddb5d2134326e6a0f5d2b303fa9528796a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602349, "uuid": "8f1775de-911d-4705-9b51-cb38aaf6d615", "comment": "Malware payload (Mirai)", "value": "d0e536e51f154ae4f4378d2785b6681ea8ab7d095055c2f2123a977aebdae224989fb07761cb4aa866b45c54f92486db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602349, "uuid": "e621bf3c-c223-4bcc-bd73-569d4eff58ff", "value": "T109634B95B4029F7CF98BD5B9541A4E09BA3113C647930F2BA6A7FCE3EDF30586A02D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602349, "uuid": "ce1baa7d-0ad1-411f-a1b1-f928051cef4a", "value": "1536:G6+YXypFvZqgPEaRgpxEoxF98ThrkHGGNYvrAqI3TdG:G6+YXkBZ/ca0xJjswHGGSA98", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602349, "uuid": "31295d35-66b1-42d6-9276-ad1f65839c31", "value": 72340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602349, "uuid": "4b3b3f97-d7db-445f-b127-e42d3113b5a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602349, "uuid": "c7e70c7a-d14d-4eca-acfa-0023ad87ac95", "value": "kowai.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7084892e-bc9e-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762604912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604912, "uuid": "69985204-58a1-4409-b86b-22ae73e8bbf8", "comment": "Malware payload", "value": "b30ccaa2c0249044d812f488ec4d820b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604912, "uuid": "2625366b-0824-4792-976f-8847e560d51e", "comment": "Malware payload", "value": "68502078e46121431d632e3f1f7370cc3cc731893c8af253b07342d69ca9888e", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604912, "uuid": "3622c511-cbcd-4dda-add7-49c6ad2b0246", "comment": "Malware payload", "value": "b590edfec38fdaf91454bfd8bbf2d925a362cc3c", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604912, "uuid": "bbe6841d-9606-4f5a-87b2-46a289f9ae1e", "comment": "Malware payload", "value": "62341ab606b55ba974617cd2bf758caca055bad662de1e1feb20afb177ce6111c5dfe0623aa544659a0ea8060c64a4fb", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604912, "uuid": "05dae26b-ab5f-4b30-9820-7cb2c6b9d1f2", "value": "T10DA5D01973A4C19DFFABE1B6CA22C60AD7B178450637861F01A45BB67F337716A1E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604912, "uuid": "d00cb663-92b2-4319-b038-bf4fe83f2a10", "value": "6c9794990dcbb89d798ebf671bb8138f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604912, "uuid": "478c7325-2549-4cfc-85ec-1fbbe6b347ba", "value": "49152:p2EYTb8atv1orq+pEiSDTj1VyvBaeyWgLQiGOKGL3OonDUWKgXk:oXbIrqniOz3vDLk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762604912, "uuid": "0c66efbd-d762-4106-9827-14fe5b1bbe20", "value": 2129920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762604912, "uuid": "206e8ae0-9b7d-45ca-b2c9-03a85d13a73a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604912, "uuid": "28affcc1-763a-45c8-8689-6628096e06ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2766eeb3-bc6a-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762582456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582456, "uuid": "dc75b920-3f68-47c7-83de-37ca72329364", "comment": "Malware payload", "value": "506efa0ca128b2f6738a70a9aa45812b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582456, "uuid": "a1d5b01f-53bf-4d47-b56c-ad0b7a98bc14", "comment": "Malware payload", "value": "689646b26069f32f988b48d7c241eb987fc0cedd606bbab03780603faf6ecb60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582456, "uuid": "2ed94e5d-2f8a-4e0f-be5f-7779de87c1b2", "comment": "Malware payload", "value": "63b463d664faeb2f1886796a0880daca166328e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582456, "uuid": "0fba080a-8b15-40cb-b694-fbce77d0c952", "comment": "Malware payload", "value": "f005f27561ec2f33dc4ba000f438ea3bd15aacedfd30e426ad30161c2ada602a38251eb3ba6fa22332774f94c9087179", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582456, "uuid": "a167ebfb-bff3-4289-9584-96088c6daf65", "value": "T1CFC2E09FE9B17449CD2D287E606E3E388DA2705963AB0B9C8341454C7D3E8AAF48C0F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582456, "uuid": "6c8d8e44-6315-4be9-8535-dd3aed63c284", "value": "768:ljZo8zHHgqOB8U4CCIEiUZJOXAcGkg9mYWc:lVFTQ8RbiIOX9Gkgki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762582456, "uuid": "27d3a018-18a3-44e4-ac29-0f12ad90a746", "value": 27540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762582456, "uuid": "4bf11b8b-1112-48a5-8e27-3639639392df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582456, "uuid": "dd3b0500-d33c-4749-b696-6f23aec47cd6", "value": "wewe3.johnsmith", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac0703b-bc9c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762604044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604044, "uuid": "f49ae943-7f0c-4617-b2c7-0643cf023c03", "comment": "Malware payload (Mirai)", "value": "099202b70370e215a964a10c5343392e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604044, "uuid": "557d0475-724b-4368-87ee-8d7c13c1abd3", "comment": "Malware payload (Mirai)", "value": "68e2a2e74bf15a8d23771a202f1f910aa2f9381eff93f4819c22ab859ddb8388", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604044, "uuid": "b9328720-76f3-4f54-bedc-67d91f891283", "comment": "Malware payload (Mirai)", "value": "d8a6c2cddfced743da2689e4b7cdec91d72246fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604044, "uuid": "4841a2e2-ab1d-452e-86a1-ae4189a1c107", "comment": "Malware payload (Mirai)", "value": "3360372ed51391a51348a0058346ba8ab0f6a9689c81774139fbcd126e169d62829c2c7eec056dd8f631aef878c06af5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604044, "uuid": "3ebc2835-c18c-4fb9-a948-8c3256ac65e4", "value": "T1FB13F1ABA32B73F3D0F1C8F46B5A9291FB075C179AD376661788A5F4DA53AC4C6004E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604044, "uuid": "bc008682-0755-4968-a036-90ef7935b316", "value": "768:T0yxTHzn2CCyMmykkiIEBVgXLVYc+OvjUB+IWjPc+FG/+KCUdwOE0x05y:4uzx7yktVgbV/7FPcB+ewSAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762604044, "uuid": "27ecc115-92e6-4d42-b57c-cb700ac89353", "value": 45420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762604044, "uuid": "85ef4389-276b-44bf-8a76-e75435acf684", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604044, "uuid": "12c88321-06f7-4146-a930-166043f147e0", "value": "executor.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790bf56d-bc95-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762601061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601061, "uuid": "23249f3f-5bf4-452c-b7e5-c332618f942a", "comment": "Malware payload (Mirai)", "value": "b4e830a41b4476a19a5ecb584dea14e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601061, "uuid": "3586d6d2-fddb-4036-adce-6213375a9b7b", "comment": "Malware payload (Mirai)", "value": "6920359391e39f67f68fd77bf6f5ed2570c70ec8bcc0b660f43f6a0f4f39ca2e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601061, "uuid": "6eebae6d-eb10-4906-9975-7e85b6aec3fb", "comment": "Malware payload (Mirai)", "value": "fb4a6daf937219c237d6e0f74c6e5e3249ffce5d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601061, "uuid": "0e4ecd4b-d4be-40aa-bae4-60799a2e7ac6", "comment": "Malware payload (Mirai)", "value": "fb93eb4bdf6e57566f02cebf7d64abcb4f9bf71a2b45c498befcc7f8a264c4394953d70b8a518bc7c8dc3e98c3cfd4bc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601061, "uuid": "9f7a2876-f54d-4f18-9cb0-c35e46f8b69e", "value": "T1FC935BC4E68FE4F6E81621352072BB379A72FD3E103DDA83C3A9963698935C0D44675E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601061, "uuid": "ecdb7119-df3e-4e75-995c-b1d291cfe174", "value": "1536:b2GTv1Vkoy+rpNe20+FPFwsYxc35yrGnmzNUU0F/oZA4nDcSIZf:fTv3DFrpkz+FdwsYxG5yrQmKUSsAXZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762601061, "uuid": "5349bdd1-e293-4f67-889b-855c9ccd4fde", "value": 91444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762601061, "uuid": "85e32d42-ebe1-46e7-8c4f-150c68a82d07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601061, "uuid": "33bce888-e8f7-4d92-ac75-2071eee90ea9", "value": "executor.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb95ef41-bca6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608501, "uuid": "87da96c2-64b9-4a89-b417-91c364cc0539", "comment": "Malware payload (Mirai)", "value": "4a44a105d528ca92c853c432dc05873f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608501, "uuid": "3b2d85cc-0d1a-4d38-9ce7-94af568603b4", "comment": "Malware payload (Mirai)", "value": "6990570b0a835bbc806fb17a01e2fd6612ed65d689c38511d074af8b94955214", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608501, "uuid": "deda7b28-4441-4f44-95d4-5709cca41de7", "comment": "Malware payload (Mirai)", "value": "50e60333a850f97c1ecc3d1309f37d75b700afa6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608501, "uuid": "b04c2720-9823-494e-be33-9c1ef0c34503", "comment": "Malware payload (Mirai)", "value": "d59a6f12cb310606bd86c7de702f86a58189b816af93e7d233c67322395f39b08bb8e60a33928a8e37440490655aca78", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608501, "uuid": "a407ef5c-fc88-4fa6-ae60-e2097ee42b8d", "value": "T1A8331881FCD2996EC6C4137AA77E258F3311B3A8D1CF3607CD586F21768661F4DAAA01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608501, "uuid": "cc7c00c4-e287-4518-956f-653c8be1dcd8", "value": "768:9ZyyN71CsoMLyqEmh+CV9fIrh5FwuMfbj89mNB7cjoAHVPnY2LHBNKnzKmzaK:9pjoqEuPGFwuMfbZcDFnY4PK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608501, "uuid": "6b8e03a6-ed29-4409-9228-924d9ca47b14", "value": 51108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608501, "uuid": "bf20e6c8-64b8-4403-83e1-337c6ef56561", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608501, "uuid": "57fc809a-02de-471c-91f7-541482832dba", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1b1331-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620425, "uuid": "4b2b6eed-7e2a-4318-8dd1-5222fdaf3ef4", "comment": "Malware payload", "value": "cf2c2018be2f3013aa4a9dc13c287699", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620425, "uuid": "1354bcc9-13b8-45fc-affe-e648564cd798", "comment": "Malware payload", "value": "69927c1d2cc64d00870c237a36c6b25d8b7c18e8666ae3709b45b20bde5a4117", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620425, "uuid": "c78491c1-db1c-406e-8bc6-8d77b9e86134", "comment": "Malware payload", "value": "0f33f3f2cd9b158c30d9537d6dc79b61ea9e6c78", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620425, "uuid": "700cf076-883e-40b8-9e68-e0c8b552105a", "comment": "Malware payload", "value": "17b6aabbbd01c4bd7bdbb4e06c0152b3eb8108f92fac3099caca1ffe708a8db534e340a834c969804f70fc90fd8c6cfc", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620425, "uuid": "d40a70fb-473d-40d2-9dc3-53968930ad1e", "value": "T1BF91220FBD0A92709033CC95593AB85DC9C2487A41684858B998C4D12E753FFE6F9AEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620425, "uuid": "e09f9057-f328-4f3d-a184-8c421bcf328a", "value": "96:x4uA45Swr3gojH6qgrKJzkQ1At3q5J/kN77YMwqqLkc:xN5Swbgd+kqAt33YDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620425, "uuid": "191fdbeb-7895-476e-8dea-de4cb3a1d1f2", "value": 4533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620425, "uuid": "972d0040-7847-4a7b-82f2-4b6e56a52fa0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620425, "uuid": "e7abd94a-1eb5-49d9-bb5e-1f42e9bafe4d", "value": "svekla.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5c1f33-bca6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608185, "uuid": "405c7d7e-df59-491b-a14a-a0e870c993bf", "comment": "Malware payload (Mirai)", "value": "553b2a3db0aff12d2022ab93111e03d3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608185, "uuid": "f01e0757-61bf-46df-81b5-3dde4298a22f", "comment": "Malware payload (Mirai)", "value": "6a78bceade236fc8a1d7e6a19aca8f3719970483b68f0914b15c81bb7e8006ee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608185, "uuid": "d50996c2-9785-4efe-b14c-ed41c467f75a", "comment": "Malware payload (Mirai)", "value": "c2e99532a3de6e78e864c8e6a7691f5283c9b9ff", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608185, "uuid": "04b94969-9245-4b19-b34e-dc575a79aa66", "comment": "Malware payload (Mirai)", "value": "fb7abb063f04e69e35d0a964f2d002ad9ff7c1bc4fafe2e6daf3d294068c563a3e3ba618fd1942127e9df3864fa62957", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608185, "uuid": "3d35daf7-9391-4307-b64a-2089a0c9662a", "value": "T13503F125085586CFD46F5078073C0790B8316F669683BD1626DDF6CADC9B6E1B42FEC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608185, "uuid": "caa05881-0308-4a54-8c0e-847e7a929a51", "value": "768:rF+xYaF57IpHNUbn23DqCxm3dnqERNCyrRpaOIQ5Un37tdgkqZJgGlzDpbuR1JV2:rF+xR/gNUbn2eCIwERAkLaOIRn3HMVJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608185, "uuid": "688acb41-b14b-41b7-9cb1-474a00556db7", "value": 41160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608185, "uuid": "b0729c52-7e7a-4f9e-9648-4b0c5db8da4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608185, "uuid": "55ac0411-8085-46ea-86c7-08ac05d300b5", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b5d711-bc8b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762596594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596594, "uuid": "dbcfb8dd-4a37-45f6-9edb-b25d14a13645", "comment": "Malware payload", "value": "ec2924d70d86d24e911202b1523c1858", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596594, "uuid": "4b85d90a-0d40-4c36-a04d-f77a9eca9884", "comment": "Malware payload", "value": "6b139dec14e03afdaa6ac51415a9d097eaddb9b7ebba5f77575404c5395ff778", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596594, "uuid": "56f829df-1e9c-42a9-afad-0a4c0725378c", "comment": "Malware payload", "value": "ae7996444c3d9dbc66c6768993a032c3ca39cc59", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596594, "uuid": "9318256e-05d5-4abf-ba78-999360f01e26", "comment": "Malware payload", "value": "ca91d86865586f419e41d4a13de8a4be39ade9ea985791aef78ea3fbbf86f83ff33df8186d47201ed6227256950a681f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596594, "uuid": "27f6ac70-99c2-4e95-b889-54baf2128d2b", "value": "T14BE4231064697428FC69773692ADB083E85CF2CD508D5ABB22CD34E005EDC7EE69DB83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596594, "uuid": "95b2b200-cb75-401b-a3e4-2068275b3f90", "value": "12288:ZpRwt2tEZ27ARFSJ/bCn3Nc851hVOuKTEvdGKEFtjJU2/fyelz3zG2L:zRwo+ZGALSJG9X3WTSdGKEr1/+2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762596594, "uuid": "91e156ca-7b30-46ce-af8b-dfecb812d448", "value": 692528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762596594, "uuid": "d5aede54-e954-48cd-bd89-5aa448086445", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596594, "uuid": "2a4e3ea4-cd70-43ff-b703-61d73312634f", "value": "ec2924d70d86d24e911202b1523c1858.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1791e4-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762620363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620363, "uuid": "576851f1-aad6-4f96-9aba-2ff7795e7c69", "comment": "Malware payload (RemcosRAT)", "value": "dbcfa189ae8dd7f15f13a17f486babf1", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620363, "uuid": "d3abd7c1-ed6f-4cb7-a53a-ad0d45c25469", "comment": "Malware payload (RemcosRAT)", "value": "6b4d83ed5491bbcda02e92fc8394fbc164ae8b021585ff6658b2eb5cbaad528e", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620363, "uuid": "37eeb952-18c5-4c72-9b57-37711b055cd6", "comment": "Malware payload (RemcosRAT)", "value": "4b8d5e899c292c4bebb78f13065c79bcf3c0031b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620363, "uuid": "de06ca52-8132-4950-94f0-78b80dccd28f", "comment": "Malware payload (RemcosRAT)", "value": "e3334a9b2c758cdcf4c148c12551caf34cf6647f4dabce42570398b587a5bef6efb35d3b8dfd25149b71bceeba0e761b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620363, "uuid": "cd0ff49c-c17f-487f-8bd9-f503b292f609", "value": "T16B1524BCFAC87CD92A6EEF9A7D521C1F079636022E602DC7415AF34697E2344C79E484", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620363, "uuid": "d4149f85-9f33-419b-9229-e381880e55fe", "value": "24576:dCog7iS2aQzbJ3xNxMOZabx2hacBAinfV:BZlaQC56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620363, "uuid": "e9a37e14-44c1-4ded-bd49-ea18af9aceaf", "value": 876419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620363, "uuid": "fd82844d-baa5-4c11-845f-d400b8db1fcc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620363, "uuid": "1e62d479-57c2-4779-ba0a-82d24490f745", "value": "SCANDOC11625.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0823ac45-bc63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762579397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579397, "uuid": "aae70085-62b4-4cc7-90da-33abd87607cf", "comment": "Malware payload (Mirai)", "value": "3eb76a7f8b10dc50328ac5b8f9fd2f1b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579397, "uuid": "6ade77c2-11bf-49b6-9049-0338c7d3aaf4", "comment": "Malware payload (Mirai)", "value": "6bbeb68909bd958c5974ce6e230e8d592f126a6d292fb5dd477a8663d4d1da0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579397, "uuid": "d2cbb140-18a6-447d-930c-106db8ae7c44", "comment": "Malware payload (Mirai)", "value": "21bed17a674ed7b4c0c5ec741df367bfd6b99c4a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579397, "uuid": "be89a655-4a27-4cc0-bdf9-bca2626a05de", "comment": "Malware payload (Mirai)", "value": "3c1f093b655f7d888798cd6dbd3272c41a9841f39e6ab4b0b5c9fa9e6f0a64f6e2d11ff63a81930b496a703ee61d38f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579397, "uuid": "f1f7686a-d748-4bc9-a117-9dc5e8afb57e", "value": "T1F1934A65BD81C612D6C065B3FB0D428D776707B8D3FEB2439D252F61638E86A0E3B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579397, "uuid": "650f6ae4-a1c4-4d7a-b0f9-f83f2a3526f6", "value": "1536:qcsyR8ofzBaJWFNlj2KYU++6twF3TUltem3:qcbRpfzBaJWF72KYVtKc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762579397, "uuid": "872da514-26ae-4c98-a605-e992d4c1524b", "value": 93164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762579397, "uuid": "5edc06ea-6058-46d5-8504-8320321a5ae8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579397, "uuid": "c9feb1d9-3ab4-4fd1-9241-2d1cbde876dc", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87318552-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762602373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602373, "uuid": "905eb66a-b89d-4a5c-88c5-79effe2b3158", "comment": "Malware payload", "value": "5b8626055f1a2432258f39bd6aa469c9", "object_relation": "md5", "Tag": [ { "name": "irc", "colour": "#760958", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602373, "uuid": "6d2b0e0d-60a7-46e0-b5ec-468488efbf1d", "comment": "Malware payload", "value": "6d1fe6ab3cd04ca5d1ab790339ee2b6577553bc042af3b7587ece0c195267c9b", "object_relation": "sha256", "Tag": [ { "name": "irc", "colour": "#760958", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602373, "uuid": "e39d5f23-3f16-4137-96f8-bbe09c5a7824", "comment": "Malware payload", "value": "7860246ba168278df0530433cd7bd09677efc8d1", "object_relation": "sha1", "Tag": [ { "name": "irc", "colour": "#760958", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602373, "uuid": "4a0ba704-f951-4d56-8817-ee7770576a75", "comment": "Malware payload", "value": "d93b624f1b5b307579443c5b4eab68b45e6b820d73a9f60c70d298bb6ba143a0ff682aa449771d80ea6f11be96e5a882", "object_relation": "sha3-384", "Tag": [ { "name": "irc", "colour": "#760958", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602373, "uuid": "e63e816c-58aa-4fc2-b533-afb8c28b7514", "value": "T101A1E750112C1AB17246697AD26FFA52B90EC81B0A7B7B358473A63C74F9DA8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602373, "uuid": "be20a2ac-c5a1-4f09-9fd7-3a74b87b2d67", "value": "96:URYZxQOBpLyxIcymLKY8M991wuIaQPYPS:URJObLyxIIYMdwuwPYPS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602373, "uuid": "1918ab4c-f491-4db5-8941-2217f41823cd", "value": 4745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602373, "uuid": "ce3c61ab-1707-4569-87ec-a9aa259d08db", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602373, "uuid": "3795b2ef-4264-4c91-9f92-79e7bb583520", "value": "iLFwqeyH", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91aa637d-bc78-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762588647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588647, "uuid": "5f1d3b73-ab33-4c36-84bd-2d25fa5e0aae", "comment": "Malware payload (Formbook)", "value": "070771557308ef7ba36e764fa0498bd8", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588647, "uuid": "59b688ec-338d-4f1c-a017-c11914db3175", "comment": "Malware payload (Formbook)", "value": "6e2c46144ecfe43364ca64844c46562391c994bac618e8c6e122922d14c64964", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588647, "uuid": "056db7bf-d409-4807-9ab1-95d1f9562b4a", "comment": "Malware payload (Formbook)", "value": "141ed81f60c04904a9a3e656373951ec84655bf9", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588647, "uuid": "0ef19330-e0c3-418d-91d5-d69b94be7915", "comment": "Malware payload (Formbook)", "value": "d33bbb73431dc34b49ece0c3a9e8b221acbd52b6252db1721a7f5078f7900b130d8996038d099a9edf2d39ab9d1aa044", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588647, "uuid": "0107cc21-611e-4bb2-86bc-a23611533440", "value": "T1470501A3A24C4B95E81EDDF272E196E70DD29EDA495617CA5B8C3F0D137FE0523C1828", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588647, "uuid": "4a63684a-8cd3-4f9f-9751-d63c8cba2e66", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588647, "uuid": "4bbce241-b239-4cda-98d8-2ac2766c0f3a", "value": "24576:Gq5TfcdHj4fmbIIh1nDoap15sLFjwvNVyW:GUTsamrnbpvsVwvN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588647, "uuid": "6fff1aa1-9ed2-43b4-a644-6d2811c10e3f", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588647, "uuid": "ebf1caaa-a0d9-4f1e-b370-f4b6f2aa37a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588647, "uuid": "82685792-3f2d-4e40-bc19-ec1c3a86cc60", "value": "DHL OVERDUE ACCOUNT LETTER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fcfdce-bc67-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762581324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581324, "uuid": "ec26dcad-c0ac-4d0b-a70d-0d52f1893379", "comment": "Malware payload (Mirai)", "value": "dd2abf823b216c448a29defdb7ad5563", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581324, "uuid": "46d45097-37a9-4772-8bbb-802350d08edf", "comment": "Malware payload (Mirai)", "value": "6eed176f4af968dc146af42d695e34c3d067dabfbc2eb666da4e4a2de6329e09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581324, "uuid": "85911ea5-1de2-4552-8f3f-70a2973547df", "comment": "Malware payload (Mirai)", "value": "95cfafdae0f9dc556392413692ad83b885cb4e3a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581324, "uuid": "677ee624-1648-4fa2-816b-603a60c8c670", "comment": "Malware payload (Mirai)", "value": "7ba6aeff93da80498a9b338612f599eebc83f9e9e33333d7bd0be81afeb9e8f1778236e9059733b430d4402c07e03f21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762581324, "uuid": "666482d5-6fc4-4163-a5ed-e1fced84c968", "value": "T11F531A92FC424A2BC1D402B6B5BE5A8D376213F9D1CB7227DD614B407BC5A1F0D6AEA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762581324, "uuid": "1f695f21-42bd-4617-86f0-dbe96a8b77d2", "value": "1536:AkvvADrAJ9yAPw4+x60GgxDkRucdHHmo1IEwhg9y2IymQY2AUm6hh1Z/C/C:AooDrU9zo4lXC6hh1ZKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762581324, "uuid": "732b9a4b-0c4d-44f0-a2f0-387c905a2856", "value": 63820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762581324, "uuid": "004212f2-0e94-4bce-b405-b2764aa88351", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762581324, "uuid": "04172949-7406-4817-9cdf-ce8eb380b3a7", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9121b60-bc66-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762580955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580955, "uuid": "859b865f-9c82-4bc8-990b-3d4f4a6d60d9", "comment": "Malware payload (Mirai)", "value": "a36e83477fcee1cddb2556902137eeed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580955, "uuid": "a6da63b5-b520-44d2-8f52-064b14ec55e9", "comment": "Malware payload (Mirai)", "value": "6f442fe7cdefce679156667c68709a00499abac754fb57b63278962bc07f6191", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580955, "uuid": "cdda18da-4ea9-40c3-a77a-016f5ab094f7", "comment": "Malware payload (Mirai)", "value": "99dc19b28e59d09d7d3ebd7157ea9226abcad2f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580955, "uuid": "801fb6ff-7f7a-4001-8d61-745c19bc20b9", "comment": "Malware payload (Mirai)", "value": "9e0a4e526fb17f75d150b97a3721b1fd30ebd0cb02e2746c7327ff5ef24fd9eb3d0107a4d218d3201b3968787ec2fcf4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580955, "uuid": "3a604dd6-320d-46c9-b48c-37b3bb381f90", "value": "T1B7B32A46F9819F11D5C721FAFB9E414933136BA8E3FA3102DD24AF6123C699B0EB7512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580955, "uuid": "850db28b-5fd6-4b33-8aef-c2a8796dc5a4", "value": "3072:6hqDftNRRhAOamwQzilrRtl6z0C/SiULqO:6hq7TOOamwQzildtlTCqiYqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762580955, "uuid": "7383c2e2-d9ef-4b3a-acb9-eb3b7891cbd3", "value": 115616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762580955, "uuid": "ab06be80-9e6d-47d3-8d1f-316bfc3b0470", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580955, "uuid": "d2a10e48-4032-4275-acd9-1ce889bee71f", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1a1a6e-bc67-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762581496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581496, "uuid": "3643ef4e-b486-4ac4-a8b7-19a6c04e53de", "comment": "Malware payload", "value": "f0fd9c7b5600aee9bd17dee3991584f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581496, "uuid": "f0e71f20-fea4-49e8-838c-acfbe2b47dec", "comment": "Malware payload", "value": "6f967f6f9448c1fd18c438f8ee04be97ad22eb1f05b0c95140c21dc3faa052a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581496, "uuid": "6a6b952a-1eae-47f7-8bcc-c7ab3d65ffc9", "comment": "Malware payload", "value": "fc79fb923f6552e7aecd85ec17e58d26573dff15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581496, "uuid": "bb744078-867a-45c5-ad3a-e90f5a7042c9", "comment": "Malware payload", "value": "7e60af84940fe361b397163545e1384297d2f831da665b4f158895c3913155e9dcc3cc5c707b909386a9f53687fa9494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762581496, "uuid": "efe627f4-de75-4e06-949f-af2e15d95e42", "value": "T10E260240FBC340F2EE42093C41AAB77F8E3A75214735DCD7DB901919E8E26D16A7939A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762581496, "uuid": "af92ed54-71d2-4bca-903e-6196f52a6c5a", "value": "958105ae0ee99c1453d86f39d3c60656", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762581496, "uuid": "b47ea74e-7dce-4820-a7fe-60492526303d", "value": "98304:a+OfPAd3yHB5CxQCvcz0We1/dOgMBbFyT9pU+q3A:amd3uBavczncVrVXFq3A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762581496, "uuid": "96df0434-77fb-4617-8238-5d2c30be0eb1", "value": 4522054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762581496, "uuid": "355a92e8-eba0-4863-be92-b232aa065ffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762581496, "uuid": "a5d79e0a-c0e3-468a-aadc-4b42cdc7a683", "value": "mwc_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "769d30e0-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620384, "uuid": "6b7d0afb-2a6f-47b5-b5c7-ced86737b3a7", "comment": "Malware payload", "value": "4ab207cdef81ceca90607bdb62aef2a6", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620384, "uuid": "7b08eabe-a281-47fe-aa9f-dd8c242d38da", "comment": "Malware payload", "value": "6f96b534bcfec55b97dbeb18cbeaf59c2a7b745e667fea1a0998b1ff9df72b45", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620384, "uuid": "0338db0f-9ce7-4071-b041-2fb36f70b09c", "comment": "Malware payload", "value": "7c2f299296ba696572d38dc475f65c1077edd9d4", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620384, "uuid": "b3d45aea-89c5-4219-ab98-f4496da40cf5", "comment": "Malware payload", "value": "9591ce0bed97de848d00f1932c6b35842fa97cc88560383b320e8c215f2e350dba7d6c5e3af64e1cf4a0c487f50436b7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620384, "uuid": "428c72e5-438e-45ca-9803-dffd5a447718", "value": "T14F54E2E495FF5EDF86D72593A3B33D1108299501131A02548E9AFFE42821C1BB6BDAFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620384, "uuid": "c4035536-af94-4445-b25b-c5456ba46e63", "value": "6144:rsugAp5sa+i2CnxIZaLF+FgAXf7asJIyIlbFnpmyLyMEvrQ6KwKCBaejPg:f+Dvp9BM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620384, "uuid": "2d056ae4-d32d-4127-a4c2-11e0d639426e", "value": 296057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620384, "uuid": "a5120318-0e68-4699-ad37-ba107b29b0ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620384, "uuid": "6940ff51-f7b4-4dbb-a09a-7f3ae0c29908", "value": "Factura Rectificativa ES 2025.11.06.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b7aa0e5-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620392, "uuid": "a8f62d67-2a84-48ec-b8a2-6cc4875e3ccc", "comment": "Malware payload", "value": "b2d9581e86bc9594c09fc81003d67d75", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620392, "uuid": "3f21a72a-2d22-4318-86d8-f3d1c54ffb19", "comment": "Malware payload", "value": "702ccf23fea0beab32c3bb77868353d58c9e395eef8c9ba685c83d04e312b5eb", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620392, "uuid": "e0078ee6-d26e-407a-84fc-287c0509b961", "comment": "Malware payload", "value": "4996da97831bd594e6cbacdb5a2f6ec9f77fd2c3", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620392, "uuid": "3104b6ec-afe6-4e2e-9577-e080b182eeb2", "comment": "Malware payload", "value": "3e409d5cca875831f855f7b1dbfe22d67b6b6b49a24d2057b839d3d9e26b0f02c90ad4f95c4cc2285fe0ef59964edc89", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620392, "uuid": "d8fb4783-a796-4177-97a4-54ff32ee2960", "value": "T145349FFE371CA48CFA312A6E235ECD0120DFC65DE52510156A86B0EF15A7048E7EEBB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620392, "uuid": "7a97d222-ece2-44ac-8b09-b6c88ad6e329", "value": "6144:7wv8Mgk5TzLS7c+tcJZaS6JNJQkt3QDr9AAxDLe5LcqJlE0ORAZBla/Fa8:5A+tcF8If", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620392, "uuid": "f8840744-9971-4970-a953-62328cae810a", "value": 249046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620392, "uuid": "ff346260-2545-4404-9aae-36a3d4c64ebc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620392, "uuid": "ef141a20-1ebd-4477-ac90-065c5198389b", "value": "INVOICE FOR PAYMENT_039849USD.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e978b206-bc83-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762593519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593519, "uuid": "49766887-bf5c-46d1-8824-dd1db7b6f97c", "comment": "Malware payload", "value": "dcb3f1139abcf8b403b6f86a9aadac16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593519, "uuid": "784ff384-cc8d-4914-94a1-27bc15ae94c7", "comment": "Malware payload", "value": "71326ed439de11c7b2a9cac492e6231ef881589df1eeef691a2e88030acba2ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593519, "uuid": "c9ebdef5-6505-41e8-b76c-1457d02476ee", "comment": "Malware payload", "value": "d9e22543a1a166116e2736fbb245d44ae1394e7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593519, "uuid": "ee309c54-f64b-4972-9278-a46a9ddeddd5", "comment": "Malware payload", "value": "29314d66878cc6222467dc486df13dca47c27652aa9134681ab6c35350bc5c6469317631ea7544d601fced4da82410c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593519, "uuid": "c41fd63b-8ed2-4484-9b9a-d976c8d21adf", "value": "T1834733357AA29071D37236349699A339F77EAD70AB3902D322903D3C3E716C15A7C25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593519, "uuid": "c459f97c-3718-4896-a688-5794b11a3e7c", "value": "edb0a89022b9c14b574f0c2cef13dfa2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593519, "uuid": "bd25a7e8-28a9-4b12-80ed-b0e14cab6b0b", "value": "786432:KtplaXQ6W10rrKJBH5lFRqJkkt9O2B4Bi5e:KtpjTuPKJBZlC39ORb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762593519, "uuid": "d127f8ad-5d34-492c-b5b2-327adecbfa67", "value": 26691952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762593519, "uuid": "38a8b00d-a751-49a1-b4d9-cc75897dd31e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593519, "uuid": "17b58e81-c403-4fd8-93eb-385455b04731", "value": "TLauncher-Installer-1.9.4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7a7123-bcf0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762640102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762640102, "uuid": "134da3fa-352f-457f-8403-2cf9eaaa9c67", "comment": "Malware payload", "value": "20973dc477e5b2cf2246b125094e0f14", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762640102, "uuid": "acf1d770-3ec4-4222-9b99-920a99430503", "comment": "Malware payload", "value": "7185943b05cccde9b5800ffb1fac51e2aa71de7f28216b76312d778e99524690", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762640102, "uuid": "c3212e18-ecc5-41bb-b181-2416574742e9", "comment": "Malware payload", "value": "4ac04f18123ea49fd63d5e92f3be737ddae82c6d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762640102, "uuid": "c9914cbb-4543-4d69-a9b9-df4648def672", "comment": "Malware payload", "value": "7cf674bf5953331ece666fff7a8daf3bb154befc00493bb0696c3d334e07299c98620cbd7ff469da37a91d2e81d17382", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762640102, "uuid": "42492553-44e2-4ae0-a912-a866bea448a3", "value": "T140D46A8EB57B0CEAC6DF95FB80368255F10368D07141862AE7AE4027DD872D29F95B3C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762640102, "uuid": "112af6c3-792a-4b48-8854-9133966a12bd", "value": "99660705ddfa2fb658dde087921ec28e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762640102, "uuid": "d43e254e-cebf-4665-88cc-e9ffffa0005f", "value": "12288:scYgl8F20ivjFVCOMg/taoT0JFGjRNFLPKQjNPSl3JH:Ggl8FFmjFVKyLT0J+RNFbKsNPKJH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762640102, "uuid": "61675080-140c-42ae-b819-bd2328e68818", "value": 619520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762640102, "uuid": "24705828-1da2-415d-b21d-b86fbd5a010a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762640102, "uuid": "4b86edfc-79bc-418a-ae52-fa55eb9f4a46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785f18a5-bcba-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762616951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616951, "uuid": "4d76a58c-f92f-4cfc-8f54-16b1ad802e56", "comment": "Malware payload", "value": "599c9938ce8f40b765dba7ee3df44fc8", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616951, "uuid": "183c56e5-b28f-4238-ba52-b66ab963e214", "comment": "Malware payload", "value": "71b6c39764797330beac737f9187ae38c39745f5a1e81cd114e66429bcfe2ab1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616951, "uuid": "a4fbd7f1-ffd6-4ccf-a302-5764bc8f4710", "comment": "Malware payload", "value": "da78ea1882c9b6c46c5c23092608b1ef7ad95a64", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616951, "uuid": "7cf70185-c44a-44fc-9349-de94daef2e27", "comment": "Malware payload", "value": "dddda7a6036d1f57bf489ab35281e90051de4ebd93b9ba8bceb68303acbc354a946383bccae11920d97e51fbcb14fa74", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616951, "uuid": "7b848747-56ab-46e1-aa85-b52537f262fc", "value": "T1CBC012C9706331B3046CEE00BDB14C5AD08282CD0D6B23E9EC5B497C90D0B907010A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616951, "uuid": "cf961ea9-988c-467b-9c52-8cad3ab44e33", "value": "3:pKHAqRhAeNLhEYSsbovdFSIMKSGt0KKgqRhAeNLhVVSIzG1SZeok:kHKgVkvuBG6KKqgXFeok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616951, "uuid": "3a136f83-ba24-4a9f-9a08-87138ebe3fea", "value": 185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616951, "uuid": "4771c6ac-8668-47d4-8860-ed80e9563e35", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616951, "uuid": "262a86e1-a22d-47d5-a17e-3b2c4c3d57f9", "value": "wlan.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea489084-bcf9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762644201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644201, "uuid": "5e13d949-8fe9-485e-a9c5-ecfb6e42f84b", "comment": "Malware payload (Mirai)", "value": "9a78987672c67178b3ff2d57504eff32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644201, "uuid": "c1850446-5835-4cc6-a07d-aa7be0d6aacc", "comment": "Malware payload (Mirai)", "value": "7271a0b2c3ab5f774de4eab4dfb7a76afb0b451a5af953a7df31f532b59706d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644201, "uuid": "d10d2390-bf22-46ce-b4ca-6c764b8be567", "comment": "Malware payload (Mirai)", "value": "b42ab015568b204bb8abdd5de6e38e5f94725ecb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644201, "uuid": "9f1ea9a6-d271-4ca6-b8b6-58a9fc723f95", "comment": "Malware payload (Mirai)", "value": "3b84082311eff33557f79015a585a6803a7ced566fd8d8c1f1ae73dadee1a9c1e9b6dae7629cb8a698fe746e2fb909ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644201, "uuid": "d03ddbd2-f9a5-496d-b821-ff1745f3b823", "value": "T1223301F4D0A03161D2A05D32AB0CE5C59F1B2B3E47FE743A41E6C42917A39EA9198F47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644201, "uuid": "5a648832-041d-4c1f-bcf5-b7500370f2e9", "value": "768:YfSdfrdPtv3VPP5D7K8ztBrNPqe6lBHW0FSyIYkiqXNuvbaSktQtmjJN7gJ9q3U1:pB1BRD7DRBrNCusSyvcBt0mnvLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762644201, "uuid": "55601b67-35e9-4ada-a15e-59a353becf0c", "value": 50872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762644201, "uuid": "2b3e853b-a2d5-4181-91de-1e6361bb10ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644201, "uuid": "bb6330d9-a542-4056-9dc0-cf95e08cfed8", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27366005-bcdc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762631418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631418, "uuid": "065ee9d4-c78d-48ee-a774-f34f36f3175f", "comment": "Malware payload", "value": "4d7ce95074d6d4225daadeddae07ea55", "object_relation": "md5", "Tag": [ { "name": "CoinStealer", "colour": "#8B6A99", "exportable": true, "hide_tag": false }, { "name": "Powershell.Agent", "colour": "#48088A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631418, "uuid": "bbe16242-fa0a-4cc5-b8fa-c7e63645e846", "comment": "Malware payload", "value": "72d4cc4f8c6b106e667095951d0637c6853c5f4187382d8b36e017fb93636a85", "object_relation": "sha256", "Tag": [ { "name": "CoinStealer", "colour": "#8B6A99", "exportable": true, "hide_tag": false }, { "name": "Powershell.Agent", "colour": "#48088A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631418, "uuid": "15b010f4-674b-49d6-bcae-224eafb4f893", "comment": "Malware payload", "value": "96f28231ff13a05c64944e614a94ba5ed06edd01", "object_relation": "sha1", "Tag": [ { "name": "CoinStealer", "colour": "#8B6A99", "exportable": true, "hide_tag": false }, { "name": "Powershell.Agent", "colour": "#48088A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631418, "uuid": "70249d3f-cc51-4df7-9017-6f8fbb2a421c", "comment": "Malware payload", "value": "72b28178bcbfb3f17718bd2e9df1cc59d28db0e0f9ea9cc2bdf54823fa8f8c3e849af50bf794c64ee530582efdfc17f5", "object_relation": "sha3-384", "Tag": [ { "name": "CoinStealer", "colour": "#8B6A99", "exportable": true, "hide_tag": false }, { "name": "Powershell.Agent", "colour": "#48088A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631418, "uuid": "2f038f2d-d74e-4805-8f87-8466a0b942f5", "value": "T1A3D02BE7D2098092462C91FD4AA7A82194123116809215946B29DC49D6D27EE0908941", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631418, "uuid": "e05c0767-5ad4-4b41-b45a-19a5ad4b755a", "value": "6:tlIG35BLu3q19cTZww3CVMBOe5fEgZS/uxsyc3sxv3XD:vD6C9UZ7WSOOs//uUsx/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762631418, "uuid": "0a71f2d4-86ca-4296-b017-f7304f6472de", "value": 253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762631418, "uuid": "3b6059f9-5ecf-4824-9cf5-8c388bace51f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631418, "uuid": "947d9ae6-f19e-4fa9-a3b3-6078723d9671", "value": "4UuOUvB7P.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21c69657-bc78-11f0-91c6-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1762588459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588459, "uuid": "6735b473-ff97-4047-b2dd-66e770029128", "comment": "Malware payload (GCleaner)", "value": "6f8fe30e702406d41db85f98fdda694b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588459, "uuid": "00ff44ed-af49-41e0-b5ff-c2e583626f52", "comment": "Malware payload (GCleaner)", "value": "73287e17a40a65069452ef48251b4f8bcf686188898983e98cdbc5552108e2d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588459, "uuid": "92c00cbe-1f43-4bcd-8938-c82a25776e89", "comment": "Malware payload (GCleaner)", "value": "019e4208f200b01135d3bd8baa50c329d7ea384f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588459, "uuid": "53b9827e-0f2e-4fef-8a54-ecb0574ed8b5", "comment": "Malware payload (GCleaner)", "value": "a45b668de9c1f3fa7437f063807bf0096bbc1dbe46d60c542e62aa0aa40ea3d6da1e0f7c476b2697dc71c4fd1658ee79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588459, "uuid": "da24cceb-d968-4d44-8c97-3a7e592afcbc", "value": "T14216E00BCFB10A0AD11F1979C9E309591006BB49D48AFA5E3FACD83D56760F772BE11A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588459, "uuid": "3cc22843-6ae5-4491-b24c-4c2b00bc27ad", "value": "c2ffaac75292c9510a72a45eee801fb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588459, "uuid": "62bfbff4-3e26-4259-a9bd-1daf17ef4702", "value": "49152:J3UnBYBTgQ804/GAjmWeBcBBUhDhAh33QwruX52ZQ8JRgR6lMgwRCXmaalSvMrU:JkwUQDxAjmWB4Dhw3AwyJMto9lTU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588459, "uuid": "df62d41e-3cb8-4cf9-a729-8976c780e61a", "value": 4028176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588459, "uuid": "100b4a9a-94e9-481c-8940-2264db1b2cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588459, "uuid": "6fc41a9b-a180-40a8-a63d-a4ea375ae1fe", "value": "random.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a6de70-bccb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762624114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762624114, "uuid": "7b0428f1-6feb-47d4-ac2d-7955c505e0f5", "comment": "Malware payload (Mirai)", "value": "68199e7e93ffb85c3f98994f590a2d15", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762624114, "uuid": "641e3ee7-e597-418f-ac15-17fc2db1cd9f", "comment": "Malware payload (Mirai)", "value": "73371b30876f47d6a43751254bbbc30db301674a6e59dee92e828eacedebf820", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762624114, "uuid": "81f53e09-27eb-4c97-82af-2120d79e6afd", "comment": "Malware payload (Mirai)", "value": "96cfc41708a1d8cd9aaa497bfd2663319cdc233c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762624114, "uuid": "3082235e-f40d-4efc-823a-408aaf0cb7d0", "comment": "Malware payload (Mirai)", "value": "596cd118bd8765f54c213107a6a56556a3a19dde00e18e42b6021fa8d055d679ace56af6e2b8b43ee629f2e8d01b4cea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762624114, "uuid": "e27b70bb-acc3-4618-85e6-81a0ddcc771d", "value": "T152838B23C9361DA8D84844B0B0B48F755BA3E11984572EFB599ACA3ED483EDCF6853F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762624114, "uuid": "13edfa52-576b-41da-94b2-0cd696e0171f", "value": "1536:wvDsx6cvknLaT6uhbkKRvxgV++uRCaWuRH3HyP:wLsxWLix1LRu++uRvRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762624114, "uuid": "985b994b-6afc-4df5-94a2-fafa1dbf6b9d", "value": 83812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762624114, "uuid": "ea7db0de-01a9-4733-b5aa-2d41e5cf9738", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762624114, "uuid": "85f09533-8186-4944-ac31-4084a5d3d0db", "value": "titanjr.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499f53fd-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620738, "uuid": "03736b7d-7a1b-4617-9eb4-b64fff2dedc8", "comment": "Malware payload", "value": "0f1d0fad61afc53c84373b79b762197d", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620738, "uuid": "4b425c3d-abfa-4d4b-a85f-1c853304837e", "comment": "Malware payload", "value": "739b506e6bd7ecd9cfeb71456e19f2378173e13be0cde308c3e9dbb98b4d7ad6", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620738, "uuid": "bc08efdf-7ad5-4158-9ec2-5ab5bad6e080", "comment": "Malware payload", "value": "b63fdd36d81b30b1eb165dc07ae7ceb42aa5c6e0", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620738, "uuid": "c3aeb6bb-2c35-4f6b-95d4-df6ae101ec44", "comment": "Malware payload", "value": "a483e66b5dafa3786c2d871cbe25fb1ac4a26fd7eb11b59636dfb005e8b9c8aca965e9494a98c1339f9a11360cf472f1", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620738, "uuid": "aaa2f006-8de1-4d91-af57-610925071d17", "value": "T1E154129B3181D985C628A93FCCD0E1DB251EFD427DC6004F3988F71F9DBCA51692AA68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620738, "uuid": "b201484c-8712-4d01-897a-1bd0fa888dcd", "value": "6144:DYDPUEDusNH5nbH5UkoAHQxDij5JwUl9AmyB7j6vWJpF:DYDPUU5ljHQJ8w7pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620738, "uuid": "965100b2-1052-4ee4-b70d-2190c40a32eb", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620738, "uuid": "086a7854-ff4d-40b5-98ff-86e47c2f5264", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620738, "uuid": "02a2a466-ccd6-4eaa-b65a-d3f01a92c5e9", "value": "Nomina 30.10.25.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3072666b-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602228, "uuid": "313d30ff-0a72-4c91-b8e9-4722035aed8f", "comment": "Malware payload (Mirai)", "value": "544ad1f39111bba022d58144d542bcad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602228, "uuid": "e34328e9-d24d-46ca-98b0-a01a6e6a2360", "comment": "Malware payload (Mirai)", "value": "74017ac31f136246137c96d70f696e92bafbee2d893af905a09adea616394655", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602228, "uuid": "afa6a3f7-ef47-4e83-a8f3-d39cec897a6b", "comment": "Malware payload (Mirai)", "value": "4ffe6e390c6e93df4b1ec80a1945a0029876e655", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602228, "uuid": "6bf13d15-fc1b-468b-a646-01e4e06f892c", "comment": "Malware payload (Mirai)", "value": "a0cb3646dbc5e580431ce973091e98fb02efd059bc9fce1c6942be050d337af8b17ac281bc7a1ea0cb2f751783bab074", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602228, "uuid": "22a1a9b1-09ea-4c77-ba63-3a69ec7f1b76", "value": "T1E4042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F12A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602228, "uuid": "b83c3e31-e0ca-42d7-b059-41d0c98da3dc", "value": "3072:OLe6vhN1QIruCee+asuTuRebU7IVILMZQy38YhTfYo+M/Rvs1tlLn:ee6vhQIr1r+asuTuReAvLM738+x+M/RO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602228, "uuid": "f17b7106-ed71-464b-b0da-d54ccbf7e906", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602228, "uuid": "7bd62725-edf6-44ee-b840-fc4cb8fa9178", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602228, "uuid": "4c0163b1-e52f-409b-992d-425d4a7e7c2c", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664d4e77-bc67-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762581273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581273, "uuid": "73a57b60-b10e-403a-8194-655e0981d7b5", "comment": "Malware payload (Mirai)", "value": "ec990bd80a9d87d1d5e82efc6f13f570", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581273, "uuid": "8704122c-9167-4659-a0c0-2ecaa5862711", "comment": "Malware payload (Mirai)", "value": "7409652ff964f918641ee734f4f49fd679ae075c62fd6fcce2b565b03b506c22", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581273, "uuid": "2e8f8f7b-d9d1-4b3b-a4fa-682d570fd68b", "comment": "Malware payload (Mirai)", "value": "5ddfe69708c005e86d7b6441c6ed50c49e45a2e6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581273, "uuid": "e88640de-8395-42a0-b5c0-b71e6f9713ce", "comment": "Malware payload (Mirai)", "value": "6bb5a1096fdf17759d6852a0788f3111382d55dfa6f3023e952a4a3e4256104d742b6ee7d82b0ca0630e4c4e791b2f1a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762581273, "uuid": "eace2542-555f-4c03-8559-c53bd623aeec", "value": "T142A2D062D3D3D671C6608936EB7C88926ED0CBBDF3FB3473102152D622C1A9616F91D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762581273, "uuid": "11a43d48-ac3b-4eb6-a8de-fa8f05f47b98", "value": "384:FOTec4Qq28dNSrGxwmI+mCsOWbckgtUdyismYi2jvHrhymdGUop5hXS:FOizQq28CrGxKCP/ky68zs3UozJS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762581273, "uuid": "19e04165-b577-4300-8e5b-39a4b65acd29", "value": 22244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762581273, "uuid": "bd112af2-0ab5-4d97-a71c-e56cbe30851f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762581273, "uuid": "7ff8d0a0-15fa-4455-8f52-ce9609b6596a", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46bdf748-bca2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762606560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606560, "uuid": "9cef7ffe-178e-49bf-a8a6-d769bdae8ef4", "comment": "Malware payload (Mirai)", "value": "d117a6c3ac20ae89ae453733c1c377ca", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606560, "uuid": "9583575a-5558-476f-a76b-5b5d7636f52f", "comment": "Malware payload (Mirai)", "value": "741df6649360fa73c4fa54dcd8cef092d7427174ad92a7d706a41828a676c758", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606560, "uuid": "3089ca03-a63d-4b72-b78f-f8530de9ddca", "comment": "Malware payload (Mirai)", "value": "66e710039cfccb07876918d209003408cc6d8c36", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606560, "uuid": "6b2ebfec-e5ce-40d3-bc12-b477ac614e70", "comment": "Malware payload (Mirai)", "value": "092b19231f13ba3565be03eb60f66c56b0230b006738e1cb36bfc2f0c63f3f984a329b4f9d232e762cdd92a88c552cb6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606560, "uuid": "a63a820e-62d6-490e-a925-56904528d755", "value": "T1EE23F12B095EFD60C3708971D78A4887F3A50E6CE3DD21BBE6701948B39925927F0B9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606560, "uuid": "3ff688cb-a5de-48a2-811a-d173af2a4c08", "value": "768:fVIyO8reNlAubXLG1pOhu41yoqELe9XPlx645hhHanIJP7DI2Ivpgs3Uozx:fFeNjXLG1pm31y7EOfl1hh6IJjdIhVzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606560, "uuid": "14d02988-3556-4332-a162-dac9fbf254b4", "value": 45668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606560, "uuid": "5c8f2144-aef4-4197-83f0-34fc3116c86c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606560, "uuid": "575fa00a-b4e9-4d92-b84c-29662cf4ddcc", "value": "executor.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1da58017-bcc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621953, "uuid": "2bfb3bfd-c9c0-4fa5-8a47-a806c519eb01", "comment": "Malware payload (Mirai)", "value": "3eb9c50ab71ff442915f0957d1f64c0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621953, "uuid": "f257672f-867e-40ca-b134-741eba0cda1c", "comment": "Malware payload (Mirai)", "value": "754871ad0ecb237628372c4f9322a7b0ce9209759ef7fe269d3b1ae60f7d149d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621953, "uuid": "0d3dbc17-7f1f-418e-ab3d-976586d57100", "comment": "Malware payload (Mirai)", "value": "78fc3323eafba1ae754fe4cdbfe25c523b10ef9e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621953, "uuid": "c8c10d10-310e-4c2c-9798-af0af4116c90", "comment": "Malware payload (Mirai)", "value": "95043c1f7059ce2d247daeeea18a712e8e62e9bba62e8054a335a0eab46210a3b81b6102f604378eb3651f6a259d5bab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621953, "uuid": "88106748-a405-4da1-871e-c29988baf129", "value": "T19D630852B8C18E15C5D813BBFA2E018D33126768E3DFB2129D116F147BCA92F0E77A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621953, "uuid": "f46f1a71-9ae2-499f-97d0-764d149c95d9", "value": "1536:StnER4jL83+4/ZZM0mA8w7lR5vzq91dO0nz/IziSX+1/K:t4jo+6ZZBLbRd29P2X+1/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621953, "uuid": "c438eaac-0944-4e20-9907-8f1dc79277d4", "value": 70960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621953, "uuid": "8f2078ee-8a3e-4838-9566-467a1daa5e30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621953, "uuid": "a3ab48df-b17b-4750-bf66-784d1c2d703a", "value": "jew.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b04dc19-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602353, "uuid": "c5dc4c0a-dd46-460c-a966-0559b518b622", "comment": "Malware payload (Mirai)", "value": "c901c03954e51e0dfcbe6069c225c563", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602353, "uuid": "ea1b96a2-7304-4635-86e4-977348d94f0a", "comment": "Malware payload (Mirai)", "value": "75629129a2f45fde55c3b488e328611af56dcdd72e7980f04d3f150a50c101e3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602353, "uuid": "06364d51-f2fc-45b7-893e-dbe4ab3ed043", "comment": "Malware payload (Mirai)", "value": "1900cbcbadb13992f072971f245d3d907bab136b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602353, "uuid": "b1290008-2fd3-4cf7-9563-5603dcd1ca45", "comment": "Malware payload (Mirai)", "value": "f6c6a002befa343b2a0bb54a48aaf9940f479e259d92a0c20dcfec0c17d81475127c4879c9da205092f124d1c093eb92", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602353, "uuid": "0da36ee8-ba00-42f1-b86d-f9cacb55473a", "value": "T142435B52721C0E17C4A31A70263F5BE08BFBEAE021E4B685699F5F968935D331486FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602353, "uuid": "664664b8-19db-4389-9d70-dbd43259d99c", "value": "1536:eF6QcATQdskHosl9k1dP92T0bI666hJa108:tqgtJHk1dP8gbI6x4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602353, "uuid": "53cdbb77-030a-4167-8d37-730f1bad57a9", "value": 59764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602353, "uuid": "705b3afb-ad09-4123-8fba-642237aae6f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602353, "uuid": "31d9f522-c386-4803-b293-b1e756c85dbc", "value": "uYtea.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f087d00-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602225, "uuid": "e9a6bad3-3795-49b9-a33e-ddcfe6cbadfd", "comment": "Malware payload (Mirai)", "value": "0e09e1855d970c47e86dc9fadf0f415f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602225, "uuid": "92265cc1-a2a2-4df9-9086-6c2184b02e95", "comment": "Malware payload (Mirai)", "value": "767ca499e9a7b6f1ef385f1f15233d07de1bf929af4a685afacae59d8e092ffa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602225, "uuid": "67f55164-74ff-4d85-89f8-d13cab57b4f6", "comment": "Malware payload (Mirai)", "value": "f33922d0c7cb5649bf24bd6fa8cd2a7737538b64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602225, "uuid": "f410ee88-6b01-45e5-8522-36e3dbdbc1df", "comment": "Malware payload (Mirai)", "value": "8d59babea0f633e46b58b94eba1b8cfb1522acaaf6e5b21fec38cee35d1bec108b19f159b7c86da60192f7222e1fc726", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602225, "uuid": "037be3bb-3402-406a-a692-b15e6c4a421a", "value": "T133937CC0F683C4F2E84705B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602225, "uuid": "d1b7703e-8bb5-4b45-af03-91a51ae7a41e", "value": "1536:W/QCZaxGdvts3i5JPhoRsxPu++4HRsUIKqI4FrS4LSU:WYCZa8dvm3oJPhssxP5lR+KfUmDU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602225, "uuid": "2b85968b-6edd-4812-8673-5a09257ec0ea", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602225, "uuid": "5e13241d-15bc-49b3-9d56-61e48ffbae2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602225, "uuid": "a13fde04-fd94-4c5f-bf29-c32059bf30c6", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92283e7a-bc66-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762580917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580917, "uuid": "07c9767e-6e09-409b-bffa-4fad083c6ac2", "comment": "Malware payload (Mirai)", "value": "659d6e3f205bbc12102ccf25c34b0742", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580917, "uuid": "0d367437-2b67-4c24-9a10-82bb499cf59b", "comment": "Malware payload (Mirai)", "value": "76b9d7e0a961d8f1e4d3df5bdccdd29f3a38a4803c0199477dfcf1b717ebf908", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580917, "uuid": "fea17e80-b000-4d38-b38c-332fcdc472b4", "comment": "Malware payload (Mirai)", "value": "2323e705e6770bde1c620f2bdc773b4c2116a6ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580917, "uuid": "dc8ff458-02cf-4873-aed1-e4fed334c874", "comment": "Malware payload (Mirai)", "value": "cd57007fc9cfccbbc5427a94ddbb66013b08729fe01c3ff02b378f4993fa03ad2beb7b3012d8dbb5ea101b24a9a0c98a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580917, "uuid": "60df3808-79fa-4d08-a97f-23e69282ab60", "value": "T1A223F1F29A21CEB4D2926D35DBD944C70354AF39A3E9E28450284D2816C36AE18BCD6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580917, "uuid": "7f7230e5-103e-4827-acac-535b93febc4a", "value": "1536:2m1whCy+KtudF7rORp8pkrj0ZpP5xLj4D4Lc:20I+iuTXOoLLID4Lc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762580917, "uuid": "311e8a74-68d9-47fd-a503-07916bea2f9a", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762580917, "uuid": "82388225-09be-4f57-aed4-2861f15992a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580917, "uuid": "2cb10601-ca1f-4fc9-b4e5-a5c02e84b3f3", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ec5e8ed-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620398, "uuid": "35024dbe-4c35-4282-bcba-66d52dbe03a2", "comment": "Malware payload", "value": "e20ffbdf12ff49390a38beb840386031", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620398, "uuid": "3de25344-6e05-4fca-bfe4-198323dab5fb", "comment": "Malware payload", "value": "770772e9235711af31bca075236e5a7377ac3ee5cdfb12cad48f89fd26c7d69a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620398, "uuid": "009843b7-c64c-481f-9f38-ea569532fa7b", "comment": "Malware payload", "value": "8ea24b39dadf6fbe1a0410632104cbde3cedd65d", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620398, "uuid": "a6959b53-52b3-4b4c-8111-90f52cb79257", "comment": "Malware payload", "value": "84f9032f820e2557d90b71cb758e64f2c73537c1d9e0205035d43891da9df9e341241e4fc2b0a25f3b98fdb251315b3e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620398, "uuid": "77363564-8851-4d6e-b474-d163da34bed5", "value": "T1EB4623734A2C357B07710755F00F77B39E6EC8A7868C92E979CCA14A35CB6A1852FCA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620398, "uuid": "efc85952-874b-4d0b-a27f-4cf34fb367fb", "value": "49152:D+J6W/GmtZVzjixb0NvI71bu5In/dC+cDg92Ta2ESnaaaaaaauCjCVHaXcpMPw5I:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620398, "uuid": "37d22a4c-fbc9-4e07-bb43-e674eaea0057", "value": 5603977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620398, "uuid": "bd1f7654-d802-48ec-975a-048e9138ca90", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620398, "uuid": "096619a6-1b9f-4ab2-bcf9-76e555669a75", "value": "605766!~Re-co-no-cer~!572716SV3LU.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a943246-bcba-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762616955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616955, "uuid": "8d74c6fd-5bcf-4e0b-bf11-d268de626291", "comment": "Malware payload", "value": "3af1e77826f5a0739b38e69a5cba1eef", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616955, "uuid": "2611aa17-0847-4093-9da5-e1e005456b1e", "comment": "Malware payload", "value": "7791805d2245fc7c6405b243d5fa1e30d8597c6467e738985481bec4c5586a60", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616955, "uuid": "3a807b6f-e1f7-4355-9197-d0e2fa2db624", "comment": "Malware payload", "value": "19f0f5890b10837f835895c64c5a8daa60817536", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616955, "uuid": "394e6e49-d06d-497b-b08f-89450d66737f", "comment": "Malware payload", "value": "6f04f5df42e0a85e7a5b2292ddc78289fbc6a655ad51a940e8cf2b1c0d4e0202a5094cd9e44468d29cf5b86340ea6e22", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616955, "uuid": "29a937ce-a38c-40c0-b8df-e9983fcdd865", "value": "T189C080D990521553DCC13C54F09B4556E54DF6D41E044319E2EB027515155B070D0540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616955, "uuid": "adf5fc7e-59bf-4077-b8ee-81b81a2ec92b", "value": "3:TKH/bYTAJsGLpvQEFMLkVG4FBKsPF+bNTKKgqRHFIipVaK+HJPjRQv:AY8JsGFQsI4Fh+bNVfp7uz6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616955, "uuid": "a3ba9568-30ca-4245-95b4-24e9508f0ac2", "value": 169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616955, "uuid": "2a0a02f5-4a7c-4fae-9a4a-7c309ddb4670", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616955, "uuid": "3d9a2c9b-5c54-4488-a99c-8a3af53a5ccf", "value": "f.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59531ab7-bc77-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588123, "uuid": "eac8039e-e980-4c41-93a1-789f02ee739a", "comment": "Malware payload", "value": "b32fdec654576b15112d1224a2a598a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588123, "uuid": "5f72a625-88ca-427a-be3b-9f906c9f3ead", "comment": "Malware payload", "value": "779696f4bf969ef9da50b98c884bc149a601847c5ca3b854bb2fd6909040462c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588123, "uuid": "3960ffb8-ce83-4bf4-bec0-3d3c918ea1fa", "comment": "Malware payload", "value": "77dfe89e158160aa955ea0628ccab08a8d3f75eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588123, "uuid": "f76d7792-909c-4802-acfb-140c83b260fa", "comment": "Malware payload", "value": "5a810585314e180bcba4c7f80b04b2abb86ed5994d3e88024c52b33cfb51bbba17ac0610a6456ed3fa336b121e003bf7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588123, "uuid": "7477256a-94e8-4e15-8797-71e07cc31d76", "value": "T1ED444B4977A400B8E867923DCDA39A86E6B27856077157CF036443BE5F377E09A3D322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588123, "uuid": "ced36b45-5af4-4a7e-afea-d6f4a09974f0", "value": "5bc0b70caf749d10ae7da841cddb62da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588123, "uuid": "b1f9f297-e58e-46b6-bef8-8bdc3cf9b68a", "value": "6144:87T0hlXUHxPFOA8c28cd+TUF2W4HuTxm+EiLCyyw:8U3wFP2mHWm+XCy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588123, "uuid": "84986380-cbf5-4410-acf2-99704570d951", "value": 262656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588123, "uuid": "3d52709d-07a6-451b-a924-80afec6bc9f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588123, "uuid": "f17a03bf-dcea-4465-b206-dd2a22f1eb6a", "value": "Software.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a616de2-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620713, "uuid": "797dfd66-12e0-42e7-b03e-ed65fcfb1cc9", "comment": "Malware payload", "value": "09c4f031b6bdbaa54c822c26b8cc649e", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620713, "uuid": "436eb558-61f3-498a-917f-8c2c1fa061ef", "comment": "Malware payload", "value": "77fa47c9eb3222bb2225db53fcfc1cdf1d58f1ec02bdaacf9ad29f5b7ce5000d", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620713, "uuid": "adbce98f-ae68-4168-8b00-f79423891c06", "comment": "Malware payload", "value": "cbe897ec7df5031341ff30a6a4c568fe32ea5d88", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620713, "uuid": "b1677c1a-2cf7-4150-a8fa-52053c6b66b0", "comment": "Malware payload", "value": "db82caaa7380666ca066e329d263613c3ea698067990e52bb14ca34baf21dd6068d82002c214ada2d12bd26538b83cac", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620713, "uuid": "4a83fcf3-a946-4a75-9f07-a57520e65f92", "value": "T1E1D501225E14DC887789353E2EAC6150D3E0DEB72DB7E65052A3EBEE273A9444720F71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620713, "uuid": "992087b2-6d97-4675-a788-f2f7c8344029", "value": "49152:NS5iM+G2SleiaT+xslKPP7CqYi+d22XTFbHk1Po:J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620713, "uuid": "34ef983c-d666-42a6-96a7-69663f9f751d", "value": 2764418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620713, "uuid": "6324aaf7-a342-4352-9ba1-688c360a0742", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620713, "uuid": "20c41c1f-92f4-4f2b-80f4-0bad605755e0", "value": "ORDER No - 14100058.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ea2418-bc44-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762566399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566399, "uuid": "45692a8b-00ea-4f19-8ab9-7cfcc14b083d", "comment": "Malware payload (Mirai)", "value": "f210fb085feecb5c80dc5737ae2938b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566399, "uuid": "51000394-5394-4ee2-a991-67e26e5f6c57", "comment": "Malware payload (Mirai)", "value": "7839ee3462d9ea4fe1fa5f94a73e6284ba5bec2f0174f078661f68a3a07771e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566399, "uuid": "60f62802-bf6e-4ff8-ac85-497f1a0d5607", "comment": "Malware payload (Mirai)", "value": "4466072e8f81e0a48f8359cacc8b37793a7a9d4e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566399, "uuid": "61fc701b-76e3-45cc-b7ac-da26497fea35", "comment": "Malware payload (Mirai)", "value": "c69a68acf092a0a5cad51049e9adbf361e8f22eea78aea1c6be54babf9de1141ea957f15763b0bbcccf42b1a74e59504", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566399, "uuid": "300cb0a0-9d7e-4244-825b-737c8c1e8a04", "value": "T145B309496BB24F7DF6AD833587B39D24A644238523E6D280D1ACD9146E703CEBC4F366", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566399, "uuid": "96f492da-7633-4ed7-8ebf-51f5ceb9cc07", "value": "1536:YT2q8g7NcQvSAytb0g2byymic0EeoSKUSKQaUAISyC90gHM3/hz7RD9uH0owkIuT:c7SIuivvMU34CcU9EtA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762566399, "uuid": "ff6368b6-96ea-4ea8-a84f-6315d99993c7", "value": 116340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762566399, "uuid": "58bd0aeb-9f77-4ceb-8ab9-840120fe9a90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566399, "uuid": "ca029e50-e580-4cc6-b560-b611514a8e1c", "value": "b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157992db-bcc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621939, "uuid": "1d79f143-803e-4a84-a521-ce949568c9c0", "comment": "Malware payload (Mirai)", "value": "12ba76712ac8990493e900ff7ae7d60c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621939, "uuid": "4484acd8-9822-4933-abd8-23e3b8d437f3", "comment": "Malware payload (Mirai)", "value": "78c4ac944f9368e24d43d59d3806f435b634ebb3a663d55a0b55752423ebc3d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621939, "uuid": "4874ad49-80ce-4623-94be-4ef41284c43c", "comment": "Malware payload (Mirai)", "value": "608a6195317a1169442b8bc0dd4c2d3ebfd10421", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621939, "uuid": "e9b23e09-e141-41a1-9b32-8c81da9fe684", "comment": "Malware payload (Mirai)", "value": "416ace89a38e3ebb398c575eb40b3d0eae2379f494d72dae7c8c106e7342fe0ce872cd30f68ae8ab2d8070c121586029", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621939, "uuid": "aeb367c8-9e4e-407c-889d-ed769891c30b", "value": "T1E713F11D80E19947EF9E9B3C69EBF4890241C91FEE47A4ED1FD07636408BA40ADAC3D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621939, "uuid": "e5b1783a-6a61-424d-9df5-5cb04ce62957", "value": "768:rpiuuutJawmVE49+0htB/MSRDYgWG+My3r16N6lZ/mMB+PnbcuyD7UHQRjU:rLtJafVEf0lMSRDYgf+M6AN6lZ/lWnoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621939, "uuid": "9b27387a-2aa4-41f8-9ac2-45c7330995b8", "value": 45300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621939, "uuid": "f48b75e9-9fde-4a15-b184-0acd50d97b16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621939, "uuid": "52b11256-61e2-4e89-95e9-b41aa6315e01", "value": "executor.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd96f09e-bc4b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762569501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569501, "uuid": "1d20b3e8-a3b8-43c3-b857-08c2ef991ae4", "comment": "Malware payload", "value": "88a27c18312cb5b027908aaf7f8296b2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569501, "uuid": "3355e317-2694-4d9d-a44e-ca3e2ca9753e", "comment": "Malware payload", "value": "7997eca9041eb31e0264e9273d28e3b672f6f6cb206919ea1167610cfa601f93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569501, "uuid": "f7f65b5e-2b94-4807-8a5f-5be482989fdf", "comment": "Malware payload", "value": "287f81f1dea9f0dddfa704a9ac67ee56347e938e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569501, "uuid": "e8aac613-b760-40cb-808c-6dd2799709cd", "comment": "Malware payload", "value": "ac2bdf20f1c411a73d756be61e8dfd96492b9e32cf59eeb91c80690046cae27eea20be8ffd7984eb52d3329bb6cbf89d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569501, "uuid": "4a8e1f9a-3237-46e6-8729-4e3bd0906ff8", "value": "T131837DA8F90EAC41D2D7E37AFD958BA172273D98C716C2B17D01A34CC8F69D4CA91913", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569501, "uuid": "acd76a0d-8efd-49ac-8948-7ab3f0d1c833", "value": "1536:42oVxWQl3z3o4mpE6H5tK4+h90k2Q+GK0reUYrco5sKauPzJIr6FQ:42TQljK1H5tOv09zU7Yrc+sK+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762569501, "uuid": "7a5e3ecb-69cf-45ee-adbd-0babf77c6d03", "value": 87696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762569501, "uuid": "08146e81-a4c5-4649-a8d3-bcc12adc3eaa", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569501, "uuid": "ea6027d7-d1a5-44b8-9770-52a3fb83bee1", "value": "frost.aarch64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae94b18-bc9d-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762604634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604634, "uuid": "5c361e1f-9728-4ac8-94a0-11e4df9a8bc6", "comment": "Malware payload (Mirai)", "value": "7080d6b24870c088b81be749572d6ec5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604634, "uuid": "dde9608e-6bc4-4aee-b181-3a4aa5335145", "comment": "Malware payload (Mirai)", "value": "7a21386ad5715bcdee082d4d2d6b0e863a88bac3606541866fdaf69ba348ec79", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604634, "uuid": "4d601439-6cf7-43f9-8595-7efe3d4fd39a", "comment": "Malware payload (Mirai)", "value": "e17c108ed42a1422c85967e406da4077f3b5fc44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604634, "uuid": "8fd10351-17da-4be4-bcba-5ef94298553a", "comment": "Malware payload (Mirai)", "value": "4dae9608886cdc875d888cb812c6c34c7b0a7859346dcf2bcae9439638a238bee4bdcff0f7f0e5a485c3d9f98b05b24f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604634, "uuid": "f2cd77e3-6392-4b76-bf0d-63c2395b6042", "value": "T1C9D37B73D8256E98C625C5B4B0648F782F43D1A881436FBE69B7C2B05487D8DF609BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604634, "uuid": "a4c0091e-615c-4be8-b623-2eebf07b7703", "value": "3072:QOuckx3SPfcjjNr/qDhTdDWIZ19K6hh1LGb6:QOucl0jNri9dSIP9dGb6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762604634, "uuid": "3c190550-9f2c-4807-bd75-3b21c0d733e3", "value": 141920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762604634, "uuid": "19a9169b-c0c9-4a32-a0de-2fd0e5d82153", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604634, "uuid": "831d510e-de22-4d08-96a3-29efeb10172a", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa55d0e-bc93-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762600240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600240, "uuid": "d3ec7a45-87f0-449a-a99a-7c155a78a3a1", "comment": "Malware payload (Mirai)", "value": "0a45032a002ff7e23c3f341661ddaf5b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600240, "uuid": "677ffde7-2c8f-48b3-a363-e664e5ba2c92", "comment": "Malware payload (Mirai)", "value": "7afb45618058429a22eac7b28827faa9f5f0e3bb259a7440d721de80b49de843", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600240, "uuid": "71f78523-8680-4778-af4e-2dda431467be", "comment": "Malware payload (Mirai)", "value": "cbd167f6790299b8c7543ef1f1fbe965af440045", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600240, "uuid": "06db3446-a564-4236-9321-6b765d40ed92", "comment": "Malware payload (Mirai)", "value": "f958d9f490ddad590938d5fdf0ba24124580e8e7b30931f40a4b3be1aed9cfe50041d8b4180ed7779bbd408d450259ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600240, "uuid": "2ef573f4-b49d-461a-92dc-f0e6b3809159", "value": "T1B3A32C47F9928E12C5C212B9FA5E514D33136FB8E3EE3212CD24AF6123865DB0DBB516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600240, "uuid": "141819a9-c1ff-44e9-8dbd-6146c4b329e8", "value": "1536:1An+3IsJ0KO536EcFdtO901VSpW3lz7WaSp1SXzDgRiYm13eiC7SN5wYo02:/YyleiSQVz7WaSbm13eiCGNiT02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762600240, "uuid": "b427db36-b4fa-45c9-9e89-5e770e50c872", "value": 99036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762600240, "uuid": "13d730ed-ecd8-41ee-8189-dac27e31b06c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600240, "uuid": "afa762e4-1c75-4b1d-a4b6-d27a57df13c2", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3702957e-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602239, "uuid": "9759ac40-ff72-4a74-b5b9-c18f9c6dfd14", "comment": "Malware payload (Mirai)", "value": "70054e7ea584c889759b2256cad05966", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602239, "uuid": "43a61d07-3231-4913-8a08-46d69ae588d9", "comment": "Malware payload (Mirai)", "value": "7b137569d4481d484479fac6302fd1dfe64e42535f172a20b1e752c203ed99df", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602239, "uuid": "f4797393-fd8c-4fa9-b3b2-6e9311b6be23", "comment": "Malware payload (Mirai)", "value": "e0de58f14ea8192ab1f4bc28e22890827f0d9df4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602239, "uuid": "2bd48212-19bb-46f4-a135-b1bfb2fb721f", "comment": "Malware payload (Mirai)", "value": "1139f86252840f692896b12bcff08534ed67cf97f25541a2cffbd096311fd48ff5eba32817039784ddb35627701cfeb5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602239, "uuid": "0e45bf3d-6fbd-4ccb-a7fc-2faad5e4721c", "value": "T1A451E9C5E2E46D302CABEE13F6B6436C7085965318E37FA6DAE4BAE0064FD143141753", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602239, "uuid": "f4dce912-cdd3-4e94-a5d9-03cae339a13a", "value": "48:vn7q7N7hnJ6GnghzPn5KWn7oUn777o7Unfw3bn69Rn/cgn2pVnhSOn9+CnAfTn4K:vn7q7N7hnJ6GnghzPn5KWn7oUn777o7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602239, "uuid": "f5333967-ed7a-4a22-88e8-682a5651c2e5", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602239, "uuid": "77438695-f785-4deb-881e-b75c43655df4", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602239, "uuid": "5b76696d-1930-445b-ad89-e29be7ab5258", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1837ef31-bcc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621944, "uuid": "24899948-f5e0-4ecd-b1b2-fa727586ac84", "comment": "Malware payload (Mirai)", "value": "e239ef56a2f435357643b7c66f75bc4d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621944, "uuid": "4e4bd2fa-d2ef-4d81-9a47-995178c58e66", "comment": "Malware payload (Mirai)", "value": "7b193ca63426e8cb4cd9cc6092ad72e979fdec30b08ef6309f18e2b8128e6cee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621944, "uuid": "2929e4d4-aa5a-4457-94bb-0853ade859cd", "comment": "Malware payload (Mirai)", "value": "8ba0751bb63017143f36ad6f0b49bd21ad9745a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621944, "uuid": "0c224fbf-5466-489e-b376-cd58b7bd33b8", "comment": "Malware payload (Mirai)", "value": "4a03d35ad0d7738888b1d4d80105a30cf0fadd0037b443e97d935642440e85af999859a52f87533c409296961cee6d30", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621944, "uuid": "c936fb64-3d1d-4669-b009-42c0eed1058d", "value": "T19C338E76C42EADD8C6458734B82A4A740FA3E10491E76EFA5B8586A54043FFCF61C3F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621944, "uuid": "8f454ee4-f171-428e-ad0e-6c439fd92ac4", "value": "768:Er9Q6eGyC75erUUeOiwwtNp40Zdi/FyGoMuJLk3XCmlolN9aXCxk:EcdC753UlwtNEFyGoMD3X3qlGXCxk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621944, "uuid": "c748c059-a0c0-42c8-b599-3ca1de5a6558", "value": 51924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621944, "uuid": "d31fb641-8a1b-476c-a788-f65abea4dcb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621944, "uuid": "195b4b0e-4b00-4f23-b3dd-5371266a4586", "value": "jew.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0216a4a8-bcae-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762611599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611599, "uuid": "d1c7ef90-7365-4f71-93b4-dec049e9565b", "comment": "Malware payload (Rhadamanthys)", "value": "39c0fa5cd2d3a5a302728c72b63a3784", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611599, "uuid": "2c1f72d2-0382-47b4-b822-05fe8cab265c", "comment": "Malware payload (Rhadamanthys)", "value": "7b2e8ff937b6c0db8d62fb844971ccb5a33c3f9bc99b4c5881a641128a6c454a", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611599, "uuid": "70e5fe05-f62e-49d8-9786-16a6927b4ac1", "comment": "Malware payload (Rhadamanthys)", "value": "77bf4f65921b2c078816cf3a766c15aaa6cbcbf6", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611599, "uuid": "3b428c2b-f87c-423c-91fd-5ed1bbe5d45a", "comment": "Malware payload (Rhadamanthys)", "value": "29b112db72f75f1cc9c48b7b6dc4bd41e3aa231a7584d9cee318bc69988dc52d8c85a8338a34384dd5fe8c71f6f44e2e", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611599, "uuid": "36acf9f5-0fd8-4586-ad81-5057a7890fc9", "value": "T1CC97338AFE9E1124E7A3DD7AB497261C5436C916C766F62FAC7C32006C637A60F0D607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611599, "uuid": "8fcef130-2e91-4d07-a5f6-0255f3da57b7", "value": "786432:6npG5cIxEorZTaLDMm/Y/R3eOaSvV+JJIJHaeZl5qWQeaM:Mc5cgZTaWJFvoIDbieP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762611599, "uuid": "86f3dec9-8d62-4e43-817b-bf7ca294e03a", "value": 41995577, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762611599, "uuid": "b5413d49-a791-4456-b583-97ec3c253a96", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611599, "uuid": "944a69f2-603f-452f-ba9a-1ed6477c13ed", "value": "#Pa$$w0rD__2025--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6988f48d-bc6e-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762584285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584285, "uuid": "44d59001-0c4f-47c9-97f7-7d76aaf1dea5", "comment": "Malware payload (Mirai)", "value": "caea4553387f92a05b24336b422554c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584285, "uuid": "9d11b058-f410-4dba-9d77-dc5a0721d847", "comment": "Malware payload (Mirai)", "value": "7b40f6a6dd6321cddc1c47375db53b43409bb7ccaf973ca0c48e17475a78184e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584285, "uuid": "308214df-6604-4d4a-8697-1191dcb34d0b", "comment": "Malware payload (Mirai)", "value": "d6d738ce907812a80c035e70c1031aa30bf86e0c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584285, "uuid": "58b7c4dc-37d3-4096-94ed-fb10b08d2847", "comment": "Malware payload (Mirai)", "value": "3f30136d0131e6c67a4d34119e57aa141c79a6636cc536abda0bb41bbf06e3056771f95f333f6fbb96a0843ed508e0c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584285, "uuid": "6f365405-d43c-4713-a71f-86f464606d05", "value": "T115B2D0EA1386BF02E6B0E8754D34C287B3476924F5E631273C1D970CA99B4412BFA983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584285, "uuid": "9798ff17-423c-464a-83df-e67e0b0223b5", "value": "768:WobNd+T5mrtKQOcc6x5oXHd+bkALaFL6lKs3Uozw:WoN8T5mrtKpLX9+bcJ4zw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762584285, "uuid": "a14b6eab-359b-47b6-8638-7e673e35d883", "value": 25488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762584285, "uuid": "aa3c6752-fbe1-42c7-8788-6c981a15923e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584285, "uuid": "b26f7b2f-0ede-4921-aa23-41203f059b6f", "value": "morte.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "294e193f-bc78-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ngioweb)", "timestamp": 1762588472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588472, "uuid": "912248ad-31eb-488f-882d-48e4bd6a72f3", "comment": "Malware payload (Ngioweb)", "value": "b61782a2897dba6c81602acd3dde8190", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588472, "uuid": "897f1b97-d59d-4108-af4e-4aa996aa8628", "comment": "Malware payload (Ngioweb)", "value": "7b43d80550bca89fecb7ae2fb40c74fa308216400491e0ad84dcacc2b2e166b2", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588472, "uuid": "a2d1f57b-6c03-465f-83ee-27264ae74485", "comment": "Malware payload (Ngioweb)", "value": "ddde217dc496a5f45e5c94234a00e9d9e1087fb8", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588472, "uuid": "0cc48f55-8a14-4c3e-98cb-9651dcfdf946", "comment": "Malware payload (Ngioweb)", "value": "34702dcac7e021deafe6b713649252f146b0eaa6263a1a5c746285f78197099c6c8913d4ad33daf892032488ee5f7307", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588472, "uuid": "1f3a38e7-a33c-4c5a-b581-da250840bfba", "value": "T1F4012D6E29D515D4C21CDA003D6CB43251B9D3C729F53B18A19C993780BBB08BF16E26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588472, "uuid": "3a45886a-195f-49d0-ae19-5a14637a6d95", "value": "12:78CA5CFC/5CFCO5CFCE5CFCX15CFC85CFC7b75CFC7k75Y:pGCMRCMoCMCCMzCM6CMvVCM4VY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588472, "uuid": "0ff426b8-aced-47fe-bfd4-8d3d65918f97", "value": 824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588472, "uuid": "ab4faf3f-42b2-458d-a1c0-65896b44e0d7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588472, "uuid": "d20e87d1-c0d1-46f5-be71-9e1533cf86cf", "value": "router-atemi-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69371e0d-bcb7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762615637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762615637, "uuid": "ee4ec8f8-7a92-4ed5-bfd6-393a4915d065", "comment": "Malware payload", "value": "4df8542c1ff57c202d0d52a8cdf7ad9e", "object_relation": "md5", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762615637, "uuid": "2caea88f-eb84-44e8-9fd2-b64eb105cf1c", "comment": "Malware payload", "value": "7bf06a78b670521d3c485cca5873ee5ac2d4af644035401d04e9e408ef8763b0", "object_relation": "sha256", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762615637, "uuid": "52f4cb79-3711-4d3a-a1e8-daff46930e4b", "comment": "Malware payload", "value": "b6ab559b407cc50e2196087540283e83037cea5e", "object_relation": "sha1", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762615637, "uuid": "42f42e4c-5843-4cf1-b0dd-953d7d1b1eba", "comment": "Malware payload", "value": "42bdd746fe112c14a2e5be8d67d76641945e074deadd25be3fff2f6b6b0eb11c4f2e49e1764390fbe75ff948fda89ccf", "object_relation": "sha3-384", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762615637, "uuid": "1169c74b-e094-4a3a-9633-1419618d6d0b", "value": "T18C06330D101973D29C8F25435AB2870787B88C6A16AE9BDEA7F61C33F7A3BB5147D418", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762615637, "uuid": "658f2405-ee2d-40eb-a93c-02ed721d9fee", "value": "98304:D9sUBgJisIG1V1Wlb98YnRAEt13HLtzCBOl13+FcwrfeNTYuQ2v:D9TsIW1Wlb98IRn3H71bwqdIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762615637, "uuid": "506b934b-6ccf-4bc9-8e46-723a046dab43", "value": 3957259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762615637, "uuid": "2d56cc92-19ea-4685-9a73-132d28719c6d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762615637, "uuid": "4d132fdd-a1e8-4eef-83f9-cde35a1e2f99", "value": "banner.png.0400_003c620b.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a1dcbe-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623473, "uuid": "bd3963af-5efe-43fd-a571-a68374a65a89", "comment": "Malware payload (Mirai)", "value": "fcb368ba737f72dfc0ab5ef2aa3794e1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623473, "uuid": "872dc9a7-7719-411d-b21a-b43e70116bfc", "comment": "Malware payload (Mirai)", "value": "7cd388f172bfc8118e8262fa11c2081180fde436f90c1b970a9b811be66d9dad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623473, "uuid": "e9987464-fec8-49bc-87d8-797000298422", "comment": "Malware payload (Mirai)", "value": "e103fcc15f7520952b68a6563fc207cb14aacd28", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623473, "uuid": "445050c3-49c6-4a7e-9b25-39dea8c39894", "comment": "Malware payload (Mirai)", "value": "7a8ad51f5c23a1b1f48995b61662e53fc3b51847a36c41cf1353c1c08e5f7d6fd9f7cf1635585ef0f974eba35d334294", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623473, "uuid": "5d4684d7-c11b-41b7-84e9-cc654f5bbbe3", "value": "T1F33302D2E081246ADF6BBF34981346A46BE58FDF1F565C5306AB9F216F1A83E4308C53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623473, "uuid": "66d6246f-e85b-4aad-8d35-8482b384d8ff", "value": "1536:0nJbta3BPOT+QDC/ZQzrZ3Bs/Y4hRf4u+qgw091:0nABk+gmErVO/zTf4u+qgwA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623473, "uuid": "e7df7058-a67e-4db1-aa61-050e10b8a5d3", "value": 53124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623473, "uuid": "70e5d81b-c8aa-4218-9801-ebc316692330", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623473, "uuid": "e8b4bf04-962f-4035-9a47-1c10983d3598", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7498cab-bc87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762595179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595179, "uuid": "d0573b06-ec57-45e4-86dc-ada8e1105326", "comment": "Malware payload (Mirai)", "value": "22ce3d709347dc3ace4292c93e870131", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595179, "uuid": "aa2b57fe-b1ec-4cfd-afcf-bffb4f086ece", "comment": "Malware payload (Mirai)", "value": "7d19310d45717a0b00124de0458164686a3401c706b52d99c31be1b46f0261bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595179, "uuid": "4cecbeaa-232f-496c-bfa0-7ae707869622", "comment": "Malware payload (Mirai)", "value": "cc0d4f0bcfb32a22fb24d4db21424408deeb18ea", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595179, "uuid": "75a2d649-9cb7-4837-8768-f57a6a3b862c", "comment": "Malware payload (Mirai)", "value": "29672ef8646c533f96145de2e85f1c96af76b6f74ec35c0842c0b3f7056a41ef4a5987f07b523aee90a411aff0e0b8c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595179, "uuid": "5ce96292-2fb5-4bed-acc9-c3e0ca2ff1e4", "value": "T1C0E2E131C0846AC5E86B6F74DF91E78533D65B0633724396E3B5EF2094729339616EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595179, "uuid": "e113feaf-f67d-41c1-9591-f73994c38d04", "value": "768:A3OGQJwsSpiwmQ6C4yX9rOU8AAMBMo4WYsMoHPoo64uVcqgw0RKWXJ:AE+piwekXNOFAzMRWYsMoHQ74u+qgw07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762595179, "uuid": "672d2ca8-46a8-4004-bc1f-b19fa499358b", "value": 33700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762595179, "uuid": "ffbde3ba-9697-4942-b5d8-70e22ecd523f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595179, "uuid": "1a5caedd-ec70-42d4-9b0f-e5fc8913282b", "value": "db0fa4b8db0333367e9bda3ab68b8042.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63832f8-bc6f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762584923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584923, "uuid": "71774859-d20e-4c01-b774-1b288ffcf6c9", "comment": "Malware payload (Mirai)", "value": "10821a5d78c82d435d01476d562b4a04", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584923, "uuid": "f3a44753-35de-4f24-bb53-66a0228991fb", "comment": "Malware payload (Mirai)", "value": "7d38030e056c8b13cb8521e72e590f8fe5266d2aaf0a9ac6800166c1c6b93e4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584923, "uuid": "0994bbd6-b495-42fd-9599-2ebcc49f0ace", "comment": "Malware payload (Mirai)", "value": "8dd1bb3372ac21d039b2fb8cf24da4b04be9882f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584923, "uuid": "80ed40df-d615-4172-898e-0e6ea8debc38", "comment": "Malware payload (Mirai)", "value": "7e98c3940fa111b46e69e386aed8b8347b80ca657a4a9b250103f12aaeb30071b8c988f7e0761a1d4b478796d1122f46", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584923, "uuid": "b33f47ea-631b-4807-b75d-fbd7da6d17e1", "value": "T137733A42731C0E53D5B7ADB4253F23E083BFE59020F4BA85651E9B4A93B5E325186FCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584923, "uuid": "14af6c1a-9e15-4441-b8f7-edd30923dc59", "value": "1536:YN3ZW8frhXIylwUWOhfiifi8y72hKdzaWtQusNbJqiNU7:Y5E85JwQhfiZ7bdhRs/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762584923, "uuid": "fa8f4d1c-9f37-4d52-92ae-f1ec3d4d8707", "value": 80200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762584923, "uuid": "bb4ea32f-ca78-40f7-9a11-5bdac22c2d0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584923, "uuid": "a8244704-457e-4e1d-ba30-e6b000e39694", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c064762b-bc9f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762605476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605476, "uuid": "7a9cdd46-b67d-4b21-8045-5253ad10d8a3", "comment": "Malware payload (Mirai)", "value": "434f2189d4cb451cfd1a400b6427cdaf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605476, "uuid": "c0b9671a-5c10-40e1-899e-5ee235dbe4aa", "comment": "Malware payload (Mirai)", "value": "7d83bedfae9dc3589e2f63b3484b678b7c5b744df0bd0f97066af8614e604591", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605476, "uuid": "c0f64c25-d7bf-41a3-b455-f62bcc603f0d", "comment": "Malware payload (Mirai)", "value": "a6f0508f02186648b31d57c9bff14dc3ff5ebf56", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605476, "uuid": "91c8f0ef-f526-4f45-9771-31af616f2c66", "comment": "Malware payload (Mirai)", "value": "44ebf50729f2ea55b71cbf3bf74e20cc6288d15d5427f143a6e764d688b70d6835554ef2352ad812a237623070610cec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605476, "uuid": "d67ea4d0-79ea-4938-8523-4a6d94e7a03a", "value": "T11103E1496D910F1CDCB493351F9BFA5B0210A115E4EE8366FCE8F053D4A6F6D6828ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605476, "uuid": "3c2b57ff-b5ac-4039-b244-9bf057e676d8", "value": "768:RpS+nJVhHnxQLX/bSuHKzWNZsW+hzYkEK+ngSG5OKgN+xenbcuyD7UHQRjFK:RpdnJnOD/bSBzpykEngSKxenouy8HypK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762605476, "uuid": "58ac260c-f3c2-4f8c-84dc-113773908642", "value": 37820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762605476, "uuid": "a0ffb2a8-4922-406b-ae15-858000f90d55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605476, "uuid": "cb96344b-2e49-48f4-98a7-d8dea1323e28", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd14a8a2-bcd8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762629978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629978, "uuid": "90223e41-1d3f-40b7-badb-36a8a573656a", "comment": "Malware payload (Mirai)", "value": "abf8953fb68f5ca98da07bbbc092b2e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629978, "uuid": "eadf7c26-93c6-4b52-aed1-361990f9d8e8", "comment": "Malware payload (Mirai)", "value": "7de14dfc1253af154d79108863cab5ed2ca483152b632943160378c1b3ac9efa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629978, "uuid": "ceac4570-3629-4175-8959-37ca5eb6ee80", "comment": "Malware payload (Mirai)", "value": "5c9cd82eca675f4f46aeecb6fef6b3a4db365526", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629978, "uuid": "ca03415f-7603-4a90-b878-fd6abc0f2a70", "comment": "Malware payload (Mirai)", "value": "89f22e8b323aa20adcb820c1ecf9148927ad3192337c8c1690a5e5f15324288897452aa10b318b570a6b852100613284", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629978, "uuid": "6413cb2e-e9a7-4e6a-872b-fb3f8177105d", "value": "T1C9935B01771C0E43D1A75EB02A3F27E683AFE59121F4FA89654EDF4A8172E73154AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629978, "uuid": "0f401fb3-4ec1-46f0-99d3-2823722d27d8", "value": "1536:KFbUTr9Lqta/ywK/aVWfZ+C9o0+AuaOfKWq+YNy:YbohIa/TnU+C9oCu2ly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762629978, "uuid": "98347ee2-9011-4251-8573-71f65c69f248", "value": 91720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762629978, "uuid": "6e15a8d6-6190-45f6-a98a-31e9b644954b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629978, "uuid": "9fac460b-ba87-4ee0-97f1-a285efe2bf03", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e571848-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762588883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588883, "uuid": "d85e1527-6681-45ee-84f3-f17301d90c0c", "comment": "Malware payload (AgentTesla)", "value": "85c97930ba5e22b0af3e2c40056d3f6c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588883, "uuid": "b3d9909b-7b0d-4d47-8d1c-62c64c8a0ff9", "comment": "Malware payload (AgentTesla)", "value": "7e6d58dc8b6dfaf4bb5b079b2c9cb9172dfee27cb358a21580986b5beb567eb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588883, "uuid": "52ec5885-ba94-4de1-9b65-d9cff592f63a", "comment": "Malware payload (AgentTesla)", "value": "e2aa34eae760d889b78426a648b22adb82e37bca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588883, "uuid": "3ea8cd15-5fa4-42bd-83dd-8bb914d0e8b6", "comment": "Malware payload (AgentTesla)", "value": "b61eec0822c56dbe890d384930fa702333b2985ec0747c4e372bd3231f387b5b5b8a822281b17935e724c081d3c374aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588883, "uuid": "1cdc8525-6460-4003-90e8-92e99fa3e4ec", "value": "T11F33308523C0684643472B7B723FB0F5FE6E49D939888547C208BD90B5B670FEAE5A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588883, "uuid": "43be3b4d-6b1b-465d-9beb-e002a7783ee5", "value": "768:U8NMvEnXArDjpVFVetm2nr5U3yvJpi3EluPWFMRainxZlePfXS9clX4ntuyZYAML:skh6kvGB6Dccb2LSBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588883, "uuid": "b7cb9979-7419-4e06-9cf2-1fa26593777b", "value": 54529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588883, "uuid": "4acfbeb9-f9d2-402a-927f-70b718d7f99e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588883, "uuid": "561ae0b4-ceff-46c4-b0a0-fb8ff6ed8fc6", "value": "RFQ LION FILE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31eef4f4-bcec-11f0-91c6-42010a9c0006", "comment": "Malware payload (ValleyRAT)", "timestamp": 1762638308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762638308, "uuid": "81c4593e-8016-4337-9fcd-c40d8e4081b2", "comment": "Malware payload (ValleyRAT)", "value": "06aed4dbfb1ca5d1071f94c166a9cd41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762638308, "uuid": "94dbb01f-c1fb-4363-bec2-5e8e968707ec", "comment": "Malware payload (ValleyRAT)", "value": "7ed4fb65dd859ee8ebe2c174fa9ba7ba953a5f3585f064e42c09d0a23f8d39c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762638308, "uuid": "e63c866f-67ff-4844-8aba-1888239fbd83", "comment": "Malware payload (ValleyRAT)", "value": "8a2ffffbbd12b0a50504dfa8a8b8683c3fa89d94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762638308, "uuid": "8a6cbfea-d723-40fd-9530-397f1034d838", "comment": "Malware payload (ValleyRAT)", "value": "458e42eac6c3c00666ada96d52e84d3e3cb0f78eafe0924936b083419444f220ecc70cc51fda154107d6ba97a74418d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762638308, "uuid": "b8be6562-d468-4323-87df-343fc0f37803", "value": "T1DA47335852E108D4D9E5DFBBCC6242F9A3736F850219A372537C3CF1FA37B9A0966A01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762638308, "uuid": "fd4e71ab-83d3-405a-bcf9-fe6c80003fcc", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762638308, "uuid": "386fbee3-9f59-4105-bedb-f51d1b2136f9", "value": "786432:iO1QtIcuAmQ4qtiyXKw4lHcjbD0pmr9nNy3ceyHC:iaiIcZUk4WjbDfNCceyHC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762638308, "uuid": "f1c24b95-f74c-47e0-bc87-82f98f7e5fe3", "value": 26042971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762638308, "uuid": "544eeeec-de5e-4cc3-82c3-90e8c50e4e59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762638308, "uuid": "a1ec93bc-6e71-4165-8f73-e93375e120d6", "value": "06aed4dbfb1ca5d1071f94c166a9cd41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafe61e8-bcf9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762644202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644202, "uuid": "233f21bc-150b-4ff0-a951-0238dfe5a7f2", "comment": "Malware payload (Mirai)", "value": "707239e4b640003b117d1e98b080f6cf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644202, "uuid": "a395fc63-cb4d-4f7a-ace6-f67191009e81", "comment": "Malware payload (Mirai)", "value": "7ef0716357c8556aedbc946a393250b22e2be7950cc2449a4427efa6f98f469f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644202, "uuid": "ecb4e5d0-2e4b-47b5-b0f9-3ae4cd20b938", "comment": "Malware payload (Mirai)", "value": "1b6cafc347b9941296ef53c067874a5cd315a4d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644202, "uuid": "4b66ab0d-ee48-4223-b0f8-3d6aad431304", "comment": "Malware payload (Mirai)", "value": "b83ffa6744d97469b916347fa093d190373a2c336dcf481005d7d6cfc481b5f80cab945179b8b00c16ff12d5d73a4b9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644202, "uuid": "8d22d476-d1c2-4b33-a850-06398876499e", "value": "T101934A56BE41C612DAC525B7FB0E828D772743A8D3FE73038E265F71638A85A0E3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644202, "uuid": "d09153af-39fc-4cc2-ab0c-3a15834aad43", "value": "1536:vQwSTikj2tcPM6y+kALCFLgJO+iNj+emf:vQNTDj2tlX+kAdJP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762644202, "uuid": "7e95d3a7-8b7e-4741-a8c4-1e682f494e7f", "value": 89296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762644202, "uuid": "c402f578-8b10-4c40-ba1a-877182f58047", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644202, "uuid": "a0ad73d2-6595-4f5b-af66-546eda9809ad", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c583e3ae-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602478, "uuid": "e1ff7279-8922-4b7c-84fd-8596f32bd53a", "comment": "Malware payload (Mirai)", "value": "fcf6b5ae265a0de86973fc0150799ff9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602478, "uuid": "e7b6e9ee-cbaf-48ba-a8e9-43c7d8d3331a", "comment": "Malware payload (Mirai)", "value": "7f4b6c3c0661848b2f220c9ee30a33f18b01d78747d4f87b1aa5bdde8784ec17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602478, "uuid": "ac7bdfba-a38a-4e5a-b9b6-095507e63378", "comment": "Malware payload (Mirai)", "value": "9ecd2fb46096b8e0ba228873f784b1545c1bdfab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602478, "uuid": "873d5626-7e13-4edc-984a-d61b6a03805a", "comment": "Malware payload (Mirai)", "value": "b75464ecea580ce153075ca0c4b70e8b3f7298d6a3ad2bd91453c29e5167a167e6db5a2d74821aecc03bf17a1922736b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602478, "uuid": "46b82702-50c1-46e2-873f-c448987347a1", "value": "T19ED33C46FB418F13C0D51779B6EF42453322A795A3DB73069A285FB43F8669F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602478, "uuid": "2081c658-e966-4886-a1be-01bc72b25b0d", "value": "3072:BxioDMQI5nrqaO4nt3qZg2IWu6b4MX7LkDM/98PmPw/t93:DioDtI5rZnt3qZgPWjHX74DM/9smPw/f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602478, "uuid": "f0c6227d-44a5-4d80-8e41-d193ed271a57", "value": 135877, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602478, "uuid": "0b479ab8-25a8-4e67-a303-c9c98c03fec3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602478, "uuid": "e8818f95-fb8f-4148-8827-65a55e70abee", "value": "uYtea.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21c2edc-bcea-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762637664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762637664, "uuid": "9aaaadd5-75c5-4f07-a5da-f4e013841eba", "comment": "Malware payload (Mirai)", "value": "0167247b644b43eab0ab0fb973f34b84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762637664, "uuid": "2dd979e4-3ceb-48de-9135-e582d43dc72e", "comment": "Malware payload (Mirai)", "value": "80f347a65e6868bbe1faebbef90951118c936eb58270bbfcac778a32f20c3d52", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762637664, "uuid": "17b742f2-c34a-4051-a716-5e73827329f4", "comment": "Malware payload (Mirai)", "value": "a10357e5caeb4f8e07644f0edfb14c8471956be9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762637664, "uuid": "b2f858d7-57a9-4f50-b112-5f1228355002", "comment": "Malware payload (Mirai)", "value": "404be84ff9c389a4f47fa774d61e2bdb07535b9f350c5b838a91aa79aaa368f80b8fa4c40175bd937871c66d3ff41993", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762637664, "uuid": "7bc4879d-f2b8-44e7-8cd0-426077c57098", "value": "T1E8933A56BD41C612CAC125B7FB0E428D7B2703B8D3FE72039E265F61638A56B0E7B542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762637664, "uuid": "c4ad36f7-9366-493f-9703-9b4ebf464ee3", "value": "1536:ccsGYnkptrRcNKcCih8pFXWtJDn+1evC1Iemf:ccfuqBR6TCE8pF0BCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762637664, "uuid": "c45c0405-03c4-4373-a808-6a5a5bc6b4c4", "value": 92808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762637664, "uuid": "d2e01690-9ab5-4e16-9779-bd5aaaa34f73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762637664, "uuid": "45fd44c5-0b33-4fce-955c-55f280639cd0", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5bdc52e-bcb8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762616303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616303, "uuid": "7c96564a-5a36-4444-a575-79c3ee949516", "comment": "Malware payload", "value": "ea76665336aa50ebc10a7fd15d3af010", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616303, "uuid": "49d282e4-a122-4eeb-9e54-2f4c9b683a49", "comment": "Malware payload", "value": "812194fc5d19c2511e0246ac22e49f763d251081f6f810c787f99bd711ac8d7a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616303, "uuid": "d393ea4c-6e06-47b0-87ab-f670c79525d3", "comment": "Malware payload", "value": "71c64129fe1ddf7fa5f7afb4395d37ff7c590722", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616303, "uuid": "23fd520c-38b7-4b28-9d7d-a3ce8b68b70e", "comment": "Malware payload", "value": "b8a62c780dcd16398649c086e601d401341fbd53d4cff1082dba731b2c7fdd69bb1dbae133ff8f683c9953b837731cec", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616303, "uuid": "9fa9ab09-2088-4889-8ebc-bd62d9932d3b", "value": "T11926126417CC444CDFE9190A5A3D3E58B68C342ECB298F4EB20F98DC7FA4960B5E6527", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616303, "uuid": "e9c360c2-d4c2-47d8-bd38-d873bb913290", "value": "768:8bFXa/tGge94jnvADRwtypzbWof+B9tJbXOwEazmPfTWpehnKBtrjgHBLaojZcbh:ulaG9iAR+BpErWpKYjgHBmb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616303, "uuid": "6b7cac45-28a3-4e24-8da3-cfa1f52f319f", "value": 4550838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616303, "uuid": "ccbe32ae-321c-4f07-ace6-1df09af706b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616303, "uuid": "450246ca-fc2d-4d2f-bf08-aa1bc0568f4e", "value": "Enquiry_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fc7a6d5-bcf9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762644076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644076, "uuid": "b790a5d6-57e9-4499-9577-85b62265c377", "comment": "Malware payload (Mirai)", "value": "0e67a42ad9817e886cd51f401ee33d12", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644076, "uuid": "ec50fa45-4eac-44bb-9a66-324493bbdc36", "comment": "Malware payload (Mirai)", "value": "8171c1f847ae3b8c3e9847d1b594972fa093b46e76864bd9fdfa0c1a16fdcb99", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644076, "uuid": "37a86ce4-1128-4802-8c68-0411bcd82c73", "comment": "Malware payload (Mirai)", "value": "10fe2fb26cb66cf9f2f43fd2e7d8f1cb01b19b46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644076, "uuid": "208d86f5-413d-47b2-8a48-6ef02202273b", "comment": "Malware payload (Mirai)", "value": "16f195a6fcb9e396caf9984434cf1b36b4cd62e34b8c00e2d3377735732490689d5cf973e7c0ce6b6a4fe2dac7941828", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644076, "uuid": "8de24b08-3fdd-49b2-b30d-0c1e7122b10f", "value": "T128834A47798080FEC499D07497BFB536D873B4BE0239B19A23D8FE273D09E605E2A552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644076, "uuid": "74a52541-5261-485f-9111-e4a287a90851", "value": "1536:+YsezAuncQTqF3BKYaE6vlRvU5IaRwujoI9INBw:xsPuncQ+F4YaXlRRaRwujosky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762644076, "uuid": "1b3dcae7-6db9-4cd7-922f-7ac38b39d164", "value": 88144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762644076, "uuid": "7737c796-d213-47c0-8a44-3c87f992a30c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644076, "uuid": "5c0a916c-5947-4a9c-b83b-2eff22a6c227", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b035895-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762588904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588904, "uuid": "0ffc94e5-0572-4ca0-b93a-9eeac4d6d855", "comment": "Malware payload (XWorm)", "value": "5ff58866ff6df89badb64c7a5657574a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588904, "uuid": "d71a13de-b46b-44dd-9ace-953a52656071", "comment": "Malware payload (XWorm)", "value": "818ff53dc566fff967d109ce7db973ff002170d89876a76022529d8a5b21ac0c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588904, "uuid": "79992902-fd17-4753-a8b2-243c0d3c4a20", "comment": "Malware payload (XWorm)", "value": "26a32293feb49ac9655fa1a4287a4b2d44752fab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588904, "uuid": "494c63a5-4ebb-401b-9f1a-310847a7e05e", "comment": "Malware payload (XWorm)", "value": "ea96b6f56d085f22524b6fdfb33dac09f782267a1268934949d709f58145f6918ac8e630b4699c9fea01cbc0c80818f1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588904, "uuid": "084d1891-0f13-4168-92f8-c7c2bbd5d163", "value": "T1CB4442F1A98C1D417C8B6863C13DBB1F509BD50E5D33819CE8BDE4D9822D7A642A278F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588904, "uuid": "7aad0225-c66a-4cb2-a1fd-c2d4c08ed172", "value": "3072:NkItjczOH8RcEQL4vNanIGAILHIeSqcpy7yfaU:NkItYo5AqI2yCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588904, "uuid": "b7569561-04dc-45e7-a7ca-b3e48ebdd632", "value": 268916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588904, "uuid": "ef0d51a5-bf24-49f0-b011-3c647e66ce60", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588904, "uuid": "3c960ec7-a0e4-4ad8-875f-249022691724", "value": "AVISO DE PAGO_JPEG File.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a56fca58-bcd2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762627335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627335, "uuid": "a3e991a4-dc41-4979-a764-198588f33444", "comment": "Malware payload (Mirai)", "value": "3a9fe84279004949c25e891fee730b2c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627335, "uuid": "ea3c9d21-ae66-4a83-b5a8-6f595012fc8a", "comment": "Malware payload (Mirai)", "value": "81a5ff6493ec66572c8ce6123606d502ec30eb57c9897503e183a7f3fc61e081", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627335, "uuid": "c7644713-0ec4-4fdd-8a0c-6dc0c2dd676b", "comment": "Malware payload (Mirai)", "value": "3eaabff50c7a8d245ed19b1aa66cb0f1c9905a2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627335, "uuid": "779f8400-b9a3-4647-9963-853a4a1729c4", "comment": "Malware payload (Mirai)", "value": "0a3f33497f0bdf5fc8b2cbb594517dff4c3f563f373e9e0b8f77a6f798a112fbe683a0706a92c6c0e91a897e599e1a84", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627335, "uuid": "c8f3d115-b14c-46cc-80c6-c899cb330fe1", "value": "T10DA32A46BD818F13C6C622B6F7AE018D37167BA8D2EB3103ED24BFA1338659A1D37551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627335, "uuid": "10a58000-c0aa-4fbe-bf10-0bb6f1b05c57", "value": "1536:QV2Piyf0X8RwMOGT2zbOu/ksuB+L/b5jcCqnagIUhXe9WjvIEV46m:QV6iV8R6GazyYy+jbxcCBKVx46m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762627335, "uuid": "2948ff49-c537-4829-949d-8a8e54211f90", "value": 98908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762627335, "uuid": "3e610595-0451-4872-8dc7-1ce465f036a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627335, "uuid": "5dcde40e-1889-4768-8c66-08ae7689124b", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03fbd8cc-bcab-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762610314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762610314, "uuid": "d30725e9-3ccc-47af-b424-d965d5c0018d", "comment": "Malware payload (Mirai)", "value": "bcc6a505ec6642fe56a9d81637d9d454", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762610314, "uuid": "75fe84d2-dd17-4866-97ff-f13790d406d7", "comment": "Malware payload (Mirai)", "value": "81dd27b4bd4bb5c0b9fc548c2787efb70045cd94bf14ef41db23dee92929b4d0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762610314, "uuid": "f5e32d42-51a0-497a-be42-a8bf4e74502e", "comment": "Malware payload (Mirai)", "value": "d146377427fed4d6b57ca8f6bb4b9eeaab4d1f9c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762610314, "uuid": "ccdb8761-9da1-4250-aed6-59b2bac29978", "comment": "Malware payload (Mirai)", "value": "b283b53780a4a786a0b5622dc08dbaba0e083073c275a72b43aa0c5ea02e7562c99e1720c86197c75df764525df8895c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762610314, "uuid": "4735c26a-ddbf-4364-85d7-a3946cb72017", "value": "T1E9C3BE97F34B20A1C8614BF407C78B9E2E6322119E6FD8E76C0F767B197A0DB5916381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762610314, "uuid": "a092abd8-f5da-40ae-9d7f-8bc4e5c13767", "value": "1536:DyyBsojG1jUDD9mFS2y2TtsaU+yK7FbHAqDcZ13fsxZJmcg/9/LWi:DyyB3SjUnX2TtsdNW1HHQ13tcglq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762610314, "uuid": "001d24ff-f3ed-48e0-9276-c0bd612f429b", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762610314, "uuid": "af5a8fae-8e7a-4830-8b3c-17ff2f0b8380", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762610314, "uuid": "05901280-3105-453f-908e-99c1f49d27ba", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4866903a-bc77-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762588095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588095, "uuid": "73d9d751-511c-4d99-ad4f-7f5c93fcde08", "comment": "Malware payload (AsyncRAT)", "value": "7579b46b8253dbe17e6406ab754426e7", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588095, "uuid": "63d1d19b-c481-4a25-8ff0-9155c13612ac", "comment": "Malware payload (AsyncRAT)", "value": "825f309696ce68af5715a359001f9602f8edeecd8cac56f968a5797a39a96aac", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588095, "uuid": "5d515291-5fa5-4405-b39f-3587c5bcfb08", "comment": "Malware payload (AsyncRAT)", "value": "bb74029f7fed8b6cd67b0130d4cc47d42abd5546", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588095, "uuid": "add8bc1a-a09a-48c3-8273-0eb3f4ceb20f", "comment": "Malware payload (AsyncRAT)", "value": "df8512b67e08545fbbcff39cd11eb0f9444306edaedb796d7911764c72120f35fb525a6041c0f6d559fffa72b633767e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588095, "uuid": "1e3c0b99-d10b-47ba-ac86-b2cbc1946f5a", "value": "T1126612F88FD8408DD55754D73E480E84B356980B793B1C3A3E965EF84F1267A42B2E2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588095, "uuid": "563a03da-7deb-4c3e-a392-4db822bc1073", "value": "384:TooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooH:fNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588095, "uuid": "f9808e7c-0ef9-44aa-96ce-190375f97526", "value": 6722214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588095, "uuid": "e4a53c51-0cc9-4e4a-b77f-57d4165c2f49", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588095, "uuid": "c4a7b037-4f13-490c-afb4-1722caf473f9", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21cadd20-bca3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762606928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606928, "uuid": "faaf1a02-196e-4eed-be8e-ae02ddf33c48", "comment": "Malware payload (Rhadamanthys)", "value": "1ef3c096d458d31147ab3bf2794973ef", "object_relation": "md5", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606928, "uuid": "65319ce9-6521-4c21-8643-421ae97786b8", "comment": "Malware payload (Rhadamanthys)", "value": "83a582c8a37e24876bf2a84634a363c3c111b2ed6770caefd9984306ece37fa6", "object_relation": "sha256", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606928, "uuid": "2ca2df1c-bf49-4ae7-bfa4-3d879417b4d0", "comment": "Malware payload (Rhadamanthys)", "value": "91f15ab488331abe77c952d68eb6c8f3d1f1ab32", "object_relation": "sha1", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606928, "uuid": "0be31a97-6a8f-4a2a-8d69-2bab5800c3c1", "comment": "Malware payload (Rhadamanthys)", "value": "ab2d1e436241c6d4678e32f78ca8c360514d14ae1ade2ccda2c895725ee4a82857a95fd549d770215cd66aba6109b479", "object_relation": "sha3-384", "Tag": [ { "name": "80-97-160-155", "colour": "#357B94", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606928, "uuid": "fac7ade8-7592-4b6c-a2fa-41db10702c07", "value": "T1C9B689BEF31413C3DD674176744A5AA33CA07BD96720A3D3239382A535012D267BFE5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606928, "uuid": "136882ef-cd75-476d-84b4-964b272eef48", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606928, "uuid": "cdc66115-7d6a-4538-ba95-d82faa1578d7", "value": "49152:8suP1Mc1VZEgtNCYv/ibW1amfF61POyOqrXJzvt7La:FuP1MYVSe0Ynz1jfCOyOqTm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606928, "uuid": "18992c57-5b55-4235-89ed-5db774aba35e", "value": 10496792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606928, "uuid": "f5df702d-d099-4cc6-b2e3-b2224586ea0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606928, "uuid": "9330f5fe-7af4-42fe-85d8-6a144be6888a", "value": "Setups.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7120a2d2-bc77-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1762588163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588163, "uuid": "5c776285-799d-4c45-b501-9f18b8f2ccbd", "comment": "Malware payload (PureLogsStealer)", "value": "0673360af5cd67924c3f10c6f993f9b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588163, "uuid": "b17148cf-d266-4a6e-9033-95890a0d6d0a", "comment": "Malware payload (PureLogsStealer)", "value": "83cfeae334d89727ff29c9eb8ada1716523adafa7b673d3c365a1082ff8d2d47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588163, "uuid": "66e231df-2edf-44f5-96f1-b0c6a351f7ff", "comment": "Malware payload (PureLogsStealer)", "value": "91f9d7fd96a1dbb2f835165632e9abcf71773dfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588163, "uuid": "85bdb16c-6bfe-4937-95e9-4ddf91c9c761", "comment": "Malware payload (PureLogsStealer)", "value": "13f9d601f9bcac899bc6d3a0c05a929254c2ecf00bd86505604cbb5fc6d5355d55cde5794d0fc34b905dcaad2e443676", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588163, "uuid": "5b0084a7-7d61-4e37-843d-dfbd92e3846c", "value": "T150C42322D99BD634D6744A33F8F3910182F9E7939C43C5B368AE26091F61751EA22F9C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588163, "uuid": "904e70f5-2063-4c91-96d2-ac54741b6f04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588163, "uuid": "5094ee84-25e8-48fa-af84-ad27e345a88c", "value": "12288:a0PW/vy1Kn/+GYF2buEDfyzmYs9RkxVSeRU4xq:bPgK16JYF2bbfyavkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588163, "uuid": "57042b02-ab72-4ffd-b994-52f27d57852a", "value": 586752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588163, "uuid": "ced0a988-a741-46c0-9e4f-0fbb29f66d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588163, "uuid": "a24e5027-0f12-4b8b-8d43-76b7a06e168a", "value": "0673360af5cd67924c3f10c6f993f9b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a133c791-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762620456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620456, "uuid": "4819fd11-ed60-4477-b3f0-ec9e4cf241f5", "comment": "Malware payload (AgentTesla)", "value": "6914c32691d4d3c2729bb2c8eb3fa0d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620456, "uuid": "59c45fd3-1895-495e-be72-e9a4c7c2e922", "comment": "Malware payload (AgentTesla)", "value": "84da43067e377e51d0e4617270d18aabef324f343662b4369c4e9dc719edd055", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620456, "uuid": "6403dda5-8c6b-4594-861f-044af5c3a75f", "comment": "Malware payload (AgentTesla)", "value": "a24473c9de6c7c9f64b1dd29370169d0c22a4e15", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620456, "uuid": "485a204a-9fd9-4d74-a63f-c6d3184ec8c9", "comment": "Malware payload (AgentTesla)", "value": "0b7002a04e95948eff515e251c5298efa9fde9fbda8906179fadfded20abe1df2f1af4c8b34025fd055f7e0fabf41c62", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620456, "uuid": "8caeae4c-9f7f-4ab0-a2b7-f954c859c76d", "value": "T11545F2158DC46FA9CFAC9A1840FE160DE3F05A8A9517754AFB37BC0AAFF7644020B1D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620456, "uuid": "d9082e56-e2ca-4605-8c31-a6459a74853f", "value": "24576:/xNHimw5ZcsQlUH/LwREn7AFncICE0kPF7wy:/Tmka7AFnXCnkdr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620456, "uuid": "dc00417a-a31b-4ab5-9048-1c5559541ac6", "value": 1240788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620456, "uuid": "a69780c2-86be-474e-bb88-ac461ede288e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620456, "uuid": "d7bac0e3-e137-4063-a93a-d20da55a7e85", "value": "PL 20251013D212-0834 30 30.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b0583f-bca0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762605718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605718, "uuid": "cb63b767-dd56-4e63-8443-175d613b391d", "comment": "Malware payload (Mirai)", "value": "80628c38ececf1ca8cafa3b10f2adafb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605718, "uuid": "d587a75e-9c86-43d4-877e-1c594bb60269", "comment": "Malware payload (Mirai)", "value": "856a3ed9efcecdeac7bb992631ec6974a59e4071704bbb975fc4a1f95b70d4a7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605718, "uuid": "27ff079a-304e-40fb-bf25-e9dacd5531ae", "comment": "Malware payload (Mirai)", "value": "d0919d04935afad59cdd79a1fb1d8e05f676646f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605718, "uuid": "dd7d5519-d0dd-4e51-a345-407289cf8fb9", "comment": "Malware payload (Mirai)", "value": "0d21cb87eb01086bc80905ab5b51052dac0575c0f6cb19d4de92fd571196bc9125a57b8240c7c5e83be9c6f2b079193f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605718, "uuid": "44e5a934-6b76-4cbe-8353-d4efb8f033b8", "value": "T10F939D23CE9598D9C12A4971F0A5F9355B63AE4A56C71EF60BD7CF228003EC8BD093B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605718, "uuid": "bedfa7dd-f191-4049-a32c-913d1fb5b888", "value": "1536:U/w0uP55M6+DTxnee0P34IdyTK53KXm9d7QoV/tCpc1Jk8lEz:UI0uxt+nee0PIIdp56XShV/tp1K4Ez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762605718, "uuid": "f8e94ccc-4efd-4e49-a65d-ff6d4c44300b", "value": 91696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762605718, "uuid": "0c8d185c-f6fa-4baf-8c44-3d6cb4150f2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605718, "uuid": "ae076bbe-f3aa-44c5-98d9-f40bd9462f82", "value": "executor.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a8cc8e-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588946, "uuid": "644cf255-8b1b-4c10-9862-a59c08a8c339", "comment": "Malware payload", "value": "881a99f4c51239f0003a35f32796dfbd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588946, "uuid": "7f90e729-4902-414e-90b0-639eb9472a7d", "comment": "Malware payload", "value": "8619f79764f29ad1e0f3b701985bd953c081e18566aa3bbb54674c6e14a19243", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588946, "uuid": "3d5b48d2-c9bd-4ee6-81cc-c772b9eaa90b", "comment": "Malware payload", "value": "df441ff4735590befc1b8dbf18bd6897cecca8ea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588946, "uuid": "4f2adee0-4851-4ba0-8f4c-e2f2f1a886c8", "comment": "Malware payload", "value": "f1fa448a02a02b752198c42c0df036dac1d5726c2083090ab09234ab0e01295ef01a5adc432db80e5a7149fe3be8b42a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588946, "uuid": "bbde0f74-2693-49ef-b504-9b4ff5c3d20f", "value": "T160242A61CD7006694F0B27DAFD680A22CABCC619552620F1EAEE470D71069BCD3BD77E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588946, "uuid": "ec2ac5d6-e0f0-46b6-8ea9-c4e8c6679472", "value": "6144:upc6Xpc63pc6Jpc3p8ppmGqIpkpc8pcOpcqpc6SpcFp7pXpc9pc6apGpcYHp4:uvPBgWMGNyJBzqU9tiSIvH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588946, "uuid": "4438523b-ebad-4b96-9035-79080c667f7c", "value": 222841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588946, "uuid": "b73c7813-d879-4b28-a844-e308dec90cb2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588946, "uuid": "80bca604-c3b9-4dc3-b85f-c3e33fa4f1b3", "value": "CATALOG DE PRE\u021aURI 2026-pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82e0faab-bc78-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762588622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588622, "uuid": "c91339d4-e84a-42d0-86a2-9b49037da992", "comment": "Malware payload (Formbook)", "value": "8e80bdd8b40398671ea9becffe19b19d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588622, "uuid": "e475d4b5-117a-41c3-8cf5-8311a533596d", "comment": "Malware payload (Formbook)", "value": "8721dfd4d5746dec31a7f9b8b589c5dcd0a435eeb721d5ec5c75770aef186fb8", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588622, "uuid": "b5033e5e-85e7-4815-ac5f-ed32339f9d6d", "comment": "Malware payload (Formbook)", "value": "625207b950fccfa8f8a484669ac6b01963442d12", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588622, "uuid": "cd97cad4-3639-4163-a340-583bc014aa46", "comment": "Malware payload (Formbook)", "value": "18f442086de80b91cab555582777b8d5bcbf6d147bafb059a343e971c11d24c24252df442504a56c1ee60bfa1a151250", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588622, "uuid": "09a626d2-f087-4d8b-9ad0-3604871f27d8", "value": "T18B33308523C0684643472B7B723FB0F5FE6E49DA39888547C208BD90B5B670FE6E5A35", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588622, "uuid": "b905ce85-06e6-49d0-b3a4-c0edd6be53b3", "value": "768:U8NMvEnXArDjpVFVetm2nr5U3yvJpi3EluPWFMRainxZlePfXS9clX4ntuyZYAM4:skh6kvGB6Dccb2LDBx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588622, "uuid": "194061d3-5631-4430-a4ae-b8127469e49d", "value": 54605, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588622, "uuid": "ab2d3261-f4a3-436c-84f7-99d2a739cbb8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588622, "uuid": "d0263d1b-bbb0-4cca-82b9-94c24a639f14", "value": "(DHL) Original BL.pl.Cl Copies.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a9454d-bc65-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762580357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580357, "uuid": "ac7a99be-5fc7-489b-aa98-32c1817e24ca", "comment": "Malware payload (Mirai)", "value": "819b62fadf03b254bba6057cea78db40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580357, "uuid": "74cc753d-d679-46d6-9e1f-9e9f87cfbbb5", "comment": "Malware payload (Mirai)", "value": "8729bac12293f4b17ab29b14f37779ecac9f8212766994780c2b1415059b3fee", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580357, "uuid": "71855fc6-32fe-4b4e-83e6-06fa86910add", "comment": "Malware payload (Mirai)", "value": "3bcb44bf5b3ecdd9d1462b10a09d800bea36066b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580357, "uuid": "f9759dee-2c33-4c35-aa91-31293b873788", "comment": "Malware payload (Mirai)", "value": "419f57797299dddf19861c93a7f02bae9097bd98dfd63636f117a9ee645a34628a1ceca8283a3d7809f049186af32ca7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580357, "uuid": "bdb7ba5c-e5e4-43b2-80f3-a5d95e1ab665", "value": "T11FB3D84E6F319F7CFBAC823447B38A21A75923D627D1C985D2ACD6001E7024E785FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580357, "uuid": "4417e736-403e-4696-b8c1-d1e41170671c", "value": "1536:g+C8TmWvlSi6QjyUN5WuFXLvd3jWC0UCbWOMb8aq8eUcN2jsoFKt:WanvIOy+5ZXjd3jR0zbWvDqujhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762580357, "uuid": "d4aedd8e-17d5-48a5-b0a2-92eb03406902", "value": 113928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762580357, "uuid": "b57424d4-4cd9-4b6b-bce5-dc40acf1d37a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580357, "uuid": "dfb56dee-78f3-46f5-8b3b-d5cf5ab7194c", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf09c1b-bc4b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762569500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569500, "uuid": "548a7490-67fe-4c4d-8529-7668933a72cc", "comment": "Malware payload", "value": "c7677a9adbe8cd4d49903c2b59ba27e4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569500, "uuid": "abb915fc-2937-4cbc-85b7-42e528f017c4", "comment": "Malware payload", "value": "8758eddd99d34eae170f69fe5c58231a546fef0f56a7e30eefac59ef10ca906b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569500, "uuid": "819c495c-109e-4ffc-8946-576ad407d8cd", "comment": "Malware payload", "value": "a590c95a99e092eaf5ae9556f6d3da8199922e97", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569500, "uuid": "1e664cbd-ff20-43b1-a943-21d00534fae8", "comment": "Malware payload", "value": "9f88f81aca21d66483986cd6e13c5ad3b0b4e6a247eb305b991a5d0252e78379b8433ee525fb3ae7f469dd61a0cc8893", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569500, "uuid": "868e4611-5eac-4cb3-8890-87d04494f5e9", "value": "T1C1C30A46FEA05AEBC05FCD30062F830315ED98CA92E5771E7578DA8C7D6D24A89D3988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569500, "uuid": "a594fbe1-8e17-4724-a193-38186b665a77", "value": "3072:e/FuNwsG53KKkytXbB+s7/AJlCWFAd/d7D1jkj12D/gfw8dy9aP7:P5S3KKkqXbBtrAJlCzXkZs/gfwayC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762569500, "uuid": "d26c5d05-11c0-4873-b815-87b2057caef2", "value": 123680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762569500, "uuid": "d04e9a06-f142-44bf-b7be-b85e04fa7d9e", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569500, "uuid": "a59ca980-850d-425b-9e08-4dc5d36c80c8", "value": "frost.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f5bb42-bc7b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762589971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762589971, "uuid": "65718e3d-e3af-4502-92a2-3e4b0e897704", "comment": "Malware payload", "value": "3c2d53b45b3b89dc3f49d2c4f64a8202", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762589971, "uuid": "e86788ed-52a6-48a4-8f4f-e0f34b763cf9", "comment": "Malware payload", "value": "87e18fddf45d71c2b1bc961795279c67ac96a01427ace4f30e0998bc32f50d21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762589971, "uuid": "7bb527f3-4b72-487a-a54d-c4d494e7c207", "comment": "Malware payload", "value": "12bb748e5fa682ea28e23bc88a3714fc02d223f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762589971, "uuid": "843b8c54-728f-4c70-a702-3f65722563f6", "comment": "Malware payload", "value": "b13890901e9abd27561356809ce0a08b4fac608546792ec5184ccd8333b324b79da9eb5351003601b265df2049ad26b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762589971, "uuid": "0ceff683-98f0-4d57-9218-370e3514ed1b", "value": "T1FA166C56699EC8CDFA54B4B166AB6993807718404F5A831F70CC31F5EB30C697A33E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762589971, "uuid": "0db24a1b-1c88-4bc6-9349-ad235c48529a", "value": "9b587f6e592ac48f4597c27bf7044703", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762589971, "uuid": "025fd41a-7c03-4378-958f-5849e2654476", "value": "12288:QIVcyopcAb383bQqnvTlT7QBOnJTR2xwXJh9vfG7EfrVt4Ifrr3micAmnvE:QIVcyopcAboQo81oDvu7UV2yrrTIvE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762589971, "uuid": "d56f71de-53bf-4381-a5bc-0520c43a68ff", "value": 4155392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762589971, "uuid": "22976320-1b90-4cff-81be-826430fa26dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762589971, "uuid": "9ad8f44a-7ead-4ece-9c87-966666a1baa1", "value": "SecuriteInfo.com.Win64.MalwareX-gen.85363435", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4ae1c4-bc90-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762598896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598896, "uuid": "456d4681-1cee-46c6-bde3-8481f7625ed7", "comment": "Malware payload (Rhadamanthys)", "value": "f59472171548ee717ca5d232daf79cc6", "object_relation": "md5", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598896, "uuid": "54f4d8d3-7e06-466c-9f76-451c813690b2", "comment": "Malware payload (Rhadamanthys)", "value": "88fcc7070feba770c8815b5ce8f8a0b7138071f6d2928096f90787245849051f", "object_relation": "sha256", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598896, "uuid": "fbf7478a-5543-4c9a-ad6e-2e9cdf4926c6", "comment": "Malware payload (Rhadamanthys)", "value": "f65fe378c1612ae140068bfb94920d42db750b97", "object_relation": "sha1", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762598896, "uuid": "9e101ee8-1554-4eb0-8d88-1d59e6d7f24d", "comment": "Malware payload (Rhadamanthys)", "value": "2e2a26b13135d9565d8e8b517417af6a92c71ade208ed28a947058baa40f65534c455691ce2216ab8f73babb0e4a80f8", "object_relation": "sha3-384", "Tag": [ { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598896, "uuid": "4516a3a2-b7b9-4de9-9ce0-06a320baefc0", "value": "T181F36C5773A520F8E177813DC9920A46E772B8350B61ABDF03A0477A1F676E09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598896, "uuid": "28394bb3-631f-4ca6-a901-3ffd6646066c", "value": "23aa6ede111f6ac860a5e9008f9b9673", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598896, "uuid": "1ba7d7ac-9ab6-4204-97ec-9c15404505c6", "value": "3072:jBlWijqU87dGuWZKE7629VLbi0Xuv6GyzeO0DsLxmOnHHiSa21jdGl:jBlWijqUqdGnoy/9VH15uO2CtNdC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762598896, "uuid": "7f424f1b-338f-427b-b9fb-a5d1f1ae278c", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762598896, "uuid": "73b59a3c-8d4e-4302-82af-213eb6ee1626", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762598896, "uuid": "c8a7f416-f2f7-4558-a179-9a4e19cd4705", "value": "DeepLauncher.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efbf2f2-bc68-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762581556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581556, "uuid": "e86fbdb1-d9e8-4ac4-b0b4-5e0e28066595", "comment": "Malware payload", "value": "69d5730454283e9657891726ff5183e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581556, "uuid": "0dc7df83-3439-4189-8608-ddcd08f30ab8", "comment": "Malware payload", "value": "890013a67d0a08dd8490f8770a13ed97232446a31fe0eedf6c8526f8b899f4bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581556, "uuid": "dadbe4a6-1d28-4179-a365-926dd3450268", "comment": "Malware payload", "value": "773d7ead3a725a6a46da460fc6e3d0bef25b64a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762581556, "uuid": "766dda17-cde3-4576-a394-ffe5a1b22766", "comment": "Malware payload", "value": "496d23d281c16451c47c9989a02a13af96096667f71d81aa3c15339fd536ee5e5d32cdb99ce7b050b576315ef15323bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762581556, "uuid": "0ab2c0ba-62e8-41e6-bab8-ae3a7c6dcab3", "value": "T145D50140FFC318F5EE82467C419AEB3F5A26B5128735DCD3DB801502E8E2AD16E7929D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762581556, "uuid": "ffcdd7c2-f70c-4b27-bc72-e45fe98f897f", "value": "c4dfd81799750b8216e23427ad6f5f1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762581556, "uuid": "42264e99-59cd-48c2-9805-65215967f882", "value": "49152:0JUxwFPr1KqIZmwkiGqfIz5cgkV0gjqXc0aLWBBPKmucj:0JXtpKewkow5cgkCMqs0ay/Smtj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762581556, "uuid": "4222685e-d30f-408c-b871-aa927f9d1fbc", "value": 2953814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762581556, "uuid": "e18988e0-9b9a-45aa-8fb0-de43b3e3aa26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762581556, "uuid": "656ee3c5-c7c9-4ad7-b684-a192d84c3b5f", "value": "mwc_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3ac85c-bc8c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762597229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762597229, "uuid": "c13c1794-6177-49ed-922a-5cbe8b2034a3", "comment": "Malware payload", "value": "3b0b0b2e6c22405d526d148af00695e5", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762597229, "uuid": "a5859f5e-5cf5-465f-a808-193c0aa11a50", "comment": "Malware payload", "value": "8955ce3fd17372299c9d5c91f552e2b9735f9bbe1796397f6307c0d3661787e7", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762597229, "uuid": "f490adc8-bb4f-4df3-89d2-63cfe61bd61a", "comment": "Malware payload", "value": "d3cbbd4fca3c835b22d5f8acd45e5cf4eda07fcb", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762597229, "uuid": "4b2348e4-bae4-4b06-a27d-c718ababe156", "comment": "Malware payload", "value": "d4f600446cdb1b774e9e45062333a09f789df22ab44797bc877fc292915cc3914b38f91dc7e0a63821255165b9215449", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762597229, "uuid": "85df5b2a-fece-446f-a2c6-0e7f90a540c4", "value": "T1BB21D7C96E9ACB02EDE74533A826B2CBA3C1B0999735E3464CA782105BE502470301FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762597229, "uuid": "96914e32-8d5f-413f-833b-0095e76c1caf", "value": "24:dd6tjwb76jnqNBfor+YK5Adfe7fPcB1akoCJiEA0Zxc7RRR8ZA4gVMTq+HxUicy:dd6tacqNlYK5S8fP/vCoB0ZaLWZ/gVu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762597229, "uuid": "81fbc97c-ce43-433e-82d5-2c5c218b24ca", "value": 1160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762597229, "uuid": "411b40e7-e1aa-49ae-b4aa-e08d6e471bed", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762597229, "uuid": "2a0edc05-191d-41b5-950e-31596061ccda", "value": "Sea-Front-Hotel-2025.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7671a816-bcba-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762616948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616948, "uuid": "e67aaa83-8df4-4592-a6f9-b6483315f0c6", "comment": "Malware payload", "value": "6b21bb07e6cec3f125f94cd6856444a9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616948, "uuid": "c32a9e98-e595-459d-950e-6671b8fc07e6", "comment": "Malware payload", "value": "8a99579f4a8f162a97d9db2d60e45fffa551e78c31cb56b421ffa1d900abbc10", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616948, "uuid": "f2db97c8-8952-4085-a4c9-1cc1d138fa68", "comment": "Malware payload", "value": "a34bf6df2a5dad11a102b256688a0942e87f8ec1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616948, "uuid": "589d5646-c670-4dcd-a326-f9638f6619df", "comment": "Malware payload", "value": "9a5718adf706464a18510b281b4c580fde1620fc59792d494ee5a12b20441dec9c5b3c0bbc588e742a8b985b0a578df2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616948, "uuid": "a41a3f82-1b09-4fae-8971-81a326815109", "value": "T1391375492E229FEDF729C63047B78A31A79833E227E1D684E25CD9005F7034E645F7A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616948, "uuid": "dcb9b4c7-830a-46f2-9ef2-a066ad559f80", "value": "768:Ih2bkIO4atv7/VEynIrk5uIUhVtxIOu0/3fgtzxppbIWj5dPAIKw0U:8T41P+0vwxv/7P/KwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616948, "uuid": "a0242f12-ae18-4724-b882-fc969f1ea4c5", "value": 42732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616948, "uuid": "b9e0e41f-4960-4ff4-8378-83a149abb369", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616948, "uuid": "f2730916-79e9-4fae-ab05-3420ef662880", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8592881-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623474, "uuid": "0d64c4fd-6a93-45d9-a57d-7bb27e1d9de2", "comment": "Malware payload (Mirai)", "value": "c125cd1d66b7461bafc106876af20f22", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623474, "uuid": "90adb3f0-f3ae-4cde-91c1-8bc7a8d758c0", "comment": "Malware payload (Mirai)", "value": "8aba4bf204829d6c7c63afe473a40d9a1c670043e172f8f705379bdd92f985f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623474, "uuid": "41cc57a1-da51-4286-a664-178efcac0a69", "comment": "Malware payload (Mirai)", "value": "40aae186353eb4faaeee14c721805cb627c386bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623474, "uuid": "cb7bb0c1-a0cb-4518-ad15-52064f6f09bc", "comment": "Malware payload (Mirai)", "value": "b03dd75cc7c0f24f97927bc30c61d4286759a108c70745b815faaeb45c640dca3608d12f6406054fd7911651c5f376fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623474, "uuid": "c0ab2b7b-0efb-4623-981a-32d59343b8f4", "value": "T16373121A2FAB2C524F7137F95C9C008D28891F9CE17CB67BA15B862437D69920FAC589", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623474, "uuid": "1d8b97e3-11b7-48d3-97d7-f51515e4dd3d", "value": "1536:d8IHq+kgsIGQy+wCnu29vywakR08stL4BcGXUqhXn6B:qIHq+iQsku2h1/G8stLF5VB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623474, "uuid": "1fdb4604-30b0-4bc9-b8b3-d2f7c71687b6", "value": 77216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623474, "uuid": "2cb3e123-057b-4a08-8ab9-3606a4c859e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623474, "uuid": "555d9f55-82bd-48b1-8668-3d72f3bdc2ad", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3e8e14-bcc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621947, "uuid": "c11215f1-8eb8-45ff-afa5-016a78b1dcfe", "comment": "Malware payload (Mirai)", "value": "67d98ef3f3dff80b5e6185a637258d00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621947, "uuid": "b858fc12-a638-438b-ad03-dc6726248a99", "comment": "Malware payload (Mirai)", "value": "8bdafc34ce010302ee1980fd54ff51829b8686e8bc4d238cbeb064d448be3681", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621947, "uuid": "a643466c-a7fe-4bf2-804e-578f551f9490", "comment": "Malware payload (Mirai)", "value": "b09830cd6e43059a569dc49ed5a79275e7b81d62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621947, "uuid": "08085816-f147-4944-9a4b-9a7b97d46a59", "comment": "Malware payload (Mirai)", "value": "68a20f1654fba79e0937ed1493b183ec7624c19b8a869c7f72d47bbc6eeb52aba74a10ad12d20e69761efd56a8c25545", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621947, "uuid": "75db6c88-e6cf-463c-aacf-82d9a7b0ad55", "value": "T196432BD6B802AD7CF94FE6BE8423090DF661335051930B2B67A7FDD36D321A86E52D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621947, "uuid": "5d9355c4-42c2-4c76-99c0-43f87bf2aad9", "value": "1536:uc4QFpUZAJIwvVqwHsyIo8Wh6fBqozrMt:XfFpUZGIwv1HsfO3oHMt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621947, "uuid": "845b5548-de0a-4262-b262-092cae548031", "value": 57092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621947, "uuid": "2ae48a5f-ea0f-4ed5-8d7c-71bd727d4dc3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621947, "uuid": "061f5a12-1668-4a23-ba7e-4a91d7920e52", "value": "jew.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d3ebe35-bcc8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762622785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762622785, "uuid": "86d75570-62fe-413f-bb64-03d3ca0ce356", "comment": "Malware payload (Mirai)", "value": "6b2112c61334692eefea04c69bcc3e4c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762622785, "uuid": "4556f2ae-51ee-487e-84d9-507e01245ecd", "comment": "Malware payload (Mirai)", "value": "8bfc811a8684e78812a9c9464ee07719508635630f7215708849803b56b38e96", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762622785, "uuid": "44716975-62ed-4e95-86d2-0fc6206d617a", "comment": "Malware payload (Mirai)", "value": "7be1d167aff7bab80714f24042cbd661e7b271f4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762622785, "uuid": "07520a56-3017-4b6f-9e1d-2c84111535b9", "comment": "Malware payload (Mirai)", "value": "fe82e872d68e7a5bd7235c3c642db1bef57b6d5e029a3b03b8d4005f8beba178324052802196ff6d69cf8582564b4541", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762622785, "uuid": "0ed2c2c6-6e4a-410d-832e-d61fac81c087", "value": "T135A37C02739C0907C0970AF2263F7BE593EFD59521E4BB85690EAA465272FF7144AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762622785, "uuid": "bd760252-9c2b-4637-a959-b7244081f8eb", "value": "1536:27eMPaZUl8riIHodn/25QiBJN6GLdBAFI+W6mZ+76zN//62:27esiipdn/4xYFA6mPh62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762622785, "uuid": "1ed740cc-ace6-458f-b54d-650cb2cd8f88", "value": 99928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762622785, "uuid": "0678d396-4962-43ba-b99d-530635811a58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762622785, "uuid": "5f19c387-76be-42e8-a610-0ae756c0c382", "value": "executor.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57e86e93-bc9d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762604441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604441, "uuid": "50f3c52a-221d-4b2c-a698-3a82c46b9a93", "comment": "Malware payload", "value": "109dd7b90222457218257ac780884a5e", "object_relation": "md5", "Tag": [ { "name": "27-124-21-207", "colour": "#89C7BA", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604441, "uuid": "0aaa225a-00b8-4cc4-bdcd-8ba7a0afe4a3", "comment": "Malware payload", "value": "8e21f3aeea96d71deb10108b8d030bb2e7ce2e0ce85a12e1855ff7c56ce83535", "object_relation": "sha256", "Tag": [ { "name": "27-124-21-207", "colour": "#89C7BA", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604441, "uuid": "94e1deb8-4b62-4b58-be91-2db10879122f", "comment": "Malware payload", "value": "e3db80d5c4cf9d4b628b3b4336cbf3323a309dea", "object_relation": "sha1", "Tag": [ { "name": "27-124-21-207", "colour": "#89C7BA", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604441, "uuid": "8d93b20e-c650-469b-a5e6-840956d4e353", "comment": "Malware payload", "value": "4b58a9febd5145beb9859b8168cbad1233d98fab4de50fd48e45de4bb7b9b736128b591004277d7e2e1cbbe459f17ea3", "object_relation": "sha3-384", "Tag": [ { "name": "27-124-21-207", "colour": "#89C7BA", "exportable": true, "hide_tag": false }, { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false }, { "name": "winos", "colour": "#DC3112", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604441, "uuid": "6b0782a0-c259-4b8d-80f5-83a39117e390", "value": "T188183331B2777995D52FA77FE0A86F884430BCE1731AE5AB63783FA686716436071803", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604441, "uuid": "68951657-97bc-42bd-89c4-9b29f20b38a3", "value": "1572864:cJ84khetrOWndFawKj4aGBwagRO0+qkjywmJ0945V/IA:5Qtr/ndFawa4aGStR1+tjCGO5FI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762604441, "uuid": "2a8740c7-86f2-4f15-b883-18e954d51e66", "value": 90633216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762604441, "uuid": "16923cd5-ca6f-47ac-9bc8-7a54fb71bbe2", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604441, "uuid": "a58c2398-f0f1-491d-b5a6-b317cc72eaf7", "value": "HelloWorld\u7cbe\u7b80\u7248-win-2.1.2\u2014883x8cv\u2014hoolefanyi-x64.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "909b0912-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620428, "uuid": "4522982e-5601-443e-9f53-e9ddea21d9a7", "comment": "Malware payload", "value": "7bf8845e09f4176a6759cd04168e0377", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620428, "uuid": "34c66c4c-03fc-434a-ad25-6a1948bc4f86", "comment": "Malware payload", "value": "8e71c41288acb92bc0ba8953cee28002a06a5be616c5f2999e902b0f16d64157", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620428, "uuid": "097dab65-eb3a-44a8-b9f3-f4745e54da9c", "comment": "Malware payload", "value": "291cbf5efecc02f4801daffb399f04af2c280221", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620428, "uuid": "c28bc691-a1b1-4b2d-958c-bacba97a227e", "comment": "Malware payload", "value": "4090baa1e286d99ba68b71490f27ef1bc8601ba8c7a052d22155a491612a6fe1a2b70d383a36bcb3146a70b2bdff5054", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620428, "uuid": "90ebf4cc-3698-412f-9390-d149b69e8eb0", "value": "T1C55141CF394695349433899EA2B6682ACC905227593638B5FE5CC1C41F312FDB7F88E6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620428, "uuid": "7dc5b654-3021-4c75-9fd4-cd0f1b46c41a", "value": "48:ywAFRymUczW3oEZ5v+Q+jOr5R03QWEAB/uftS2sP+Xs3C0Ghv5d+1IIW1r:KfymU5f+jA5R8QJA/uf3P8Slhv5DII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620428, "uuid": "6e7fdad9-e0fb-45c7-aaaf-74f3390e74b4", "value": 3042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620428, "uuid": "49a3f52a-676c-43e0-8bbd-463a8ff3d03e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620428, "uuid": "29146ae3-8f34-4344-9d74-ccfe6db87595", "value": "young.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbc635a-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620770, "uuid": "18a3578f-7bba-4fc8-a48a-0cbffeef26b2", "comment": "Malware payload", "value": "37e0f8aa804ddb51935203badaa6f555", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620770, "uuid": "b36b5bf0-208a-4735-b4fd-5af45094c45a", "comment": "Malware payload", "value": "8ed5a957a22590916a3887f8c183d73b1cd3043a2d75e871cf522c06d2c3547f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620770, "uuid": "49cef9c0-7d81-4ffb-92b1-1060e887d396", "comment": "Malware payload", "value": "6716f65add33f0a8547fb0db7fc158e32d1505b8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620770, "uuid": "e7b7b0ba-0ce5-4016-b2c1-f50abdb2a2a9", "comment": "Malware payload", "value": "be63dcb1a556bda0e2ca75847c368a7bd69ea01cb2137ddc7af9029f6ad136347f65d10bcd6edd76cb97674a04113dcc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620770, "uuid": "0cc211da-31cf-493c-ad7e-3030a54beb19", "value": "T19C0422E005B8897F0E3214DBD36EA45E4B7567D8C5EFD98F488BD94B620BEB2041E09D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620770, "uuid": "e81e3de5-dcda-45cd-a0d7-983c79e302b9", "value": "3072:aeFyoqRUy86FTHNR0jUSlbbziSN2hAdXcoLnXRNM2tn7SjlS/v0lNt3I:aewowAj1lbbDaWFRXmlPV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620770, "uuid": "5ca7d6a9-4eef-44e4-bf07-34a5a3cecd83", "value": 189474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620770, "uuid": "d00fa699-00e8-4a24-a6c5-f581911e5b13", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620770, "uuid": "8e3a6876-a853-43d5-89a8-b906680b1a86", "value": "quote.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2bc30c6-bc93-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762600379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600379, "uuid": "b5af0c59-1ccc-422a-afb3-7add7178d9c8", "comment": "Malware payload", "value": "395da66bee080c943e820b4e61e50de6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600379, "uuid": "7227f43d-1f25-4f3f-87f8-356c5061acfc", "comment": "Malware payload", "value": "90b613cebceb8fd9a735f0daa496a01e457d8215d511bc7864c75e646a2e27c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600379, "uuid": "a68e4427-adb3-4724-a97c-9c4da668cf49", "comment": "Malware payload", "value": "a146fa78d37c242dc08b806a24dc87848ffacf0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600379, "uuid": "29ad495e-4338-472e-b879-337aee37a0aa", "comment": "Malware payload", "value": "d4813eaee83c891637b71ed88148ed07daa463a5abe55e061419007c0000511ac2942faab913790c3e2afed50ea0a395", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600379, "uuid": "f1237daf-52d5-4e85-a85d-8546a299641c", "value": "T1D2A51A426AB509EAF5774374C4730E29D1B5BA218731ABDF039162691E73290792B3CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600379, "uuid": "dc022deb-0cae-48ef-bee3-0b3ca6c02057", "value": "2d643bf6abc836dbf1770398e8e02a7d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600379, "uuid": "f350a4a4-4f59-443b-ac03-a36f498cafc0", "value": "192:KwfaNTQctuIIFqBrZfz1XQW3+3Q5tfBDe5I7WTxbWJ:KwfaNTQctuI1hBf+3VI7WTxbWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762600379, "uuid": "c60c9729-3f0d-43ce-8ced-03fe1c47fa5a", "value": 2109968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762600379, "uuid": "0e4036b8-85c5-4451-bef1-2ed60a90d3f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600379, "uuid": "7d3c7a40-6d75-45c3-86ba-c476cfc562d9", "value": "yVLQbWaX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39208c0-bca1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762606340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606340, "uuid": "1698c681-df31-499e-bb41-6e65b4016af8", "comment": "Malware payload (Mirai)", "value": "a9e0ed34fd7ab34a3a8056baacaeba46", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606340, "uuid": "76088ad1-afb4-442f-9af7-8846fab840e6", "comment": "Malware payload (Mirai)", "value": "9142974ed195fb33d1b6f9191aadeb2f50f23b2da054bc49c2f8c55f83147e91", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606340, "uuid": "e38f6108-59db-4eeb-9708-56b3b928ca62", "comment": "Malware payload (Mirai)", "value": "3f35d91719fb43628a67995c520fe9d631eb0622", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606340, "uuid": "137363d5-178f-403c-88b6-9e5808a283dd", "comment": "Malware payload (Mirai)", "value": "82a9c129f34005f2fd5318dea8b7f9f377144bdf96cc172ae82e3dbd28e6d12d58523e426b59ec1d227edd751561cd7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606340, "uuid": "3ee8b4bf-62b8-4262-b1e0-ad5871e0edcb", "value": "T1A0A3C61E6E518FADF7A8823047B79E22935C37C737E1C685E19CD6046E6028E145FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606340, "uuid": "ac4956cc-a274-4066-8b3d-5c42ad4e4fb9", "value": "1536:xa54D8cG6eNyuAGiEf4/XKFjCKbTDoiRCQWf53vfTa5/jkeun9syQPWJGi:K4D8cG6kZziEwIjCKbkfBvfTi/CQMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606340, "uuid": "bd07e6c4-2911-457c-822a-17dee941dfdd", "value": 106400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606340, "uuid": "7b7fb413-c839-40a7-8bae-e5c0616d6e36", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606340, "uuid": "1cd3a900-167e-43c9-97e1-4920bc572ff1", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5706568c-bc99-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602722, "uuid": "4f5368c0-26d2-42d7-a0ce-8bb973731694", "comment": "Malware payload (Mirai)", "value": "355cd6a39684cec25f2940c0459c5b3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602722, "uuid": "8f6e399e-605e-49f9-9860-8347c79e5285", "comment": "Malware payload (Mirai)", "value": "91a68eefaa829c4b6c705372d28bc4fc848eec85efa66e08348e7995321d7d53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602722, "uuid": "f9dbeba3-aa13-428d-b23c-27d50af18858", "comment": "Malware payload (Mirai)", "value": "6473cbe48a794293a8634e38715dc1111d12fb21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602722, "uuid": "c994f6d4-bc5b-4647-aaec-d7387b65fe28", "comment": "Malware payload (Mirai)", "value": "469dfe6fefa92dfd7d055fec2506291b9cd6723a2e662d0dd311989cb079f69159385d62b831bbfc27d376f6c3068d3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602722, "uuid": "8fee37a4-4d86-40ae-b57c-1cd8231d9e21", "value": "T1F4A3398EB404DD7EF41BDAB64CA7690AB531D3715A831B267397B963AC321F44823F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602722, "uuid": "1539d04e-2d2f-4f56-a3fb-ac392e80c676", "value": "3072:sslkG9aqz0/D2ECquD3ZH0uTD34wVQ9LpBaHtYcBNREFJdQbt/qKvqBujfg:XlkG9aqz0/SECquD3ZH04D3zo1BaHt89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602722, "uuid": "bc0cb42f-6dc4-41a2-8398-7c16a2e5c4ec", "value": 106900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602722, "uuid": "fdf19293-4359-46e8-bf4a-3d57c1a9f809", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602722, "uuid": "04156ad1-845e-4891-a04d-9505d79d8a3c", "value": "executor.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed37aae0-bc9d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762604692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604692, "uuid": "c6f7722c-34c7-4351-8775-175953512923", "comment": "Malware payload", "value": "44da7e477f788bce1ccf86ed15b92bda", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604692, "uuid": "c37271c3-9600-42e4-8004-880edb8cb5bf", "comment": "Malware payload", "value": "91ddb1c7d2090d850c8c0d7cfb3e25fd9ff6f4897e4d2d3157478d2e7ca18bfd", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604692, "uuid": "67b7afe4-b64f-4df9-a3e7-2e3ee1b7f21d", "comment": "Malware payload", "value": "6e7dc42f726ea3fd4c45a8a73ef35ef718490e99", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604692, "uuid": "54ea8807-e206-442a-b2dc-530cc5f85dad", "comment": "Malware payload", "value": "7b1bf063606d80b3abc3d1f5809647884be15d11aa3716a1e296f11040b50ea1a5a7c273ece4678fae6bd52c6a1225aa", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604692, "uuid": "668c09d4-348b-42fb-9e12-2f162e2f2fde", "value": "T1161318053A98C26AD6BF0F7CB8B20E6152B29266C102CB453D8C55DE6FB3705CF1639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604692, "uuid": "3a7f5439-db24-422b-9787-b5294f5428c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604692, "uuid": "aa9e6384-7a1e-4130-9d13-6a16b96c463f", "value": "768:HCnWZWFTwL7wuikjZO6W9ewHHolkgeIOt7BXAW0Q1C6XbYC1OkVwY:HOpwLXzJwHHolkgVW31C+b1VwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762604692, "uuid": "b7ea5c06-6e37-4e1a-9881-c545a332ea8f", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762604692, "uuid": "e38561bd-404d-4fa4-a434-9b80c60d72c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604692, "uuid": "d22060eb-8911-49f2-ba80-865230e8400b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2980bfe1-bca8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ngioweb)", "timestamp": 1762609088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609088, "uuid": "75128283-01fb-499a-a4e0-8e01a6fc5de3", "comment": "Malware payload (Ngioweb)", "value": "fb151744ccc778f6ca910d0b586bc687", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609088, "uuid": "d091e310-6fc7-4566-b90a-d9b903dcc4f8", "comment": "Malware payload (Ngioweb)", "value": "925d5525563d3438245bfc9bd409a5b126b96cf449f7d540bffe284f56d5745d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609088, "uuid": "ab79ecf0-ab35-4502-8a71-831ea44544c9", "comment": "Malware payload (Ngioweb)", "value": "70056edf336bfffe9e202f2c3ef7c6a3f340da35", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609088, "uuid": "f13e6ae6-2b8f-441e-ac40-929d7b204962", "comment": "Malware payload (Ngioweb)", "value": "bb8c985633c2378fd3db03157821337e97acf99146cb47661c2c19c981e9f8b06962e69dc0b58c17e51b45e6091d580e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762609088, "uuid": "a5b2acc7-e210-428a-b1cd-2053e17a94a0", "value": "T10F01407E3D5F69D4C55CE700F870B5215188CB8730A13B14719C5D3584EAA847B2AF26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762609088, "uuid": "4439e642-3935-4a3a-ba28-f06dbdd0ffa0", "value": "24:pFAHDxXHDx4HDxWHDxlHDxOHDxv7HDx47He:p8Dx3DxaDxoDxtDxADxDDxOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762609088, "uuid": "dde67f0d-7e1c-4eca-838e-00e8c3cb1f55", "value": 824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762609088, "uuid": "17eac6d8-7b63-439f-88e5-1dd32d3c15b4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762609088, "uuid": "065a1254-3a30-4c88-b973-cc7b18f0b9ae", "value": "router-atemi-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabc18f9-bca4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762607667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607667, "uuid": "2d4b45fd-4916-4c14-bfb1-5471a4a0cb9f", "comment": "Malware payload (Mirai)", "value": "3be86e8b1776ef971358cde1042ceb52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607667, "uuid": "6546d6e6-f621-44ec-b32c-d3d1b03a257d", "comment": "Malware payload (Mirai)", "value": "92a8409c6d850392f4b48a7df4e4a2e5db932015469ca6a90570fe2964abe8cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607667, "uuid": "2778e52e-1c8c-4962-b587-cee949238d30", "comment": "Malware payload (Mirai)", "value": "d462ccbc98dbc02110bb45c857e1210c805ea8fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607667, "uuid": "5cabffe4-60db-433e-8a4f-2dc0c15a4bd6", "comment": "Malware payload (Mirai)", "value": "831b07b45a36dac552158c4ddf7fbc81f041b3723919be376f68fa6b8265afb2ff2fef9759764abc377890ccecb8baa2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607667, "uuid": "9392b21b-364f-40a0-814b-738db40ee064", "value": "T14D83AF33C9241D94C65842B575A4DE3A1323F94066871EF616ABCF76D00BEDCF90A3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607667, "uuid": "eb3d706b-db29-431e-bb4b-badc256ceb23", "value": "1536:i/V5nAjRtKHduXFzrf6KgpJda77ZmAYCj9W48wJze:id5nkHA2FzrlgRaZmAYsV1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762607667, "uuid": "5b29ecb0-03e8-4f2b-ba9f-a2d39e70bcc1", "value": 83488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762607667, "uuid": "70df127d-bd5b-43e9-a445-5e1c30304664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607667, "uuid": "5e03cf8a-0ca6-4727-8a22-b0ab32fe3251", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eaf3484-bcb9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762616532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616532, "uuid": "749519fc-17ec-4e09-86f8-6e36dd1e9aef", "comment": "Malware payload (Mirai)", "value": "f3bb76fe23f01fbd5d0cd2c86ba3fdeb", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616532, "uuid": "d071eaf8-b2ad-4bfa-aff5-22189f817c8a", "comment": "Malware payload (Mirai)", "value": "956e4d50cee880c95457cb69ad152739f8cdab964d634d61efbc79e5d7099285", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616532, "uuid": "1423b901-953e-4c1b-b34f-3dcc13310f7c", "comment": "Malware payload (Mirai)", "value": "630ffcba7d2a6fbdd274b3d534008735b7811905", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616532, "uuid": "5885d6d8-82f1-4812-9737-6b83e7dfa038", "comment": "Malware payload (Mirai)", "value": "4c142616f3cecc386eba37024924f3ecd735d68b0c9b6a3bc1d903f245eb4d83e1a3e16381a2e1a2d451e1e4484c2cb3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616532, "uuid": "dd40dd21-aa3f-4639-85f2-70fcb25ef937", "value": "T19DE09BCA281222305429ED872E72CC50F016805167858FF059FBDBF08CDBF486D4C9BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616532, "uuid": "8d366520-ff2b-442d-ac36-3a9cc7941a0b", "value": "6:8KhDiOnFflE0FXRLd3uNidRLd3uNCaWELFFhXBLduFGCaWELFF+q0LdlvsGL/usu:O0Fhp+IPp+N/FFhxpuFg/FF+LpxaypJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616532, "uuid": "a232f31c-fdb3-4c9f-8a26-0cfebf5d991b", "value": 408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616532, "uuid": "b2786d0b-03e1-4816-a0f9-7adf4ccd424a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616532, "uuid": "2c615fde-6042-4ccb-9372-b69fed405092", "value": "ohshit.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3d619d-bc4b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ngioweb)", "timestamp": 1762569502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569502, "uuid": "940a7532-7b4c-4e4b-9165-9c3cf0b84ea1", "comment": "Malware payload (Ngioweb)", "value": "4918f17a50810c5700cc14defd1ca2bd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569502, "uuid": "637a9882-f971-4e15-9e26-fd2caa52baf9", "comment": "Malware payload (Ngioweb)", "value": "966770e3938bb350119a960948a15421d9c6e0944c4d49f5aa631d3bd9fee703", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569502, "uuid": "411fa150-265d-4ebf-a20c-87c1bcb6619b", "comment": "Malware payload (Ngioweb)", "value": "ccb41aee62e2eee07a550c686d3ba022e89c00fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569502, "uuid": "6688d04c-ddfe-4179-a1ed-d15f5be13ac9", "comment": "Malware payload (Ngioweb)", "value": "205c9bc0ca13cdc570f4c31c7e70a75bde2a80edeae6e217e2bedca0e422c0e5129ad3e0fb03efde4cadb570754be0b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569502, "uuid": "979c5918-2a68-493f-9613-d2062cda380b", "value": "T1AD730A55F880CB61C6D526BAFA5D428C73230B78D3DE72059D24AB353BF7A560F36902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569502, "uuid": "1437a18f-12b9-4f32-92a5-2fe4e9f8f200", "value": "1536:x86RsUMiveqQHP2htLDTggI3OMEbwtrvLrxQJaNJSFOg96B1Ir:x8bZi3Q8tTMEUNLwjPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762569502, "uuid": "3c3323f4-e97b-4d68-aab0-d87dd5f23f7e", "value": 79104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762569502, "uuid": "f4d0f845-a894-415f-a75e-f22de05811d5", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569502, "uuid": "8f908bd2-43e7-4e17-8f47-16c767a489de", "value": "frost.armv5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ecc71e-bccb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762624113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762624113, "uuid": "ffa414f0-54d2-41e8-afcc-cc861fa957e2", "comment": "Malware payload (Mirai)", "value": "911521fa89bbbd215f116ffb1789d6d9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762624113, "uuid": "c09a7a3a-a142-405b-a807-634c055ab309", "comment": "Malware payload (Mirai)", "value": "9674fc08daeac53c860276fc207a5b9f682fbaa6ca2419ceffcae5aa9fbe02bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762624113, "uuid": "9e43b5d2-a66e-4d8a-a48f-e9730c9908e5", "comment": "Malware payload (Mirai)", "value": "3698f8ee12dfac17103a7ae46204208745459bcf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762624113, "uuid": "4c0e7b9b-a4fe-41d1-9034-20afabf5cf21", "comment": "Malware payload (Mirai)", "value": "bbe1a16d1a758724cba7a864126d85465bf2739c67f2495a28ec32c194be48f3a24df1b2acf3f7ff81005cdb181ce8f5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762624113, "uuid": "69a6955d-fe3d-42ac-b9d9-47666f2797ee", "value": "T111C3F909EB614FFBE86FCD3746E90B0529CC551712A83B7A3574D828F64B64B4AE3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762624113, "uuid": "1bf31244-87e5-4cee-9784-a62aa51a0fda", "value": "1536:WNyKMWFJBZBVf+g6z3jLLYsd/L7dsDbrkqotjve7hjAdeAZtiZmedj63yqF2Y1jl:8yKMWFvB6TrJA+eAHittyNZrmrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762624113, "uuid": "01e457e6-1a4a-465e-a22c-86ebaa97e008", "value": 122496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762624113, "uuid": "1d0fee60-6f04-4582-99c0-945a288f03f3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762624113, "uuid": "bc01268b-9a24-4426-ae71-4e44b10007ac", "value": "titanjr.mipsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc5a68e1-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623508, "uuid": "830d33ea-a2da-4233-a6e2-2c1eb3ee05e3", "comment": "Malware payload (Mirai)", "value": "6af17532701a4abd717fdd23c787ce69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623508, "uuid": "9cf75bc2-4ea2-449f-9b27-e4d9bfc540e7", "comment": "Malware payload (Mirai)", "value": "96ba82c79e3bfe602cedcf059571a2d34a142dd312d0e7b5fb2976de0bdcb190", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623508, "uuid": "9eb1a731-4be1-43a7-bc82-06cfab9c923e", "comment": "Malware payload (Mirai)", "value": "42b8697fd05501947dbaf950fd7fe5a64b9318f1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623508, "uuid": "eb9e7d35-5322-4e7c-bbae-314ec6f26e56", "comment": "Malware payload (Mirai)", "value": "a0d4e7bcbb9874a4f5232df495df118e9c495218ce16272a1fb007e5118c61dae2ef33d8c91a7928c37244d7fce3660a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623508, "uuid": "06e5dfde-bd10-46fe-8491-bfe66542b566", "value": "T199F32941F8414F27C6C712BBFB9E428D3B2A13A9D3EA7103DD255F203B8A95B0D7A651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623508, "uuid": "aba5a25b-7e61-4e09-b9fc-8796c4f33cee", "value": "3072:FQC7toK0YX5aWW/i4SLREYHvI67AF6hh19OML:FQ2zpDUi4IR1HAgAqOML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623508, "uuid": "47d84511-44e8-4bed-91e2-19a196be5d0f", "value": 158848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623508, "uuid": "dfc840d7-981d-4859-9618-bd178040b549", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623508, "uuid": "9e3e93d1-de52-498b-be9b-85ece21e88d3", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8117aa50-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602363, "uuid": "e4235098-2a60-438e-9cd4-02272e073f06", "comment": "Malware payload (Mirai)", "value": "38c052fdbf65a3a70f1e572b13432d74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602363, "uuid": "f0cb5cb5-40ec-48be-8ee0-385d4d739357", "comment": "Malware payload (Mirai)", "value": "96f291a4de656d9260fae03b15e55c053bdda3e5b31df7d889aae402f2b995b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602363, "uuid": "254920f5-3d48-4a7a-8bb9-92a3933614fb", "comment": "Malware payload (Mirai)", "value": "3714de83e08bf32ea55396be4b943618ef356b61", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602363, "uuid": "3b9578b6-7c51-4b15-be13-b4a923cb5d66", "comment": "Malware payload (Mirai)", "value": "bbdc1f352a0526b1905a430a3134ef6fae4996c5f84b6404ef6512bcb5a8fc4ac131eb4efed3826c537d50778b9211d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602363, "uuid": "4770b33f-7c3e-4284-93a9-1e29af2fae35", "value": "T1D493C61E7E218F7CFB9D863547B78E21965837D626E1C141E15CEA012EB024E781FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602363, "uuid": "d89c65f8-40d6-4ea1-87d6-696c9fbf682e", "value": "1536:xYFfoZCDVH2YLDy18oJlPIWJ3D0zPIJpc1K8cRyZ9KFMTad6y:qFVZHVM8APIWJ3DPCuRyZ9Ka5y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602363, "uuid": "dca73c99-573a-42bb-836a-883810172ddb", "value": 93388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602363, "uuid": "ff7ea608-ec29-4ed9-af28-5ec64bb0bef8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602363, "uuid": "68771aa6-4808-408b-9681-08895af09659", "value": "kowai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b4b542-bc9b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762603767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603767, "uuid": "6afd79a0-3d2c-4661-ba70-17b361c8658b", "comment": "Malware payload", "value": "0dc5557d56c7115b4ed85f1ca40d242b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603767, "uuid": "3bcd187d-cb39-4556-944d-4affeeb89556", "comment": "Malware payload", "value": "97e4171e2d8c1c9e7992b3c2ade49b7649ede9916777ed1db9935e6f95debf48", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603767, "uuid": "b1f1e641-589c-4acf-ae27-e15d9d891e26", "comment": "Malware payload", "value": "f677781d53a2fb25c8ef66fe93fd3a8771c13a5f", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603767, "uuid": "3acade9b-8e6e-4848-9742-8509b4fdeb2f", "comment": "Malware payload", "value": "8deef1d26cdfe3216bb8785f7da234c324e278ba9783fabb9e5f75f669ace4ad9962e1788a4607ef4bf05fe1a8f3e932", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603767, "uuid": "8f05cc59-9c3c-45a6-872e-788b33eeb2c2", "value": "T124D63348D1B019ABEDF2827D98B2C11AE33178E91F33E18B67E842632F535E15D35B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603767, "uuid": "4f389396-a9d0-4f08-8478-ef1f7e09c155", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603767, "uuid": "ed33751d-69a2-4dd4-90bc-b6a6874841f8", "value": "393216:NWSONo/ECjXMCHWUjMVg74wFKwjPNBGZ30aRUwEavq:NWSOyXMb8kDwFKwjPNBGZxUwEavq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762603767, "uuid": "b2420c4e-b271-4f7b-a768-a875cf538c0c", "value": 13344055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762603767, "uuid": "ad48e536-9a72-459d-8894-92901550d384", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603767, "uuid": "12663897-aa85-46c6-a6bf-4a51dacdf91c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72332775-bcf0-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762640134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762640134, "uuid": "13df6b90-5dba-48ee-8195-a0659e786a2f", "comment": "Malware payload", "value": "4c03a89efe3b68af23e515e29bd94655", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762640134, "uuid": "35fe789a-338d-4c75-872a-e2eefd37a428", "comment": "Malware payload", "value": "984d541edc9d43d77fd67e4174d20705baddef20b047abc6142cea69a879ec30", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762640134, "uuid": "8292909e-0270-4ba7-8a26-c155da2b314a", "comment": "Malware payload", "value": "41c62762633b6966e50faff5f282742955981280", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762640134, "uuid": "75e0ac1f-0364-42b9-ac43-14bfeef0ae53", "comment": "Malware payload", "value": "3727464bb32d699bc24634b139b1ccf560d019d4f1db13ce0478bc4e00f6676c66ffc72323bfcc0246d6ec7494023c91", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762640134, "uuid": "d29a80ba-a330-4f9c-a22b-6a9b9d6e50c1", "value": "T138B5336992212845C73BF0B841A9560F431323599F58D3F7B82A43E87973DCBB7ABB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762640134, "uuid": "a3d9b5e2-58b9-4377-811e-a99f538a9ec2", "value": "2eabe9054cad5152567f0699947a2c5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762640134, "uuid": "659e8d49-0964-4aba-8d9c-f8f757454f57", "value": "49152:Kxpw43UNgJsBfs7bdJxx9USCzJan4F4CpYSi2NR45SNGW8nH:+waUWJsK7bdJhUzoCpYS5NR45SQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762640134, "uuid": "1f63101d-b642-4ec1-aac2-0177a2b7f575", "value": 2466816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762640134, "uuid": "40b5fa58-a1ce-457e-9561-3e8e1f398736", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762640134, "uuid": "2bfc5df5-0498-447d-aa9b-35698499782f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef27d6c4-bc87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762595246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595246, "uuid": "39c24daf-6523-45ba-8284-58c9fbcbec0b", "comment": "Malware payload (Mirai)", "value": "bf2753ca44d6cb49d65b4f06aad5ef93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595246, "uuid": "9fe6fbf6-db0d-4b24-b040-76db305d642c", "comment": "Malware payload (Mirai)", "value": "98b274122afd59dc2a7f6d3359e26f1bdca869bdb5468b2360edff8883829880", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595246, "uuid": "ec48bf59-669c-4b17-a584-197e15263ed0", "comment": "Malware payload (Mirai)", "value": "9d21984e62da8a1f72277f0d623a550eb5825b1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595246, "uuid": "854c9d7f-5b4e-4439-96de-bcb4f0385b25", "comment": "Malware payload (Mirai)", "value": "67d222e6a558fbd4bd8ee5421978bd1ef088b3cd07cfc6888085b7021600089df65a60150637d506e5beb49934a7f003", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595246, "uuid": "a5a70aa7-0fe0-4486-be85-8158ae9946d9", "value": "T148736CC1A943D9F5DE140A3470B3FF328676E47E2169EAD7C3A85A73BD41A12E40329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595246, "uuid": "4cfc69b0-ff32-4d6b-aee2-5f4823997a84", "value": "1536:hrV4LLVtRuHZU6jaetKilwZvj6yIihWgSz0AmhZP/QJidQ3:NVSLVtRuHZU6jRUywprPk4AmnYk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762595246, "uuid": "b96ae374-369a-4745-96c6-7bc588920ac9", "value": 76080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762595246, "uuid": "a0fc146c-875d-4b84-80c9-e138fdcba40b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595246, "uuid": "ec6457ca-44d7-4042-96b9-4def36df7c51", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4395558a-bc3b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762562317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762562317, "uuid": "6d7df4dc-8817-4418-bce8-075286c2281e", "comment": "Malware payload (Mirai)", "value": "c3fac83d922252ba16529ada485d5275", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762562317, "uuid": "276380f2-b171-484e-b39a-c3d286b63688", "comment": "Malware payload (Mirai)", "value": "9929999d6f801c8969d2ef6a0b17c0d08a43483712340837fc2a871cb1cd9ebc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762562317, "uuid": "21eeee82-0a49-40e9-a3e3-24465a3a18ef", "comment": "Malware payload (Mirai)", "value": "9eaa8add498d832d0c4e6cccd1b4a067d1265a73", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762562317, "uuid": "d01a4963-f615-4964-a90c-b51ea7943605", "comment": "Malware payload (Mirai)", "value": "0c5248015e96cf51bd0ab695d1931ece98ba166379b7b7c33d17302fd122e071f25a175a484a090ca87035fec70ed14d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762562317, "uuid": "0410014e-94f1-4ff1-8948-df0e65c5f7d0", "value": "T142C30909EF654FFBE86FCC3706E90B4524CC651A22A87BB97574D428F20E24B46E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762562317, "uuid": "e9ff6372-bf37-42e1-8ec0-009217500346", "value": "1536:UIYtCpKWufrnK8XmR7UsgBTQFFvup3j5HwTd1FmN7Izw1ulhRZbp2Mvjmnc0peTl:UILpR8bY9jRFFTM18RTrJQ96H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762562317, "uuid": "976363d8-9f56-414d-9782-78ba42d6797e", "value": 126596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762562317, "uuid": "ab2e3c73-785f-4a3c-931f-20ac0a7dab73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762562317, "uuid": "7ec15ab5-22ad-41e4-9967-14e31dd7e085", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f646062-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623325, "uuid": "a9d10339-cc06-4dd2-9f4f-49efc209051e", "comment": "Malware payload (Mirai)", "value": "5b0837301a673240d7e64c3abf03c9f8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623325, "uuid": "a4b4e7e4-c46c-4b66-99ca-dd44e780d8a8", "comment": "Malware payload (Mirai)", "value": "99615baaf6b18034c6f772d498dc473e78cac717fb00a8e27447e6d664e823cc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623325, "uuid": "24572d18-9778-4097-a32a-22b03226ac5f", "comment": "Malware payload (Mirai)", "value": "8b3381a7f8c79016e371a1e35b635f3b813590dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623325, "uuid": "cbe11386-645f-4aed-8745-ff756cc333d8", "comment": "Malware payload (Mirai)", "value": "aa4c8e7874cebf6812e7d4a472885a518df444657543a94ba48d2f7fd9fc13359b993fb2c0deeb8dc91cde643c247381", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623325, "uuid": "63afd99b-f732-4c34-936d-640667498c5e", "value": "T161A32A56F9814B21C6C516BAFA1E518E3313177CE2EE73229D146F2077CB96B0E7B842", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623325, "uuid": "b3af6aa8-b885-4da3-99d0-898f8382baf3", "value": "1536:d8noQVHCU5M9DhIzDYf0CIGu55ilajJ17wVLU1RiTSFGxHHoz7+9YV9JY:xQV5KInCDuTilajRgSFGxHHozS9KS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623325, "uuid": "d2569597-d663-42fe-bfbc-ffb5eed33c41", "value": 100512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623325, "uuid": "25d322fc-b222-465d-a7d1-ce073a103c7c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623325, "uuid": "7825454b-adff-4b2f-8638-0c25c8761eec", "value": "titanjr.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35830fb-bcb3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762614097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614097, "uuid": "a5df1c73-1a68-4fee-9206-142854246d12", "comment": "Malware payload", "value": "be9e22b0c261a48266f0b7e1724c020c", "object_relation": "md5", "Tag": [ { "name": "arkanix-pw", "colour": "#578FB3", "exportable": true, "hide_tag": false }, { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614097, "uuid": "30633e06-dbcd-4830-a6b2-4406df2ed02e", "comment": "Malware payload", "value": "9986ab3e10c7e0f163335976d3646f2239800793e9de4b183af03c2c55d99555", "object_relation": "sha256", "Tag": [ { "name": "arkanix-pw", "colour": "#578FB3", "exportable": true, "hide_tag": false }, { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614097, "uuid": "7b2bcb30-ad3d-4458-a226-c949320cf5c2", "comment": "Malware payload", "value": "a2871989475b450f7de21f1940cc4afacb16c2d7", "object_relation": "sha1", "Tag": [ { "name": "arkanix-pw", "colour": "#578FB3", "exportable": true, "hide_tag": false }, { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614097, "uuid": "5025e095-45a1-4c64-9afe-e8925f93fb22", "comment": "Malware payload", "value": "34400f82a0738616f53164041a7e0678243c1f6016316ea6eb9aa9e5202b2e9c21546f426c6577a5bddd7f219c89fa50", "object_relation": "sha3-384", "Tag": [ { "name": "arkanix-pw", "colour": "#578FB3", "exportable": true, "hide_tag": false }, { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614097, "uuid": "432d8f50-53ea-41d9-99f0-b775f6a1ccef", "value": "T12D8723AA55D5B2D4DBC30540638F43DE21D1A47D81EA5C3C3AC72C029A34EEB668DEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614097, "uuid": "ce5959de-5c62-46a9-baaa-c2fdc0f13bc0", "value": "3f89fcc81a8c8aca2e05ddab1c622a0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614097, "uuid": "e763cbf1-921c-415d-8bb0-5f604be9cfbc", "value": "393216:2Oi5lhyyN7IgV3geofoFnsIgAlqHy0KJvOb+iQftLCGpp1moc715zkKltstw3oz+:2HKgVOfo5sIaS0KJmytrbsh5zDzT3qIR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762614097, "uuid": "d98f5197-0ee2-4773-bd71-541ca10b8995", "value": 36230024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762614097, "uuid": "fa496b23-cbcd-47a0-963b-7a834ee3ea43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614097, "uuid": "1dd972e6-7318-4ddd-a96f-7891e47251be", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfd8920-bc99-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602599, "uuid": "4c70f688-d28c-45e3-8632-b1e00bbcf007", "comment": "Malware payload (Mirai)", "value": "63f6f03c43c6e38ac7723a9c3523a5fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602599, "uuid": "7a499b2c-01d4-4de6-b05f-c31b7556bdcb", "comment": "Malware payload (Mirai)", "value": "9a54f3c7cfaf359de17b534a553207fd32c511655a73277d6d24657887dae1d5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602599, "uuid": "47e2fabe-7510-446e-bf3d-f9876a33ee6b", "comment": "Malware payload (Mirai)", "value": "0a4ca88e0556b4875e9ff7c737418e8ce5fe814d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602599, "uuid": "e8d9e6fc-ba59-4cb1-bbbc-f148ca271e61", "comment": "Malware payload (Mirai)", "value": "10227162469e7f9fb2ec589384b0feebb8760a9ddb095499a6cf6e23084ad4a08ffa8fe717b81ba722eb07595667620c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602599, "uuid": "257b74c9-424c-4681-9880-c7f865f2f648", "value": "T1CB043B56EA408B13C4D32B76BB9B424533239B64D3EB73055928AFF43F8679E0E67601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602599, "uuid": "82077e2b-d627-42a1-88e0-9862aa1bd887", "value": "3072:asTFBgvd0k6alfuzz1XvXCSAZZf9fm+5t6DCK7xhp2M/9GqZ1PvLPw5+Z:asTFuVP6alfuzz1/XCSAn9O+T6DCK7xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602599, "uuid": "7c2dd566-f75e-4cfe-9446-23590a2353e9", "value": 181903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602599, "uuid": "faa31cde-9685-4b12-b2f5-d73ac5888ff9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602599, "uuid": "3b1d1ff5-4279-4b56-b068-971f6bc2a225", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2264a0-bca2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762606700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606700, "uuid": "6d719e0c-5063-4678-9dd2-11b7bf2697fa", "comment": "Malware payload (Mirai)", "value": "0c5c493a507fded482b2dc36b3bff911", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606700, "uuid": "3ebed209-4724-42b2-a36a-7f20b5284ab4", "comment": "Malware payload (Mirai)", "value": "9aa86ed17b697412b5b34933606dd37056605f0bd9504be58f6f9ca299529362", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606700, "uuid": "3cb85bac-3b94-4a49-8ff3-50258ea77fe0", "comment": "Malware payload (Mirai)", "value": "59f9010db7edc86c9e7da08218ff46e51ebbf1df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606700, "uuid": "df18658d-dacd-4b97-85c1-f3219a13d59d", "comment": "Malware payload (Mirai)", "value": "98dcf5c58607208466af9362362b548919b9bb49b5ececcd75ed728586878df69c6c0f4d164b5d20298c8b30dc253a40", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606700, "uuid": "94517238-5bb5-4a20-9ddb-f8630dbdb9c7", "value": "T14DF34902B30C0A47D2632DF02E3F2BE097EFDA9121E4F641651F9B8A9672D361585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606700, "uuid": "41894d24-61f4-44d0-833f-43ee0952af8e", "value": "1536:SW3bmyGKnCcQjYpySAxgDVT5vhiX+EFW+tk4lvAbRoeDG/t2ErQqh7M2IymQY2AY:tLm3Iy4y5xAVDiFWokPbdE66hh1XCI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606700, "uuid": "7b9abb2f-c36f-462b-8355-954f5c688022", "value": 158744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606700, "uuid": "d2bc430f-95fb-4e65-9317-035a2bcf4e0d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606700, "uuid": "d6416ba7-979d-4772-a833-69c880c4423c", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501f0fdd-bc77-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588107, "uuid": "1ec184d1-498b-469d-bdd5-06c52cb7267f", "comment": "Malware payload", "value": "b4236f698e0ee7ba63fd918faabaa9e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588107, "uuid": "ffc2213f-66f3-4775-91be-e4a29b0e8155", "comment": "Malware payload", "value": "9ae6ea02ae345df7d39242d9ba0a55c8960a3f15c9ec9f68ea5d9ec8a9510874", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588107, "uuid": "8b829f66-22ee-4232-9826-7ea043f928f9", "comment": "Malware payload", "value": "2fc4b36a13387339847035207c6260542313b8d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588107, "uuid": "613748b8-410a-4a3d-a9e4-bb8d99cf150d", "comment": "Malware payload", "value": "dffe6d2934f6a7833b343b5f901367f9c8d61cfb4d94ecc1b4f5a5e6c7bb932bb8294df71bf2ce036f68586520dd5225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588107, "uuid": "f77e059b-02d4-4a3f-a54f-0766015dd724", "value": "T1EC2723E0EF959423F27A3BB769DBE7D1C02E6DBAB150810BB18C76190324616BE4713D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588107, "uuid": "e82714d8-5c47-4f44-929a-1a56c66882c3", "value": "490691c1e02a66f93031cea140117d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588107, "uuid": "83a9fd0b-2e68-4dba-9c25-6f5c45f05518", "value": "393216:63C+dO/Vg/CizjMTSqkF81kFh91Tg2dj4ZeJcX:GTdO+/VjMTSqki1W1ThjEe8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588107, "uuid": "76a0ecbc-5753-467b-86f7-2d6836b5534f", "value": 20939339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588107, "uuid": "b634d16d-1699-4fbe-9b9c-e97e9e001435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588107, "uuid": "110b0bc5-324c-4b0d-af2a-3a31379fc089", "value": "b4236f698e0ee7ba63fd918faabaa9e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcc3868c-bca4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762607724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607724, "uuid": "f7fb72cb-53f4-4475-a78a-bdbfababa23a", "comment": "Malware payload", "value": "923a0b8038454ce1873ea96116906c88", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607724, "uuid": "71316b80-7eec-4a71-bb8c-60ea0d0712b7", "comment": "Malware payload", "value": "9baa2e38eff9b44cda70d9bcc639fe5cbb01bf28793da3fb20203f81e7b545c2", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607724, "uuid": "87942cf8-0cba-4f1e-8d2b-c1670f0e54aa", "comment": "Malware payload", "value": "67f0c910dd63ceffca7040f71b8ecc6688db05f5", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607724, "uuid": "74052971-bbe9-4c1c-aa7d-37902bd7e140", "comment": "Malware payload", "value": "95c06fc16f77ae3e2850715f80d9035d243f05123d6f6258a27053cc75cec44be16eb996464a9c3385e883b20d21a055", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607724, "uuid": "5381142e-eb8a-459d-9dc1-36ef0409b19d", "value": "T1E2D6339429C063E6D86204789CB2ACB785F47CB52BB1C6D726F877654FF32C05D2A623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607724, "uuid": "d488b622-f0f2-4ef6-9923-2de2fdc30403", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607724, "uuid": "cfe29fcf-6bcf-463f-b2ee-0d81895c507b", "value": "393216:ib92sXojM0xKtzXMCHWUjG4cuI3/PjuUw7:ibnXDTzXMb8IH/rA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762607724, "uuid": "177f0dc8-6da4-4b91-ac76-4a2263e94d7c", "value": 13165124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762607724, "uuid": "bbd0fcd8-de38-442a-a045-6fdab37ca415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607724, "uuid": "0ebc6197-aba2-41cf-a0a6-7e898fee9997", "value": "\ud835\udc4eft\ud835\udc1e\ud835\udc2b_\ud835\udc52f\ud835\udc53e\ud835\udc1cts_v\ud835\udfd5\ud835\udfdd\ud835\udfd30_\ud835\udc1c\ud835\udc4e\ud835\udc5a_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f3ea0a-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762588899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588899, "uuid": "41cdadcd-7a4b-43a5-8c5b-8f4377a43fa2", "comment": "Malware payload (XWorm)", "value": "f8ab16d94b05c5c0e5ca608a7724d5db", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588899, "uuid": "77f3ffaa-19ce-4bd6-aa54-3a390c54beea", "comment": "Malware payload (XWorm)", "value": "9c9cf095c3ff1c23a4938f8f815055521383bc6ec5e27d4647f0f6037f500402", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588899, "uuid": "998576df-bfe9-496c-992d-a16ff422ce94", "comment": "Malware payload (XWorm)", "value": "10eb236b1b65f91cab427b73ad8945414e5b8429", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588899, "uuid": "8e3ca250-6349-4d4f-a78e-e3ff2ef2b11f", "comment": "Malware payload (XWorm)", "value": "94bbb0aa706fec61c491ced4823cccb315afd3ef16966918d77917bf3545168344736a485dfa81a737d3b3341f343db9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588899, "uuid": "a0674fe0-c57d-4af7-af42-71d9e0c78f88", "value": "T196442AA6EC42FC62A50E946DE6E019EF1AA404D9F411E2ECAB14F3277C455FCD2F490E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588899, "uuid": "c239dc47-c4d7-44d8-a610-d995b0783fad", "value": "1536:fX19cOfZ1IUxqPSahSIU1O/gVQddSVv2UNIBFKZMTIHIwU2kFe9Egy+4gyVOliGW:vfx1IUIPPjkO/gVQddSVeDBY1pFkXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588899, "uuid": "5f299912-0d16-419a-869a-4ce0fc606674", "value": 254271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588899, "uuid": "e088def3-3c84-4c64-bab2-84ccd94c9aff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588899, "uuid": "beb91e7a-08c6-4dd3-9c24-2ced980adc86", "value": "Purchae_Order#50042.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420b2ee9-bc3d-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762563173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762563173, "uuid": "2cc0637e-aae6-4b09-bb05-a97ceef28e4c", "comment": "Malware payload", "value": "b36048f695be3fa6beda1cd853308943", "object_relation": "md5", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EvilSoul", "colour": "#6C1FF0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Web", "colour": "#099E68", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762563173, "uuid": "61e95c6c-c3b8-46f1-9b40-15942f4795c7", "comment": "Malware payload", "value": "9cf11aee2dfe1f24d5c2a7fd277b36c3771187251f4cb88f5bdcb05714fde5a5", "object_relation": "sha256", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EvilSoul", "colour": "#6C1FF0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Web", "colour": "#099E68", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762563173, "uuid": "3b1b1579-1213-4ef2-b2e0-f28c3c6ae66f", "comment": "Malware payload", "value": "9fdef505703f31c307baa79c0c22249c52f7e04c", "object_relation": "sha1", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EvilSoul", "colour": "#6C1FF0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Web", "colour": "#099E68", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762563173, "uuid": "b8c70139-ef9a-4816-bb63-f8c550b73191", "comment": "Malware payload", "value": "ec2e2d14b1d10888d3c4aa2484456e01dadfaf9f8c0e9f83129097a430513af31963b202061283a74ebb27fa18387c95", "object_relation": "sha3-384", "Tag": [ { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "EvilSoul", "colour": "#6C1FF0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "Web", "colour": "#099E68", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762563173, "uuid": "8a2ee63d-f156-46c5-a155-b3749f33cf4b", "value": "T1F8F7AE0633F501A7E5B392798A9B4103E772B0575731CACB318C43642FABFE49A7A764", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762563173, "uuid": "9b503637-fce8-4575-ae5e-c7c9da512f6a", "value": "4d0fb8dc9ee470058274f448bebbb85f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762563173, "uuid": "a53258e7-5d38-42e1-be46-7af7e7b72afc", "value": "786432:fMguj8Q4Vfv6qFTrYfDJM/DJMVVoVtc/Wyn:fiAQIH6kHKD6/D6+M1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762563173, "uuid": "cc926b80-473f-48ad-bf79-12f925e5898c", "value": 72112750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762563173, "uuid": "fa265a26-fcd8-4b8b-8473-9045992d6802", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762563173, "uuid": "f48d1ae4-0fa0-41b9-a547-5e949373e0ed", "value": "panel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6f45009-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623472, "uuid": "2c88bf07-df41-48ec-8399-60a6a4fd843c", "comment": "Malware payload (Mirai)", "value": "c18b2c43b045380c27bf2531810b2b5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623472, "uuid": "c4cbbdfa-d0c4-49f9-a346-13fd63763ef5", "comment": "Malware payload (Mirai)", "value": "9ef79d1b3b51ebb1b2db738984d9cb594ad3bbb4f4c08fb878c01b6dfa745c2a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623472, "uuid": "7b852d43-91d2-43a6-8d85-962881cb47e8", "comment": "Malware payload (Mirai)", "value": "881b39e9bc9d16a12d626000e277a303e6ff3548", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623472, "uuid": "df240fcb-452f-48f4-9265-ce329c7d4be1", "comment": "Malware payload (Mirai)", "value": "b7e27c30b41f644bea003e99eb2c099ae4196bdbc8c2cac4449625317fb309f6530ac6b2f1ff1761cb2799c7fe98f708", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623472, "uuid": "04b19f3c-ceed-4cb7-9cf1-3f38025666d4", "value": "T1FF043BC7F800D9BDF80BE77748170915B630B7E210929B336257796BEC3A1991927ECA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623472, "uuid": "3a1a44ea-ad21-4e89-b60b-b7342a0b05c0", "value": "3072:tViRfTEG8d0cRQX+R164K99mGVJ2VijbiyLcsAS0yaWZkouh/FE7b:Hi1TEGRX+R1FK3vVJfLoyaXoJ7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623472, "uuid": "15f7e8c8-e3c8-4f5c-a368-61ed059076d4", "value": 175712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623472, "uuid": "2417938a-986d-4c97-a856-e3e78e9bf7ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623472, "uuid": "fab88552-ccd8-4141-8880-d1a7bf7e7358", "value": "boatnet.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05852b1-bca5-11f0-91c6-42010a9c0006", "comment": "Malware payload (GhostSocks)", "timestamp": 1762608026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608026, "uuid": "deabf87b-d61a-4d5d-b19b-db49c4d2a316", "comment": "Malware payload (GhostSocks)", "value": "2e69f114c12848beaa9f959c1585b05e", "object_relation": "md5", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608026, "uuid": "7b8f99ce-5f95-4b34-ab20-5decebf1a78d", "comment": "Malware payload (GhostSocks)", "value": "a12a94bffabebc1759a2e50600da543c077aa66da33e3881767d547d1b367bd6", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608026, "uuid": "df9e22b2-6800-4119-9cb8-f1f0425062dd", "comment": "Malware payload (GhostSocks)", "value": "076940b5f9ead435da1f467b923670b8c6447197", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608026, "uuid": "8a683378-24e6-4f0d-a7aa-bdbc0213adeb", "comment": "Malware payload (GhostSocks)", "value": "dbed83ce02468d558c74c190d477cd39c1af78ad3d43d1925864e2d0befd19e5d867704eaf01e6290645b60ddbb4bdff", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-LummaStealer", "colour": "#16BEE1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GhostSocks", "colour": "#133B71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608026, "uuid": "40750883-3041-4d73-9e4d-9f84fff6fa58", "value": "T10E5723A0EF959413F26A3B73599BE7E2C03F7DBA7191811BB18D661A0724617BE4303C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608026, "uuid": "ff1f058a-9473-48c0-9b39-83d73ba4ea61", "value": "490691c1e02a66f93031cea140117d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608026, "uuid": "3c174985-213e-487c-9cf5-6744f9ac6a65", "value": "393216:63C+dO/Vg/CizjMTSqkF81kFh91Tg2dj4ZeJcAY9wLTHpmJyP8lLQg:GTdO+/VjMTSqki1W1ThjEeMIrQB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608026, "uuid": "8f71d722-0d37-4fe5-8733-f301a7c1670c", "value": 27468296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608026, "uuid": "166414cd-dd3c-465a-8fde-4051a9c167bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608026, "uuid": "2d2d8a3f-c4db-404a-8df3-c29f62bc2304", "value": "Renewable.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e291e9e1-bcb2-11f0-91c6-42010a9c0006", "comment": "Malware payload (DonutLoader)", "timestamp": 1762613693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613693, "uuid": "2657e5e2-dd15-4c78-aad9-624fbe50807d", "comment": "Malware payload (DonutLoader)", "value": "be3e8d6edf42b502c39cd21fe011ee08", "object_relation": "md5", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "onethinz-com", "colour": "#43F50E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613693, "uuid": "0a5ee1a5-fdec-47f3-a110-11b459e7cd26", "comment": "Malware payload (DonutLoader)", "value": "a1761c5cddcc65d712992575a7c09fedb61b8449637800f090855bea2288b643", "object_relation": "sha256", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "onethinz-com", "colour": "#43F50E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613693, "uuid": "0b39817a-fa1f-4e7b-a3d0-9a209840b79a", "comment": "Malware payload (DonutLoader)", "value": "1852e1c933278213fcbe9c3b54dc739f977cfd33", "object_relation": "sha1", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "onethinz-com", "colour": "#43F50E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613693, "uuid": "94b54e17-b558-4d20-a60a-5109811ab735", "comment": "Malware payload (DonutLoader)", "value": "132ad281efeddee7d53bce692757415acb05f144c162d4529a85c4248742649fbbd574bb624d48e792a5298c56212f13", "object_relation": "sha3-384", "Tag": [ { "name": "ClickFix", "colour": "#649E47", "exportable": true, "hide_tag": false }, { "name": "donutloader", "colour": "#6BBEA4", "exportable": true, "hide_tag": false }, { "name": "FakeCaptcha", "colour": "#442A67", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "onethinz-com", "colour": "#43F50E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613693, "uuid": "da4a7299-809b-4bc8-b40d-90ff8c5ab07d", "value": "T19BA251353D8BB404AA7DD916A22F9615F968385ADC119CC334C339933B037CA7A879BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613693, "uuid": "5e3ba1ec-2a35-44b0-adb0-9634a8e2619a", "value": "384:l6oD7km1HNM7Xuh4RMIXYXEpKkNormiqdo3/sFoZd:l3D7J1HK7Xuh4+X4Oiiqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762613693, "uuid": "29192a35-e2bc-4018-9e17-afd76367e2c0", "value": 23169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762613693, "uuid": "4a5dee49-b8f8-4c04-9808-9a2b1fb0842b", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613693, "uuid": "cd108f6e-4b2d-4382-b9db-1bcc0e769b52", "value": "interop.xz.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a909e5bc-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623475, "uuid": "ac5161e4-376f-4724-8513-0eab1f80b858", "comment": "Malware payload (Mirai)", "value": "068b15fbcbc185202d32a1796c6a3f3a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623475, "uuid": "555c5bdf-d656-42b0-842e-a5e6f1aef10f", "comment": "Malware payload (Mirai)", "value": "a1efc7813ba34eb7182c5e09317ffc305986d143b1f27bf5dedb6036df65d8bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623475, "uuid": "f4abfa38-2e62-445a-944d-48a49436ae9e", "comment": "Malware payload (Mirai)", "value": "57d0c2294d82fa58f475d124ae38c7c8a9fdc60a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623475, "uuid": "ca86c9c6-170f-44ca-aabf-fa48dcc476b7", "comment": "Malware payload (Mirai)", "value": "a3175c373fcdfe2902afa882a5ae4fcbaa5da0f8af71c4b4b4c9b025cc919dba2375b564e871258d53f43005e933df9a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623475, "uuid": "982607b7-0e42-40ab-9f50-abad488e85f6", "value": "T16433F1B9DA231DF0D1E71133E4648ACA33871C71628336222E6A47DA3E53B55F369693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623475, "uuid": "dcf91280-20be-4c2f-a638-528dd81ebc65", "value": "768:bJsBQifxojULuJmO6KVF2MQHE404/LGaMHPFY4TPzutjnU7G1VRv4VX81ws3Uozi:CBQex2N5/QkIGJHZPzutjUSnQVMnzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623475, "uuid": "5fe8ff51-9672-49fa-baa0-8a70e2a53296", "value": 53776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623475, "uuid": "65da20a0-9011-4c40-9646-f9a11537f4f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623475, "uuid": "596003b0-427c-4d21-a6b7-56786817ac8a", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e11d2c32-bc9b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762603813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603813, "uuid": "a422036f-9fc5-459d-89a6-6ab307e43475", "comment": "Malware payload (Mirai)", "value": "7a2b4f95bab2e8cd80d671a734f69b5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603813, "uuid": "c59e2a79-c1d9-4731-bd8a-99bfb634f423", "comment": "Malware payload (Mirai)", "value": "a28b450262545d5439f53da00e62f691b9298bbb0c7ca36395b24f643af54e80", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603813, "uuid": "c6a4f447-5efc-4abb-b3c4-64f23a3184ce", "comment": "Malware payload (Mirai)", "value": "3e1f74e29ca9ce1795132425b60e50254205c938", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603813, "uuid": "a54f99a3-7b7e-46cf-9c95-15d0921eeec4", "comment": "Malware payload (Mirai)", "value": "d7606b32a011e57c3422ae581e2b7254e131a58df8b398afa0c79c28aff07e1fba5211e29a59cda4164bf3bcfce9c5ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603813, "uuid": "4ab57152-0b91-4627-a6c3-2e40bb507fa6", "value": "T1E923F1F0E54D8E30ED70C77DEA380E21F915569A64D5642B9B7AA148D0F3240FB2D2BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603813, "uuid": "aa31b548-f413-447a-bc81-f74a48787812", "value": "768:x3VLJNz3yqG6lYadjLZFXXaccpjFEcJQHLSTqCacqwGVtaN2xLUiJqjoPA5H9q3R:xNJhs6CkLZ93IRJ4LSTbuwGGG20Y5WLz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762603813, "uuid": "86154f09-878e-414c-993f-86550b09e63b", "value": 48836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762603813, "uuid": "a2ddaa18-4c2f-477c-911a-106137cd4a9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603813, "uuid": "70856798-2f7b-45e6-9161-bc3ecb81fb94", "value": "executor.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83911da4-bcd8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762629855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629855, "uuid": "6164c805-f413-4a15-bd53-9c207c097edc", "comment": "Malware payload (Mirai)", "value": "2acb3701bb8115a75fd15e6b8aea4258", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629855, "uuid": "a90b1ee7-0495-46da-b212-3106c875bbd2", "comment": "Malware payload (Mirai)", "value": "a372adcce3b0c5aa936f3a3fa384fbc83b902c75ee930b5c5d5eb100b2f4cf0e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629855, "uuid": "91f902a0-ced4-4253-8c3d-95884f2b5c1c", "comment": "Malware payload (Mirai)", "value": "8f83bdd9199e45711940a05ed0160b4b0e5d2838", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629855, "uuid": "a9d61d68-b95d-400d-beed-7497bf26f4bd", "comment": "Malware payload (Mirai)", "value": "232500e2f01b96b57019455ce6de283adf91b0c0359756e0a7ad70847a4b4b9967ff990d715837fd6d4c3812acc07494", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629855, "uuid": "2a622a87-34b3-42a3-84bb-cd05b64f9a3b", "value": "T124837CC6AAC3D4FAEC1302382177AB3659F7D43E2265DA83C3F89836AC22541D51765E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629855, "uuid": "4c6a4974-289f-454e-a019-21e0f60b4139", "value": "1536:pXV0wqKfkKBFBrDrNHAn9GpQszXkkptDIEWSj4c3SlzQrUBo:pcKfdvnrNHO9/KX1tUlSIQwBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762629855, "uuid": "276502af-2507-4343-b428-473fc152f30a", "value": 88084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762629855, "uuid": "db71817f-5e49-4f3d-b897-7bbfe8aab83b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629855, "uuid": "388b14a1-dd36-41cc-98eb-1834faa5775f", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b3312e-bc96-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762601673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601673, "uuid": "327023f5-119b-40f0-9eff-cff66ef0aa29", "comment": "Malware payload (Mirai)", "value": "ece3ab2d12df9b0dab9b6434b714187b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601673, "uuid": "82319ab7-bc94-4920-bd58-c50fdbecbdf0", "comment": "Malware payload (Mirai)", "value": "a3854f56d0ee10f335d4315bbe1c02abd547376c20bcd8e3e5de8406b091a561", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601673, "uuid": "048889c2-137c-4614-b2ca-e9fbec7a6e57", "comment": "Malware payload (Mirai)", "value": "5a26983637010e064e5d03f19291c9ea7b7809f0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601673, "uuid": "89b0acc0-24d3-4f39-a624-6add72e11ee6", "comment": "Malware payload (Mirai)", "value": "cdacbcfda9a8b1c7b3fb101fa524e4d48ce14d18bb5e9d345dbe87efcbb404af3d3fd1db8ab5e97aa21956128cd5623a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601673, "uuid": "28af9cec-160a-4491-9a53-49c4ae33f93b", "value": "T188C3D71D7E328FADF768C63447B34F21A798239626E0D5C5E2ACE5045F7028D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601673, "uuid": "8f617f9d-0f70-4b85-9bba-4cb8ac762f70", "value": "3072:ItWz5VoZcwIYHuUsnm7jjRHRjwPWGh0NP:vz5V4BIYH17jx9c+NP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762601673, "uuid": "70bc092e-cf04-488b-a6e0-81a6cbc19796", "value": 119716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762601673, "uuid": "1335b893-7fca-4f3b-9397-2706d64abf6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601673, "uuid": "736341a7-038d-4c66-a6f4-b2857adf9c7a", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4859840e-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588953, "uuid": "c26a66f3-1b45-4eed-a560-70ada8844289", "comment": "Malware payload", "value": "745a012a2dd75da61745515e2d070140", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588953, "uuid": "4ab9986a-b117-439e-881d-5cd8c0e2e204", "comment": "Malware payload", "value": "a5f47fd48894cc71d782c1c272186f744cd5eb6439c2dce8b146f80fb5cb028c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588953, "uuid": "ccb34504-0c83-41e5-84fb-740ccbfcd573", "comment": "Malware payload", "value": "4ebe28a3d33a0a33549a21beb7c7b672ba64dc1f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588953, "uuid": "00cae5c3-134e-4006-9768-3f4e2067a7a1", "comment": "Malware payload", "value": "3eba1269194d60bc6854cec1fbcea5a377d476231dd3d3351a226b5bda48e4742500e5eaefa8092f40ab13d856501871", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588953, "uuid": "1ab92e25-63db-4677-86d8-44690d43b3d5", "value": "T155F6B5323A82BC5F2B07DE2A736AE2848E131ED775089919F0907C9472E3C7BF6155B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588953, "uuid": "9f83e9c5-a793-474e-88a8-818389020de2", "value": "24576:CPJo+BgpPS8podA3Ia7jZs7muXo+in3JviSilT7kovc4o+h5sp0wlyvjWx4ZeAt/:84/UHoLC2Mi9uqexFVJG82v6vH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588953, "uuid": "9e0375f6-dda5-4fde-8faa-304b21a7defc", "value": 15597236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588953, "uuid": "444c4d11-8789-4afe-a51c-b6f6ac9ae173", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588953, "uuid": "ad4b82bf-30ab-4d91-b2f8-d7fe48f5604e", "value": "Request For Inquiry Nov25.JS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d41633-bc83-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762593531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593531, "uuid": "34e046ff-dce2-429e-8985-43cd63157e27", "comment": "Malware payload", "value": "4ab886a32be63206b52e904644cf253e", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593531, "uuid": "90348827-b175-42c3-b57b-a0435ec80891", "comment": "Malware payload", "value": "a6266178ca46c95564cf34767488cb03e44841e931d28f7371eaf96ea0f2f012", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593531, "uuid": "8096b119-44de-47ed-bb7f-8364adf1c7fc", "comment": "Malware payload", "value": "0987c1469bbec70d3a8e30778517e1059b4336b0", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593531, "uuid": "3f56e7b8-6ea6-4523-b665-906213d0e341", "comment": "Malware payload", "value": "942634230def4e5dddc76c398ec8662867db6d478712e1c0f63bfc141d982e410e15b1a4156b6f899fc6820ecfce2a4d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593531, "uuid": "88f3e8b6-9a8c-4904-9233-ad2911ce4db8", "value": "T138072284FBA9F81BC437A0364A765A63148A4D119A42E7133905B71EADF3ED48F46FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593531, "uuid": "4d61fbca-5eda-413b-833b-43e7ac4e95b5", "value": "393216:6iccM/ZS8WrwWjSqHNbpOQvkmCmdaoBX49BGNOIV2wGk:tctnWrwDqNp9/ZdzBXUGwC2Tk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762593531, "uuid": "f3673ecf-40b5-4327-8b08-f9cb454a88b8", "value": 17773103, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762593531, "uuid": "bf10b1cc-5725-4edb-b38f-553abc025fb1", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593531, "uuid": "61041496-d6d4-40cf-823c-74cd938c555b", "value": "sho.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd0c66e6-bcd5-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762628663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762628663, "uuid": "3443b3a3-f86b-4a9d-8780-0093646a8e61", "comment": "Malware payload", "value": "ba5b412fc3541e298a6d37c31d4383b7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LANDFALL", "colour": "#A421E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762628663, "uuid": "3a67d9a0-1005-41ee-bcfe-3058dd95caad", "comment": "Malware payload", "value": "a62a2400bf93ed84ebadf22b441924f904d3fcda7d1507ba309a4b1801d44495", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LANDFALL", "colour": "#A421E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762628663, "uuid": "a0146cff-21da-4669-ba53-492e32e0f9c7", "comment": "Malware payload", "value": "2151b6556f07d247f70bf87201b2ee0d9f572f96", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LANDFALL", "colour": "#A421E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762628663, "uuid": "4f56f41c-14bc-4203-93db-3fd82e9d96bc", "comment": "Malware payload", "value": "52174490ecf108f35d2aea6fe556a941d48e8e15c6be4a2d72f5098eba690b26c7daf83526e5b54b52ee0dd9e8566c03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "LANDFALL", "colour": "#A421E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762628663, "uuid": "c7c51a77-0c2f-4142-8907-52b463c825b2", "value": "T123A32B09F10CDA0AE6CAE1FC4B494761F716751CA39883E53032435DEE8ABEA9F1D761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762628663, "uuid": "2f409140-6f9b-4b52-aeae-70196eaa69fb", "value": "1536:kFnp/kE3+o4lrR67o5H1g13Avmd7yhE3jzN+4v82URU8yKlxTUrCpthnpwFjYN2I:kFdMsQsc4nUyoz36uNCsRr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762628663, "uuid": "7e2a058f-a945-432e-8ef2-f33b6618fd48", "value": 105790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762628663, "uuid": "d17701f8-92a1-4fed-93af-1d1c8a29dd5b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762628663, "uuid": "bf152fe3-a64a-480e-80cb-99f192fe60b2", "value": "b.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58d3392-bc83-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762593512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593512, "uuid": "5846f72d-0fc4-4ef7-aafb-98ad7dedd8a0", "comment": "Malware payload", "value": "ba02c11e91218febbb8017cd03a3c800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593512, "uuid": "596c2260-6002-4e6b-bc04-693b2e953fa7", "comment": "Malware payload", "value": "a71dec0d7d3f3be5d8046d03b662f0b2328bbbd4a3a88e33820ac4a825455e13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593512, "uuid": "b4d3d0e7-3974-4ab0-88c0-ae5f83bfd611", "comment": "Malware payload", "value": "aca7d22ceb97c214db6a5a0bf1af65b73a256bd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593512, "uuid": "567c534a-4d9a-4b29-bf8f-1926f7fa11f5", "comment": "Malware payload", "value": "9b79f258148fce30b3381d602bb6a87ce837c9a83c27e32e83104d2b5647e9a926f18baa3c76dff0219546587d8ef43f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593512, "uuid": "ddfccf83-ffc3-4455-a037-7994692e5d18", "value": "T1FEF5810BA6F8C118F5B2A670DAB582F615777E40E738D58F428F3C5D3579A30AA20763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593512, "uuid": "1c26709e-7408-4737-9ca9-106698c0a895", "value": "0c124e8ac1245068488198549d484b40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593512, "uuid": "f3ab1e1c-6cb0-4883-bed5-866351b1fcd1", "value": "49152:u3/0e6aTrHGw0g83XXoTg18CuDHwb0X3nOFLi07:ze6hgdHQS+FN7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762593512, "uuid": "8c102e8f-be1f-40df-8002-686c63e40166", "value": 3459721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762593512, "uuid": "ba5c4c6a-e192-4122-a3b7-8da88549f4f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593512, "uuid": "e4040ded-6753-4244-a987-362279355117", "value": "CXM_Direct_MT5_Terminal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8d8274-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1762588934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588934, "uuid": "68117e63-70b7-4350-8f19-8dd16b2090d9", "comment": "Malware payload (AsyncRAT)", "value": "7c2ab991c325e25467b44cbf98b150bc", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588934, "uuid": "180b8f4b-3e0f-4a5c-a233-d9f08e624657", "comment": "Malware payload (AsyncRAT)", "value": "a7799beec368393195dfe5488eef2ceeb867d016df5913a38730c69ea73f90d0", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588934, "uuid": "05d39fae-1e52-4e2e-8f21-8053c4a871b3", "comment": "Malware payload (AsyncRAT)", "value": "4b1bbb8d0b3338a9136bb66eae2e89782da645da", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588934, "uuid": "8a702ecd-d4c2-4f57-ab74-e0fbc7e4cfac", "comment": "Malware payload (AsyncRAT)", "value": "844ca30ef96b3ba8a6081fa40f9f7da9526accd6353883499fdff8018d25b66c6836162643b73b84603f7ae5504d9c92", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588934, "uuid": "084b650b-84a4-4c8e-9932-22dcbe8facf8", "value": "T1A16623801E1C1D5A98CC3C4A8E13C74D672DBA029DC5551ABCA0F6EC6691E3DA3F9CF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588934, "uuid": "3835f95c-8b85-46c6-bd0b-2729ca1cfde0", "value": "384:fbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb7:UTfogxoonFPLWgwHfoIPZwim4Ewww0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588934, "uuid": "c8f50b9b-b112-45e9-98cf-5e5348f9548d", "value": 6631941, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588934, "uuid": "efaab09f-055a-4992-b191-2357a63f15f8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588934, "uuid": "616ef1a0-c832-4c99-a1c8-aa4b0d722966", "value": "WMIEventLogs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cb4e512-bcc8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623025, "uuid": "aac2de91-c794-417a-82a7-2b768c36180c", "comment": "Malware payload (Mirai)", "value": "a41f79b0078039f8b29005b10db17bc0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623025, "uuid": "dd5706aa-6da1-4ee4-9ddc-b58019cb25b0", "comment": "Malware payload (Mirai)", "value": "a80072c3c5e1dc0b1a77a8d37cc7f02a5435bfc388444eace2481efb40e2f451", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623025, "uuid": "fd1f75b1-1a58-4f0f-92fb-cd70be7a8d1c", "comment": "Malware payload (Mirai)", "value": "37f133b2519d5e2980a392e73893ad3cc888e308", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623025, "uuid": "6c741ab7-90a4-4c3b-97e7-966bb2c588df", "comment": "Malware payload (Mirai)", "value": "d5cd5191b841be1d0f956886f1bee7eaab5465359e752ed4c55da2fea73654bf9ebee5ad8a9e55a79bfeb544ac0085d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623025, "uuid": "8bc0a827-430e-4475-bfbf-6a9cec6f5312", "value": "T102936D02B70C0E43D1675DF02A3F27D1D3EEA6E121F4F688691EDA8591B2E331586EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623025, "uuid": "ffc008f6-4f71-4a06-92c8-f5588fdfdeed", "value": "1536:H+564z4ITD5mrj6eSwxAOZ1qnftDFeyp1yEPNASKnwusu+MOXyCIk84kx0ytP:e00BTQ+yWnASpFM1Cp4P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623025, "uuid": "50eb80e2-754e-45b9-b724-cd7db1c6076c", "value": 92048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623025, "uuid": "b2647b84-ed22-47db-af00-4256019b60ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623025, "uuid": "e8213596-cca8-4cee-8358-f59c72d5f57c", "value": "titanjr.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067c44f7-bca0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762605593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605593, "uuid": "1c4f55ab-9b2d-44d8-8011-998e8a02a540", "comment": "Malware payload (Mirai)", "value": "4242677f24040bd66ad40c4278dcc0f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605593, "uuid": "c879a6e1-7833-4d39-8b68-d9efcc4ea32e", "comment": "Malware payload (Mirai)", "value": "a81972bb34f9ec7553fd75929fff125a01b8c53db350e97161e3cd86bd4e9ab4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605593, "uuid": "e8e0aefb-36a9-4ae5-bd28-cdd1bc7892f2", "comment": "Malware payload (Mirai)", "value": "3891672d79e78752d763b38d7ccec98f26cb485e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605593, "uuid": "41a78afe-ea9f-457e-89d7-2b5bb998b596", "comment": "Malware payload (Mirai)", "value": "1268d3e328b91b37d628e9cbf9a50cabab98f831f738e47c4641e1f4b23ee9662d6bea61e45772aed3fbb8d7319b6bc7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605593, "uuid": "03938766-894b-497a-83e4-23793ff226a8", "value": "T10263023098C3D024CAD5C932EAB75E843F491B3CFD7958740139760AE1F199E2BAA752", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605593, "uuid": "c2c804eb-dabc-4f67-bd2f-42334c69f3cc", "value": "1536:cwM8ntCXWoIJq7n2lr96+XffNZyvsB6LK7dpIfGhOJZjPR:TMStCXWo12lxfNw3LK7GGhyhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762605593, "uuid": "4655541e-a653-45b7-a6ea-a4b76f9bd52a", "value": 71616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762605593, "uuid": "ddaa885d-0830-4d64-be57-74ab6e03adcb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605593, "uuid": "9c97421c-340d-4677-ace0-7fad6b185eea", "value": "executor.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a7f2301-bc9f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762605358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605358, "uuid": "9da6f8dd-686c-4465-92fc-ea967180b2a1", "comment": "Malware payload (Mirai)", "value": "aac15897d0cba4b970548b7fc28f7e43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605358, "uuid": "a8aed80c-dcd7-41cb-b301-c2d06ee85c15", "comment": "Malware payload (Mirai)", "value": "a81ad14543b5b5e44edf0fa361cd03ba4c6bdad13639fcf4ec9c3f05bcd98d4f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605358, "uuid": "27555081-9dac-4e96-9448-83cdf80bb327", "comment": "Malware payload (Mirai)", "value": "b505ec01eb403747f3fdae27740adda7d443d9f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605358, "uuid": "0cd2a93a-e833-4947-8a53-e28e4451bffb", "comment": "Malware payload (Mirai)", "value": "f66871ebb88c411136d0f7ff3fc2ba56d8912a0e4c17ca08e3ddfbdf3526dab87f5981f0caedc7b08e586c7bd686a25f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605358, "uuid": "030dda7f-05d9-413f-9722-4106c5acec9d", "value": "T18B23F1E178275865CE311C3ADA9B2502E3BE09F2A22D33A29615C6FCEDD74C275B11C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605358, "uuid": "6cac39e4-d18f-4cc4-af35-738e0c69a58f", "value": "768:v9p4OQrbFJ6eQAYPTccKKfLilLG58LKl7HURxIpHsPOGg6AE9q3UELd:v9BLexYQVZ058ulFpHsPZsLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762605358, "uuid": "1b5bc4a9-6a85-41eb-b76c-08b82e2c7365", "value": 48072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762605358, "uuid": "93df4358-eb09-467c-85c5-eaf49780a2c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605358, "uuid": "cd566ae3-63eb-47b1-aeb5-f4e72513fe9f", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf6310d-bc4b-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762569496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569496, "uuid": "7ca931ca-6df7-4775-a575-917e3a014983", "comment": "Malware payload", "value": "33c9a4dae0bac39accf719e61e1a14ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569496, "uuid": "2c74065b-580e-40db-a802-dbe1062d9994", "comment": "Malware payload", "value": "a85c562d0b13602adfad63635f895ba1fcd8f4780121f7f98febc10fbfba1819", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569496, "uuid": "3fc58ec3-6e13-46e5-867b-7001545cc39b", "comment": "Malware payload", "value": "a1fc529eaa698cc799f6e76196da6960d05265b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569496, "uuid": "e24100ac-4b07-4e27-91ae-bb2d58dfa3a5", "comment": "Malware payload", "value": "1104d6a223074105e872fa2c9fb0f26e517155aabe8a9ab0947c494701e9b51717916db706ecd117d996328c243b12ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569496, "uuid": "f1950b97-0287-4d6b-bf78-50b1d2b775c8", "value": "T1DD733A02B6A254BEC097C5B4876B9577F932BC581214393E7784FB352E32F325B0DA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569496, "uuid": "d3d8157f-12a2-45ce-84dd-09ec0fdb48a3", "value": "1536:rY30VEiQRU+o7EH1NOV/EcUyjuzgtorAwx:bgRaK+/l/SNAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762569496, "uuid": "1a7a251a-0d2a-49a9-86e9-ace91f002446", "value": 75640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762569496, "uuid": "05e5a2ff-ccb6-4791-9e5b-83e3e98df699", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569496, "uuid": "455387e9-6e32-413d-bf61-bfbf6b2ec489", "value": "frost.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc560db9-bc73-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ngioweb)", "timestamp": 1762586625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586625, "uuid": "5cc1d386-ce08-4a31-8af1-ef051739c691", "comment": "Malware payload (Ngioweb)", "value": "3fef122a4e7c08c8663902126edf7a37", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586625, "uuid": "6b71ef21-dfe9-4c8c-a7ae-b64d118fa4ba", "comment": "Malware payload (Ngioweb)", "value": "a8e87888e8e4cea9a8afacad551c18d2b1ccf0fd763a5f2d3000b5fa8869514d", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586625, "uuid": "16896d8d-af85-4536-91c9-2b4a83aacf01", "comment": "Malware payload (Ngioweb)", "value": "4f0e510492ff6a120bf7d9392638f51e02401f9a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586625, "uuid": "f94d7920-d30c-4ab7-98f7-e5612d7b6874", "comment": "Malware payload (Ngioweb)", "value": "7074fce1b8c2c3010f0c9a2d7de22b76dd6a73384d8330944e6e46e42a79acb6ab23b3ccb986ca65c8e3b68fce68132a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762586625, "uuid": "8ed15386-592c-4e5e-9076-8c809320cfab", "value": "T15101045E242116D0D168F6807871B812DA4AE282D4D0FF3851E81DB7C4EAA98FF17E55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762586625, "uuid": "6c2f5fc8-28b1-479d-9360-df5a4f4fea6c", "value": "12:78CEvpGCnvpGCWvpGC4vpGCXJvpGCgvpGC7bzvpGC7kzvpo:pEhTnhTWhT4hTZhTghTvzhT4zho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762586625, "uuid": "0522986a-4f5e-4a53-8c2b-ecc7563304f6", "value": 784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762586625, "uuid": "225bf073-d6cf-47a4-97a3-2ad5868b6c51", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762586625, "uuid": "a025b1f1-c235-41f0-9af4-cc29ff1f6fe3", "value": "dvr.tvt-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfb82844-bca0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762605958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605958, "uuid": "87b38a51-3055-4e0d-84d8-3febfb46e7cd", "comment": "Malware payload (Mirai)", "value": "89d2e0d98474583f095a2aa4e35ff92c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605958, "uuid": "33663733-1ed9-43b7-b2ec-e5dab86e9a02", "comment": "Malware payload (Mirai)", "value": "a8edb89cf9f493571a51860d1ef077a4f81d72fc40eed7b08afacc95c71519f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605958, "uuid": "bb3cc63e-39da-4425-98f7-e7bce581d039", "comment": "Malware payload (Mirai)", "value": "5633f617527fa5233462869474f1d33520ad7bb4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605958, "uuid": "b865fbf0-151d-4647-b45f-9923c4510d3e", "comment": "Malware payload (Mirai)", "value": "a525e0143d1c68f902b0c73f12a7ea26d1ac56426a650cdaa1760c068ee7ce60030357d936d54d051087afc8494ded25", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605958, "uuid": "e52945f5-d77b-435d-a77a-7de87bd23ef3", "value": "T1B6739E63DD681D98C65C82B975A4CE395323E900A6931FF6069BCA73D00BEECF5093B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605958, "uuid": "dcd99887-c51d-44d1-9644-de7475865191", "value": "1536:5/Fsv9ozAPETFxZaJXwK1jJ/7Thtdk6C+8BrL+K:5tsvezAsfZaJXX19Jtdk6WxaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762605958, "uuid": "761f1a4d-4ad9-49d8-b097-989d6ed4a88b", "value": 75296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762605958, "uuid": "39783528-0c3f-42e9-a708-c71b1c6cd9a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605958, "uuid": "34d81282-b8e1-409f-94ed-4b3e134f78f5", "value": "morte.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46507bb2-bcb7-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762615579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762615579, "uuid": "491f26e7-5ad1-435d-9e3a-cac86193bc36", "comment": "Malware payload", "value": "41164f5e86d34b244ee21ae36d81ebef", "object_relation": "md5", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762615579, "uuid": "82d82e2f-1359-48cc-b0c4-fb316b658305", "comment": "Malware payload", "value": "a9a6a03bd6958710aeacc2a23860a7f7f0d09497fef85fe658ac5406734061f8", "object_relation": "sha256", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762615579, "uuid": "cf3f24cb-ef2b-4391-b7c4-762e7d327fbe", "comment": "Malware payload", "value": "2a8acde820f5205bb02969b8cecf90fcf16b1526", "object_relation": "sha1", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762615579, "uuid": "4f9824d3-2b0b-46d2-b042-8ba509747566", "comment": "Malware payload", "value": "37c884238475343a451397de2a7af03101c705fb607465c23ef262e60570bd42e847946f94ab9af5c8941d93b54c646f", "object_relation": "sha3-384", "Tag": [ { "name": "antivm", "colour": "#43D3B7", "exportable": true, "hide_tag": false }, { "name": "vscode", "colour": "#5FB957", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762615579, "uuid": "85cc64ff-aa80-4a48-b0c4-16783608f373", "value": "T12AB62326CC7617B7CE3E7233F4A9960777E1E784D8896C1CB67E43C52A8967013A0A4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762615579, "uuid": "d7ce0fd5-ad56-4201-be23-22ef112c37a8", "value": "196608:iDSdR077dd/jc9isA5w7bTYPBy9nx8cSSBz7sICLL3m7yh6Fldhg4CrtU7I:9AHdd/jc9A5wHTYp+XBTmrmcWpkuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762615579, "uuid": "f81434a1-91b1-4d70-b275-47cbe0cd23c9", "value": 11353822, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762615579, "uuid": "6cda55b3-b75d-44e0-92f9-97d0cc50f67a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762615579, "uuid": "0ae4a573-0136-4050-a3b1-1a5cd4da11f4", "value": "priskinski.theme-allhallowseve-remake-1.0.0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c637178d-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602479, "uuid": "dd4cf9da-d7a7-4361-acaf-a5cdd2cfcc5e", "comment": "Malware payload (Mirai)", "value": "960bfbb05af0d9575dce80d91befe9b1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602479, "uuid": "ed654090-24ca-4978-a974-d875df10d4ec", "comment": "Malware payload (Mirai)", "value": "a9ccb90912127927f07e6522fbb26884d037121b0929d93e28cd9bf2e1bcd4f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602479, "uuid": "285d5d34-7a55-4ea8-a063-19756fcb4568", "comment": "Malware payload (Mirai)", "value": "6f5c40ae386e26e5d0c43df58f0ed9735bb49fcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602479, "uuid": "8d36e282-fb67-4d1f-b6ed-8d1791bf398a", "comment": "Malware payload (Mirai)", "value": "58847170c76fe5899e6b7c72481f62a69cdcd169c2f7add9f690c87eab8c7890ff256feea4fdc8f7816d16044469d814", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602479, "uuid": "69c5982c-87a3-4328-9aaf-317f2890ae9b", "value": "T180533A51B8819613C5D4137BF6BE428D3B2523E8E2DF3217AD222F513BCA82F1D67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602479, "uuid": "4ef09041-7fcb-46eb-9ec0-9d0204ae9180", "value": "768:lP6aHMzAR6hM2uQBTPpdxnlILKU0vVONyRgGhd2G4NMiplImpcvwJZY10UPZvBqJ:0aHuAzgjjfUKU0NONyRgG+7XtJa10oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602479, "uuid": "f37832fd-0b22-4939-8d01-dac5659e764d", "value": 60760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602479, "uuid": "322d7387-af65-4f14-a007-9aa86c3788a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602479, "uuid": "a3de8933-e1fa-4bff-b326-86513a1e823b", "value": "uYtea.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b9e797d-bc95-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ngioweb)", "timestamp": 1762601039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601039, "uuid": "0891e55d-fb48-450e-9baa-08386b7d2a01", "comment": "Malware payload (Ngioweb)", "value": "504d3683310be2370696c41255134948", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601039, "uuid": "a65397b1-bf4e-49e6-bf0d-51533ace40a2", "comment": "Malware payload (Ngioweb)", "value": "a9e190994f75b7b2aea999b99674b344b064f4c87279729e76d3dbdd4d322e60", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601039, "uuid": "32260c0a-0037-4be2-9aa7-c33637130c24", "comment": "Malware payload (Ngioweb)", "value": "c8d2eef0c9cc9d8826c5faead15f4d595775ce11", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601039, "uuid": "becf364a-3226-48aa-9425-f2b184a6c083", "comment": "Malware payload (Ngioweb)", "value": "895dd0a2d58c8984cbcc1cd63f7b7b3ceaf7940377591f8cb51915e86578b68f107055d2371aa672e4257a5218ec03fe", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601039, "uuid": "5caaaba0-954e-4d1c-be95-a7f40f85c90c", "value": "T1DC01444DB73187A4C158D6223F70E932E62D8292D4F03B2852C95DB5C0EEE0CBB42E26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601039, "uuid": "d602497c-1cd2-4956-9012-1b6c656f9865", "value": "12:78CBkE55CvE55CQE55CqE55CXhE55CiE55C7bLE55C7kLE5b:pNa8aja5a6ahavAa4Ax", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762601039, "uuid": "b74b3758-5cae-443f-b9f9-b1d2ece8fc6f", "value": 784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762601039, "uuid": "cb68c004-4874-4c4e-990b-2a5aa1a37b58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601039, "uuid": "d9178433-42fd-43b2-b32e-6a386b0f5b41", "value": "dvr.tvt-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b43a26-bc6a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762582698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582698, "uuid": "86d09aed-0b97-4b82-a60c-aa1d3b5a3f07", "comment": "Malware payload (Mirai)", "value": "1accd57ead543235d1b991c145bf8427", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582698, "uuid": "8ea03e38-f7ef-45b9-b946-31f1bbc594f2", "comment": "Malware payload (Mirai)", "value": "a9f4d2a3f7a2d38fee9632b07f8ec56a1f3e67d6c6b3521b3c77d9522137733d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582698, "uuid": "f38e196c-ba98-4a66-8240-8ab5196bec34", "comment": "Malware payload (Mirai)", "value": "543ed0bf30e048b58401aa7fa7a8c564be924b8c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582698, "uuid": "5333a9aa-4f70-45f7-be74-ddf9d4262137", "comment": "Malware payload (Mirai)", "value": "29f6d44de1b0c1cf0ef367288436089afac25dcf9498a740aed7c9136872089227d23e11b60e687aa0690a4472eec755", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582698, "uuid": "2691c946-7a7c-4ddd-9730-c7d09e4f88b8", "value": "T10C8339C1FA8BC0F6D90788305066F63FDB72E8695071D7ADDF9AAE36DA335005217289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582698, "uuid": "8214d4c2-ad4c-4398-872c-69f0c82cf8ef", "value": "1536:3N8H7r9XOgZxEDU0uMFx0WN2ywxL5WN8QQO8dcebQ3zEu38K717Ef:3N+xZZCDU0pb0Woq2XO8jbgYu9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762582698, "uuid": "24b114fd-eb9c-46cc-89b2-d77ee6e8a12d", "value": 87316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762582698, "uuid": "a58d00fd-a596-44b6-ab76-6fa6874b9eaa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582698, "uuid": "31e2045c-cfaa-4ac4-acf5-e1f15722a379", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81fd6af-bcd1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762626990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762626990, "uuid": "dc607c51-1424-46cf-a687-e8c66ad72cd1", "comment": "Malware payload (Mirai)", "value": "cb2a839238eeaca347e577ccfff5f658", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762626990, "uuid": "d71efd87-d5c1-4fb8-8dae-c02b9122a9da", "comment": "Malware payload (Mirai)", "value": "aa2dc23179e65cdaa4557d9481025096df545e6b0cc9ffbcdd19868d1c679eca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762626990, "uuid": "db6c6f57-6477-4c35-b3fd-4613a3fb0bec", "comment": "Malware payload (Mirai)", "value": "6bae581d81c9ffca5ad87fe5418b423e195e9e2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762626990, "uuid": "3cd48e5a-ef80-4d41-a517-5965233e45ae", "comment": "Malware payload (Mirai)", "value": "63c4b2a3e41254bd838125aec1bac87eb2b11b2f344ede4e69a15801f3800e7642e561c04c80302902a124359e89e6cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762626990, "uuid": "af95a25c-79d5-4d6e-909d-1589828f7d45", "value": "T13123F1610041C5CAD85AC8BEE79407964E600FE458807F87BAEEDBE3D941965BEC3FE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762626990, "uuid": "b02e5d5f-2cd4-4ac1-bdc0-39ff71262b70", "value": "768:ESEv+43zx4hoGmxMzhPM/FdwDs1DSuUKN6mIcnPZTFgZjXAE78gJgGlzDpbuR1J+:ES5qzPCyGDs1euUKN6mznPngZjwEogVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762626990, "uuid": "3d9a806f-36d8-4863-8579-32186c0c024c", "value": 47344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762626990, "uuid": "cb8b7267-209d-4b4b-9520-d1071dea2e82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762626990, "uuid": "a520c04e-64b7-4d79-9bff-7f0b68a27845", "value": "executor.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbd8fca9-bc9c-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762604180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604180, "uuid": "589e48ee-8534-454f-8e7d-99a2e21e6acf", "comment": "Malware payload (Mirai)", "value": "2108dd58db2b950311f4d205c6eef671", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604180, "uuid": "9f46e12a-6639-4003-82e9-0d36541e1275", "comment": "Malware payload (Mirai)", "value": "aac44a8c65d18205020cdd93557880bbfb35f6df104abe241e70b6109ef44a11", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604180, "uuid": "d110f93d-eebe-46a3-b1e1-791e1ee43d17", "comment": "Malware payload (Mirai)", "value": "d4edac9a12bd45a4bda899878b8f85dc3d4a53dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604180, "uuid": "58badeae-f039-4209-935d-390a80c644da", "comment": "Malware payload (Mirai)", "value": "4c9bdd77803ea02636ab97fefd326fee57f995656bef451d018d34381aa2d0688902166fd49afb9bf146b20fa0b6b756", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604180, "uuid": "01645e78-0544-41ed-b44d-cad0466b75a0", "value": "T180736CC6F6C7C8F6EC130A3111767B2759B3E13E32A5CB83C3A9E636D812980E11625D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604180, "uuid": "12d85899-73ed-43f3-a62b-6582076e50ec", "value": "1536:zD+FnUYl4dUrbzmN2op8NW2Mzd+REYaGL3SGQAlBn:zD+Fh4dAdoONVMBEEADQ2Bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762604180, "uuid": "15cb4063-7722-4697-af33-a8d4407184b4", "value": 79796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762604180, "uuid": "f96d164b-27a2-4fb5-a09b-1a71a6ef82c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604180, "uuid": "0d2a9789-4598-4947-88db-85c4fc6054f4", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e97faba-bc77-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588105, "uuid": "8d63f910-a374-45ef-ab8b-7d50375e3586", "comment": "Malware payload", "value": "e9a3b5e26680290e91d4887486ed7dde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588105, "uuid": "877bcde1-b4be-49d0-a03d-7b43a3a3f1cf", "comment": "Malware payload", "value": "abca665537d1d63e8ad5b8a675667ce6c8f21ce02099bf4c7586a32e3e7b646c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588105, "uuid": "dd8ddeff-d351-4908-8dc0-e440f079a923", "comment": "Malware payload", "value": "b04c244b22496d52602fc0f1a2df867d940d9e5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588105, "uuid": "f5538d82-e5c5-4128-895e-999b0531ae50", "comment": "Malware payload", "value": "38f8d9cfcaf9066013c867074ea2c316ab7f93a68719c026744122175c57b0e9c1cac7b95e75d531162d18596109ce91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588105, "uuid": "d3ede9b4-6a2b-4fcd-8c87-e5108d087347", "value": "T1712723E0EF959423F27A3BB769DBE7D1C02E6DBAB150810BB18C76190324616BE4713D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588105, "uuid": "aab97fcb-b69d-47e0-9a34-501cdd1b5d66", "value": "490691c1e02a66f93031cea140117d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588105, "uuid": "47c8c989-bae1-46a4-8a7d-588ccf566243", "value": "393216:63C+dO/Vg/CizjMTSqkF81kFh91Tg2dj4ZeJck:GTdO+/VjMTSqki1W1ThjEez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588105, "uuid": "734e9078-b24b-4cd6-baec-225760dc1397", "value": 20966419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588105, "uuid": "29d74a15-a12c-42c7-bc1d-c9e4f5de2898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588105, "uuid": "4c9a608d-2725-45b1-9976-72b75593ae48", "value": "e9a3b5e26680290e91d4887486ed7dde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84a9171-bc84-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762593919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593919, "uuid": "a5ca1b0a-cec1-4468-8359-e6ac8d06f313", "comment": "Malware payload (Mirai)", "value": "a3dbab2a4c388be8f87d696c5153a62d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593919, "uuid": "17c2abce-b245-4151-91d3-9a06236fdfb4", "comment": "Malware payload (Mirai)", "value": "ac6ec8438fcbd2767d540a937382d82c744c1e0d8e6ef1e06e40764c3b70a15c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593919, "uuid": "c8cb9f48-9e49-4336-8719-d5dafe70989c", "comment": "Malware payload (Mirai)", "value": "f86cf7d11a939d681c33bbd5d1c054401e862889", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593919, "uuid": "2d8485c4-1488-4d92-88f5-9ad529086482", "comment": "Malware payload (Mirai)", "value": "3a3b5d6e5eff06920991fb0501c683b8071a009e5d25f1c1408f989c296b32d49a7f696bf4b34c9c168307e49025e950", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593919, "uuid": "b12389da-5229-4cdd-a02c-037742bd632a", "value": "T1D5937C22B9791A3BC4E4947752F34332F2F6478A20B88B1E7DB10E8EBF1565036476B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593919, "uuid": "ff4ac787-2670-4c50-b779-c33292c9f76b", "value": "1536:olcz3RpJLpvSXrmR1Boe97z3ktdxYm5U8UZ5RtF2L:OKfb/UzxYOt/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762593919, "uuid": "e7cf45d6-c54d-4655-98ba-9c9c1f3d356d", "value": 91640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762593919, "uuid": "609ef964-d6cb-438b-b540-a597b2c8be0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593919, "uuid": "3b2d429a-c8dc-41d2-a9e3-7c0d39930a7f", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a989af9-bca0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762605627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605627, "uuid": "a572994a-bb38-48f9-907a-34d7d891a19e", "comment": "Malware payload (Mirai)", "value": "b3f562dd9c22fe88888e1dc55833dec3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605627, "uuid": "a2ed9eed-ffe2-4128-bc7d-b515b44710bc", "comment": "Malware payload (Mirai)", "value": "ac79c87fd396a2a616d83e330ddb6255427f39e1c11282cae4b7f5d041b43b34", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605627, "uuid": "35d20d1c-3e90-4881-8d46-65b10d36f66d", "comment": "Malware payload (Mirai)", "value": "d646dbf29b092259e6c4a135365e6ae55f727481", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605627, "uuid": "6c2cb2f9-2989-45c7-bb03-6233112f737c", "comment": "Malware payload (Mirai)", "value": "f638c736f962f9e41df84b0f3818b59602f564b7d589034f6f18635abc97710bd1e822ee22db8626047379d9d424f2b9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605627, "uuid": "f03fa3dd-7ea1-496c-9bf5-00fcd2e48c7d", "value": "T110043B46DAC14A13C4D2277EB69F524A333397A4D3D733069929AFB43B836AD0F63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605627, "uuid": "8a7dfbfd-f941-4bbc-a3a1-dd60b45394cc", "value": "3072:cRpLCV029Z+D8ma68gjhVgTkFYppwnCtoAUSY7382xM/9xYPp3/uYQ:cRgWVgma68gjhVekq3uCaALY738sM/9B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762605627, "uuid": "ff1686cc-5a39-4c8d-97f0-dbb0f1a07ecd", "value": 189436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762605627, "uuid": "aef74421-7813-4ca9-97fb-02ae87f2c400", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605627, "uuid": "8da7ad57-cee2-49fe-99e5-02cd3f7276d6", "value": "executor.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "921f1472-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620430, "uuid": "6d5ddd1f-b960-424c-8bbb-d9209bce5bb3", "comment": "Malware payload", "value": "4f628278590c0f18b89a2706826d8a61", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620430, "uuid": "32ecd865-c7f9-4b0e-b307-9ce3ad6cdd61", "comment": "Malware payload", "value": "ac81821876a286971f7672aab9ff662ecdb9df9daa4caaec21e2694dd50b5094", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620430, "uuid": "42c71023-dfbf-45bb-90e2-419267ad5d1a", "comment": "Malware payload", "value": "088697af2f052fe3d5a632fcaec90d91524f0a79", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620430, "uuid": "085b66c5-bd3c-48db-b66a-284ffa975cee", "comment": "Malware payload", "value": "4061bc6529434da0eae1da2f4bb0e946d87577e20e78b07f3f7bb309732d7004f43b73f92b198ece63c6d021e676d3ca", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620430, "uuid": "8b29627c-9bd7-49dd-91db-c1f1dcb43b13", "value": "T1B534C5EF345098D726993D76725229CC14A9FD4AFE281E30F17370E86AD0ED4B7A618C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620430, "uuid": "27453196-bd25-467a-a092-83c89e36f32a", "value": "6144:JwrnB7VomZ+pBTkfhvTSuykagzxIZ9C4RV1ty10DYaDKKX5z3x6WPo9arOIVd85B:yfFTLDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620430, "uuid": "2206704f-81f6-444b-ae78-1d510caca4d6", "value": 232068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620430, "uuid": "ac92c888-f866-425b-84d1-f58f69cbbaae", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620430, "uuid": "a8ca8ac1-51a3-40b7-a9fd-7325158847be", "value": "Copy Of Invoice (INV23124292).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e5346a-bca3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762606933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606933, "uuid": "0dd382d8-410b-471b-8ded-0b9c60f70e25", "comment": "Malware payload (Mirai)", "value": "8b10110cca535ddfa73a71d00b9ba916", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606933, "uuid": "71e80ede-b44f-4bbc-bc83-ebe4f67666dd", "comment": "Malware payload (Mirai)", "value": "ad442fc797c5274f9af95a45583ba9e935abd25d6db296fa70f1e7704ccdd715", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606933, "uuid": "8ab1a6c8-63b9-4ed8-9a3a-634eda9c151d", "comment": "Malware payload (Mirai)", "value": "ecf5bbace644e14e155ac17805aedfc82c2dbabf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606933, "uuid": "71afd227-044f-43af-a1d4-54ef992c857b", "comment": "Malware payload (Mirai)", "value": "2ce85030288cd87bc05825a91c1b661af3569b99154bac49802c0b3b743339634c12c2a289fecc29d0e9dd2ee063bbbf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606933, "uuid": "e4649a40-0548-49e0-bac1-8deb31e0fbee", "value": "T14A13F1DDF5A53A22DC2C4EB921F82B395E466670927E738443D28CCCA47D636B41D27C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606933, "uuid": "5e3e9379-1973-4841-ac7a-37e958f378b8", "value": "768:9DqpK++XXJsx1DymQcA509ZE7PpH4HfSK61VeWuxKpGWx:9DiK+U+J0cN9ZYPBwSRe+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606933, "uuid": "37ec7ca5-9a24-4158-bfd7-61a0793523c2", "value": 45188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606933, "uuid": "edfee177-193f-4bcf-93d0-ab86b9f905ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606933, "uuid": "a220e1db-c285-462f-ba10-a193c2721b34", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "103a0ae6-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588859, "uuid": "675b0172-4266-4296-a60b-b9822310e24e", "comment": "Malware payload", "value": "5873365d1a7a190fe233c8a39105f5d0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588859, "uuid": "7597857d-4d7d-458f-9b80-177b6bca7372", "comment": "Malware payload", "value": "ada41241a0717365c8728babcc6eb7e4bd7c64e877d7fddbd1fe5e9ba8185cd5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588859, "uuid": "5da68a64-31c2-4a20-a295-c942f4ee7119", "comment": "Malware payload", "value": "7ead2b83dd0f1b81821204a6d318fd1c929e7b2a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588859, "uuid": "97a7cfc0-41b0-411a-b998-1c8c3024cbdd", "comment": "Malware payload", "value": "3938fbb8e5334ebeac952218ef8a91d1a65c43377724414e69bc4d7b797b15f9054b624590d1ad3fbf55191b3ae28c2d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588859, "uuid": "146c456d-3b71-41b5-8b16-c863058a99ac", "value": "T1FA71B901776A87877D57A1A287490C3270F7CDB39B97FA16770C21CA4FE28A760E84D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588859, "uuid": "e413b10a-d2e4-4a06-9742-1f9509c336da", "value": "96:5iOVfEVnsZwrmbJv33k7a2CzCzCzCzCzCzCzCZ6:5iOVfEVn7rmbJv3U7a5uuuuuuuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588859, "uuid": "df9f22b0-84d4-4a94-954d-e3b0d0a8e165", "value": 3543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588859, "uuid": "3244ae38-1d7a-43ca-a73b-429012c54018", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588859, "uuid": "962bb39e-1530-44fd-bb99-4a9237fe93ae", "value": "invoice88080.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d57b843-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762588881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588881, "uuid": "c0e364cb-8de6-4e08-92b6-93c97ba85dc0", "comment": "Malware payload (Formbook)", "value": "6ecad2edce0c682b698b76c7749bcfc8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588881, "uuid": "23eb99d0-aeda-4532-931a-49b71ea0c2fa", "comment": "Malware payload (Formbook)", "value": "af5bcafc99a83d82f680ba2653e731063936131fe137e40c4ef7b73e0c15177e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588881, "uuid": "6024c9b9-9803-4995-8f93-aa516ec0184d", "comment": "Malware payload (Formbook)", "value": "805c12b04b316871abd190c813f9802a90ab7ac2", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588881, "uuid": "0f292d62-c4ed-4d73-b875-ef69d06f677d", "comment": "Malware payload (Formbook)", "value": "b6892de95841084c16b138b70fb38bfb8c693dd08d85d039a0e938aa55d27c86298b6d22feadcf8768ab8ea8df3aa09c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588881, "uuid": "678cb1db-bb92-4d12-b72f-5b23604970c8", "value": "T18056129407D4A3489B1385369D903BAE933A5A0D661A8F5EF23165CDCF30D6FA331C69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588881, "uuid": "f9189136-4e45-47e4-98ea-cbc679668f51", "value": "48:P88888888888888888888888888888888888888888888888888888888888888I:iUJnnq+fA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588881, "uuid": "7a9d513b-7fed-4894-bbdc-da9bb94cb63b", "value": 6321572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588881, "uuid": "3bf0df8a-1f2d-45a6-9d10-d8cef72782e0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588881, "uuid": "1f9a8b5d-8ae3-442c-9820-90ca2b78085f", "value": "CIMB-Transfer_Advice-2025110070857173.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57009db-bcb0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762612759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762612759, "uuid": "1fd62fdd-1219-4ea2-aaa2-883278ae90a6", "comment": "Malware payload (Mirai)", "value": "fa2aabef893e27d8d0066356e49b16dc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762612759, "uuid": "c6a253c9-30a6-4b86-8a7e-eebf47056145", "comment": "Malware payload (Mirai)", "value": "afa78ad97b923ad40b2b8f8fddf66561ffd6d9f3cb867a1dfce3fa9ee745d084", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762612759, "uuid": "0474f391-4ac4-469c-9e21-6ba099d2592c", "comment": "Malware payload (Mirai)", "value": "d970a8ba245d7feefa6143f282416b7024c504d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762612759, "uuid": "9ee8d61d-6cd5-40d8-a57d-3a1d434c4242", "comment": "Malware payload (Mirai)", "value": "b5a95ac7ce0814d11a3a539269b2c0a875e57cb60286c5e30bc81cfb4db20dec2e1f35c9da9237ab0d604175c9419c8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762612759, "uuid": "7f52e82b-ca85-4b2a-8e5f-5e068fd8938d", "value": "T157C36CD5FA43D4F6DD5305B12037BB378F32D07A1125EA83E3B959229CB1A01D61ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762612759, "uuid": "ec23dfff-51f8-43c6-a481-941e41798011", "value": "3072:7W2WA4KfsQDNSHjiz2FBOeF5Bts4ceGM5UQ30hAB1Ev:Zr4KEKcHmz2F4eMeOQ3Gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762612759, "uuid": "315a9880-aff2-4c4a-8458-e224c68c7a0d", "value": 123208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762612759, "uuid": "4a975b76-cacd-4552-9213-f2a01ec8fc20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762612759, "uuid": "0df02860-cc1c-4a07-b698-26413014cbd3", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7e8100-bc6f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762584885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584885, "uuid": "d765c8ab-8602-4f11-88aa-9f9b29c3c21d", "comment": "Malware payload (Mirai)", "value": "95b7b92d344d672785f67cbd89cacf49", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584885, "uuid": "48d2e789-2127-4916-b8ec-d9d9a016c0d0", "comment": "Malware payload (Mirai)", "value": "b0b87caabe516c1def1f7b5b9a5730f8f7f28d4faa21be60fcc9a42855cc3167", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584885, "uuid": "094716c1-8ccc-4bf5-9563-f85af2decacc", "comment": "Malware payload (Mirai)", "value": "8c70737c4541349bc15b4bb4a09238b3985537cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762584885, "uuid": "68bf2ba7-9273-4587-890a-ba012702c217", "comment": "Malware payload (Mirai)", "value": "9d75cee662fdacc48c9ae97b83fa90c3f18d0b21838f8d1ef1ac5d8b183e7424cfcb205c34f1a9280f0b3e20153e4208", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584885, "uuid": "a9e2b62d-d826-4b94-a052-c8759e7dc09f", "value": "T1DCF2E051C22A8EBFF2DF6CA7DA9E135137A11F3935A3EA2151445635AE2805F1003EBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584885, "uuid": "9443839b-79e7-49fa-b3a7-48ad96c7e515", "value": "768:JFCYJNcdQc2t2pT7OMUlvec3fO3Y3Gk94uVcqgw0E0tLyT:jCYJNcd+2FcOoWk94u+qgw0VuT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762584885, "uuid": "0f3bc678-9c89-4b62-a3df-65a9e329bbe3", "value": 35852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762584885, "uuid": "d77718aa-ef90-4f46-becd-c400719af4a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762584885, "uuid": "f12bdee3-4d9f-4e5b-90a1-2a05d8d97666", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dee57c2-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620746, "uuid": "bc66f99b-9d99-4c73-843d-480de8789eaf", "comment": "Malware payload", "value": "4f5ca6174014648df72eb344a62836e4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620746, "uuid": "dd4f1b48-7b3e-40bd-abb3-480fd8b02b7d", "comment": "Malware payload", "value": "b1f64cc2d1316a6e83b9ec78c5475c719a0261b48fa0d73fdb539bd01637fe2f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620746, "uuid": "824c366e-0dd2-41e9-8208-2ff5857faa41", "comment": "Malware payload", "value": "e39dc0249821c70f0708c8adbc3e085b70b8b5fb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620746, "uuid": "c357d981-6d04-409d-b701-d4d585918e94", "comment": "Malware payload", "value": "879e1819b825bfa2ac4581ffe68bb22fb7b0c64644821206d7ac02c57722223fad88c2375c8ce89b76131a5db20f3047", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620746, "uuid": "7058458e-4f66-41c6-b212-377599febd4d", "value": "T18762F5C87FD6B2B50773A4B71C1BB05AF16B6C40A48CC191E23497A9F964718E4F2778", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620746, "uuid": "94974eea-ac42-4808-9e23-b79f1791f559", "value": "192:P1x1jEC1/oAKJjdg0CgMlwlD+al45uLJl80PKyDT7hxFZZ/+RO:P13AKJQjSNx2+aS5uLJl80PRxXZf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620746, "uuid": "b7203abf-7a07-4660-a6f7-2f8dd73097c4", "value": 15347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620746, "uuid": "6c07aefc-e700-4b9c-b74d-6acf91079d7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620746, "uuid": "feb7ad4c-8b90-453d-ad3a-6dfee357bc08", "value": "RFQ-Supply & Installation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4535b50e-bca6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762608276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608276, "uuid": "c0dcbb76-a8cd-4ce9-a884-9b85d3323639", "comment": "Malware payload", "value": "60a09cbdc6faedb88dbc284fdf42e4cb", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608276, "uuid": "442c6799-e046-4fe5-83d2-15ff588d9668", "comment": "Malware payload", "value": "b2b57e825a973f5eb8fff37c60616392422ceaaf3f9cfc97337a3362a930f78f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608276, "uuid": "65f89291-a02d-4ce3-a517-67f7be2e5425", "comment": "Malware payload", "value": "83ed02fb3e1b4d2772f938e4d50308d584acf17e", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608276, "uuid": "b8f65e19-081c-41b9-a753-eb19ce7b242d", "comment": "Malware payload", "value": "03c38bfd958125fdcc758283d109b9527b072733c26ba6faf163365d2cbee620a46589465d801643f49f142ecacc0ac0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608276, "uuid": "1b0c3644-3c9b-4f87-bbf8-674beada471d", "value": "T10AD6334892B019ABEDF2427D98B2C119E33079DE1F32E54BABE842533F535E15E34B91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608276, "uuid": "4fb1edff-4e87-418e-9af9-95fc00629589", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608276, "uuid": "3c967b2e-efee-4937-9067-b4a4ca94ff25", "value": "393216:jWSONo/ECcoAXMCHWUjMVg74wFKwjPNBGZ30aRUwEavq:jWSO3XMb8kDwFKwjPNBGZxUwEavq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608276, "uuid": "28ea725a-ff41-45fb-9103-dd7b52a21cce", "value": 13344101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608276, "uuid": "44425e41-67b6-4405-8f26-f6df34974d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608276, "uuid": "6b7c74c2-79a5-4e93-bb3b-a454e407c53d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "324a37fb-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602231, "uuid": "851f972c-e427-4e45-ab50-f6b16b076ae4", "comment": "Malware payload (Mirai)", "value": "2e71e9bba56277ec5a1af600c070c3e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602231, "uuid": "1fbca2d5-503a-433d-b64f-eb388b0ea548", "comment": "Malware payload (Mirai)", "value": "b35fb9a1fbea2469488f8b7a61c1d97bd5951019d4cffe09fca6f723a5ba4e3b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602231, "uuid": "e336f9de-a442-4de3-aa98-792cc372feff", "comment": "Malware payload (Mirai)", "value": "e4893add14f9190082be4cfd8798f9099b8df577", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602231, "uuid": "381e2700-d31a-4f29-88af-c1c0c2a4a8ef", "comment": "Malware payload (Mirai)", "value": "c88f47441edccb7d15415920ec90fcad04bd304387c853c532d6b7671847fe8bca356ce476c6fa002a83565ebbc36eb9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602231, "uuid": "96fff73d-5fc2-431f-afe8-8a722d6d13a8", "value": "T14923F15AD3F1237CD42D32386C7E25876C80F91A629409233EE4249DB8E9BE1AB1DC13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602231, "uuid": "1b001c64-a097-48a0-81ba-c679c7a5ccda", "value": "768:CessG0aMqhczBPPoy3YWX/RJOHXkRMscGQaUdhBMfnj2+7onbcuyD7UoQRjC:CessLD556HXbayar2Xnouy8oye", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602231, "uuid": "27949066-60aa-4aa9-9bd0-1d52f5cc96a5", "value": 46724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602231, "uuid": "111e2523-3df7-4718-a8a7-49fdc7f09f67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602231, "uuid": "49251f3d-ed0b-4c61-bbd6-179647ce3d3a", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3dbd5e-bcba-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762616956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616956, "uuid": "535af25e-ee9d-4921-94ad-b7fc42f0ac72", "comment": "Malware payload (Mirai)", "value": "631085fec648b00d5c3804edd01ff1de", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616956, "uuid": "51f5348b-4cdf-4fc8-8df4-d174301f23c2", "comment": "Malware payload (Mirai)", "value": "b3ee5957fdb7c2d697d40c76ee65bc86afe322d0c4917bff11139a4fd6059248", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616956, "uuid": "dde68dc0-9bf3-4768-a2db-93564c56a518", "comment": "Malware payload (Mirai)", "value": "3596522c390c7d475a8658a30772fa7106b45ba3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616956, "uuid": "4d678022-dfbb-4ada-95cd-2fedf3c065c9", "comment": "Malware payload (Mirai)", "value": "2c5a0aaf0c387f16417a227f76184a3e754393600ef4f390c64c23f8b0eef4955655142cafb10c947ca7bfea74129d34", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616956, "uuid": "a76fc52d-0cce-4282-a928-a7ee3ed445d7", "value": "T1E2E22B13A092A4FCD88DC279436BB539D933B43D1272B09977D4FE22AE9EE121E3C554", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616956, "uuid": "674def9e-8cca-40ca-bc3c-a592a5d02b99", "value": "384:LdMbjLSkQkLBoIsXbxBwZQMOc4404wqfrfNhcjUWUCXz+SjLMshbQ0C2ENSifHsB:L6aRxCcUwLrfIshbzCVN9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616956, "uuid": "1cd44bba-9ae2-44f8-b0d3-70e2453e9333", "value": 33760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616956, "uuid": "3a7d52fc-b884-4067-b0f7-d7610c51a058", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616956, "uuid": "549ec92d-35c5-4f2c-b35a-be59055e89e2", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32fb7093-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602232, "uuid": "43e42c82-8fce-402e-b9e1-b4ac2d0fc87e", "comment": "Malware payload (Mirai)", "value": "d6770fe64bf484aefc174149c9441009", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602232, "uuid": "6b16e768-eda4-4e3b-a725-9969055d780a", "comment": "Malware payload (Mirai)", "value": "b49f839a04fbada7d00e1ada4248c7fa94ef60763a9a01a2875b53620ec8e43c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602232, "uuid": "afa29924-47f5-453f-99d5-283224aea7e6", "comment": "Malware payload (Mirai)", "value": "349e610d2ca75a4beffc6f99e3c8051a387da8fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602232, "uuid": "281dd72b-cb0b-4a99-8f66-fa32316dcf65", "comment": "Malware payload (Mirai)", "value": "e735cc4d68ebda9d4e664da9d537a0d883fb5f1459f749f1132ce1f0808125de5c426d5b77b3ba3dd97b719634036b43", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602232, "uuid": "c3e464be-44a0-4d56-af68-20c861daa4c9", "value": "T1C8042945EA404B13C0D627B9F6DF42453333AB9497EB73069528AFB43F8679E4F22A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602232, "uuid": "4fdfad9b-67bc-4a5a-a248-8aea1593ef34", "value": "3072:OLe6vhWZQIvuCeeuaMuTuRez43IVILAZQy38YhTfYo+M/RgDlplLn:ee6vhtIv1ruaMuTuReErLA738+x+M/Ro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602232, "uuid": "827bc56e-e9e0-4d9e-a14d-d6b4976e05a2", "value": 181474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602232, "uuid": "34bc8565-ea92-4eaf-9f00-c64568a87115", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602232, "uuid": "f9b86321-acc5-431b-9043-420aa71cd66a", "value": "main_arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3afb1639-bcb3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762613842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613842, "uuid": "6b6bba85-faa9-4be3-b313-bc0020e1f65a", "comment": "Malware payload", "value": "420cb142ffc5ac984eeb491b4229f1b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "softhub-live", "colour": "#38B7BB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613842, "uuid": "3f27b793-f8b2-4cb4-8c9f-8d81ba0ec9e9", "comment": "Malware payload", "value": "b4decfd080dafb932296a4eca4e0d8bea53ffab996e162204c2588cc39f8a4a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "softhub-live", "colour": "#38B7BB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613842, "uuid": "5e29feb7-6b6f-424f-a044-96b726474ef2", "comment": "Malware payload", "value": "51e27637bde7fcc9c22ca290cda41fc8cec82521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "softhub-live", "colour": "#38B7BB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613842, "uuid": "37aa48b4-0ec3-4ba8-9678-73885779d6a1", "comment": "Malware payload", "value": "8c38cc9d2b5cc136bf9dfb18cdeca806877e9be5bda524ca8ff8d092611bc5e70e68241ee954b384fb73b7bb159fc379", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false }, { "name": "softhub-live", "colour": "#38B7BB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613842, "uuid": "5394408b-68c7-449b-802c-df798dffdf40", "value": "T10A188C4263EA05D5E9FB9A3489E65213D633BC063F3086DF324C176A2F736E09976721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613842, "uuid": "22b90e9d-66f5-40cc-bc95-439c4e0082a8", "value": "b2a86e8b314318c5db2758c4f1f28af9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613842, "uuid": "e3ea224c-054d-4b34-9199-0d63679cd25c", "value": "786432:AL+hSlolv5GrGaFcWAdQN45ctgPdBsUrD:ACQo15GtL4Vft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762613842, "uuid": "c3bc1bae-07ae-4805-819f-264877829624", "value": 85599583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762613842, "uuid": "125dc23a-373a-48a6-b02c-24971eaaed02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613842, "uuid": "7795ab05-3305-407c-8def-96b7d04b28ff", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3ae25a-bc93-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762600347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600347, "uuid": "38252e2d-7808-4d0c-af1a-681d97e8f572", "comment": "Malware payload (Mirai)", "value": "eebcb6b79c813a7903666eb5118fb17c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600347, "uuid": "ebe3ba40-9c62-4ba3-a439-fda1646de322", "comment": "Malware payload (Mirai)", "value": "b6775f7b8c3bfd4f8ae71b3a10f7a12a5e13469100b987dafa8c06c9d3997542", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600347, "uuid": "9faff2a7-78d1-4f2b-8d3d-46ef43ac8577", "comment": "Malware payload (Mirai)", "value": "4ca59c40266c77bf4c313f81c391781a29d982ad", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600347, "uuid": "5f93535e-a611-44f9-84d9-e1a577c27688", "comment": "Malware payload (Mirai)", "value": "f953e7e7b84432650c9035f06cec036828ffe9d8393d1d6cb1ac5f25153640fba6c104aa30312d74473d8d1d1b05e99c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600347, "uuid": "b3d37ced-4fa6-42e9-be04-0a688465bca3", "value": "T1738339C1FE8BC1F5E91B88304076F23FCA32E96950B2875DDF5AAF36DA335415212299", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600347, "uuid": "4ff440ae-ddfe-4780-9b85-edb0b4b726de", "value": "1536:KKz1LffGPJL/Hch9qkEyQbW4cjJTaoLEAQkfsaSO:KKRGJjHBkEMRjJTaYE2SO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762600347, "uuid": "9b6f4159-8b96-4909-b9b9-b6426f3748e4", "value": 83220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762600347, "uuid": "a648d35c-86ba-4ec4-b686-8da60c75ed1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600347, "uuid": "8299d0e6-63c0-40f4-98d7-d67c72421be9", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0eb4db-bcb9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762616364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616364, "uuid": "74ffd2ad-a7e8-429b-bf3a-fdd28a4f8646", "comment": "Malware payload (Rhadamanthys)", "value": "736ea070276034fe8449e7b61f6de37e", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616364, "uuid": "4935afa6-e47f-40e5-b3bc-c2c99685fd13", "comment": "Malware payload (Rhadamanthys)", "value": "b69ac444131e79b7ef5f81a986ba683b7da2707da81da4969106ebf2e12daa88", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616364, "uuid": "46f36258-2b84-4d91-9794-d7c86a686239", "comment": "Malware payload (Rhadamanthys)", "value": "6992244b2632f17fc6b47664d27a7e63cac68cbc", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616364, "uuid": "97bc2d2a-1e93-42e0-a041-da254ff9deb1", "comment": "Malware payload (Rhadamanthys)", "value": "01165d6a2fbea179be6ce7e0ef80325cfc6c44a9b6da19b994ae0b9ee40caf4c9f51a895071c696fa10bb2bdf8a51aa7", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616364, "uuid": "85d9ec4f-ca44-44dc-a589-f02775b2ee7f", "value": "T14D369D03384459E1C9EAE1348A618941B670784A0F7337D3AF91BABA1F3F7CC5A3575A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616364, "uuid": "0eca0004-d7a7-415a-85b5-a822c0d2bac8", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616364, "uuid": "2f44da25-a519-4354-892f-a145529170d2", "value": "49152:iVrIhK1tqT34eZHNVfgEmSwDM2SgEEkw2Z0D12iJT+x3OaDGap/9zommqmIOvP2g:6Ipbvtl1/wggkfHiJT+xd6aj6qMvOeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616364, "uuid": "5023b9bc-80f0-4201-8a1b-facc094d8e7f", "value": 5308928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616364, "uuid": "84e43592-e8d0-4d26-a9b6-9383a8128c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616364, "uuid": "fba4e5b9-77e8-446d-8bdb-8388dca179fe", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26c28c9b-bc6a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762582455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582455, "uuid": "3fcb00b6-5383-4017-aa9f-a85bb2734af8", "comment": "Malware payload (Mirai)", "value": "5bc18078ddb32515299f95bf7b6ac964", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582455, "uuid": "4541ac2f-c7bf-443d-b588-725905ef1afb", "comment": "Malware payload (Mirai)", "value": "b71a219cdec9536ea0f7534fd05d674096d7926b18a40549e6d287dc8667b438", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582455, "uuid": "02b343bd-1997-4e71-b02c-bde1054de059", "comment": "Malware payload (Mirai)", "value": "3803532306b4d252977a805eca1275b15f505107", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582455, "uuid": "1f0d9c39-6ba7-452c-bece-1e0154ff9ce8", "comment": "Malware payload (Mirai)", "value": "7a76a7cdd40fe90caea4ebc09995eeeeecc7bd6f74ffd17c7c5eb148f23264eb0cd533e189ab5139fa33d7b49bae96c2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582455, "uuid": "fc58b4ca-893f-4451-9e85-7f86e2041971", "value": "T17413F11EF98FEAE3AD60313ADC981917FE15A7E4C07D64475A142A79B7D218332F8043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582455, "uuid": "f4221006-ff77-48d6-9a9a-d65bba08a924", "value": "768:q+rgw1DVHxLIWNclmLQkPtVmKKoq4c2SWpvAF0Yd0X6AovCbtqBQN0l99q3UELU:q+rpVHVnGlmLftVmKKorSWpvAF0YGXul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762582455, "uuid": "55ddd297-b2ea-40dd-97cb-ceb571ed44a1", "value": 44836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762582455, "uuid": "87ea64c4-8677-4d93-9a56-d298da21ca8b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582455, "uuid": "1716aa91-9d93-4d70-a9a6-546aba7e7e88", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46518608-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602264, "uuid": "79e604a8-65c6-4418-a65a-2405a71e46f9", "comment": "Malware payload (Mirai)", "value": "ab7b0bdda315415b3227fb39f216771c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602264, "uuid": "417ee192-9a84-49d5-a7e4-f3cc59d551b5", "comment": "Malware payload (Mirai)", "value": "b8191973af562bb558e54fb4a28aaded48dd8ee2fc7e2e6a5d7748ebd6a6ec8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602264, "uuid": "de2b4436-2434-419d-a25f-a4629ca0b1b7", "comment": "Malware payload (Mirai)", "value": "5fe4d4d89b8f7d68860dd1b38ebe121ad11c8159", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602264, "uuid": "7e47f9b1-45f9-4001-90f0-0c939cb8af77", "comment": "Malware payload (Mirai)", "value": "9c6d8e454208ec22bf289296a3a53ae1b61d1f7a5b29b872003e900eca6c9162a253207482643934666e7af2a03c8d63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602264, "uuid": "a087129a-d015-4d6c-a71e-2bb1e40145c4", "value": "T13D243A42EA408F13C0D717BAF6DF4245333397A593E7B306A924ABB43F8679E4E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602264, "uuid": "87af7000-ddd9-4211-9a2b-f1105719d9c1", "value": "6144:tvERpNp86wShWU3NmaDTsOZWuv7wKeaxrkQ9M/RBGnwmH2WBLB5n:iRpNp86Z3NmaDTsOZWwMoyQG/enwmH1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602264, "uuid": "15335e52-798d-42dc-bf14-f5771bbe0b6e", "value": 225035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602264, "uuid": "85186a76-64f8-477d-b90e-e8ef200b7e98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602264, "uuid": "1adb5743-36b6-4149-baf9-45f3db0ab6a6", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a727a79-bc9b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762603694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603694, "uuid": "cfe745b8-5a36-49c0-9433-863e2a8715dc", "comment": "Malware payload (Mirai)", "value": "edab38f1a20851dd18194528414fecae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603694, "uuid": "7a869574-163b-4085-ab0a-09fb35c488b7", "comment": "Malware payload (Mirai)", "value": "b81f142e47c3706ff91a9f570b4f513dfe99b053a5fd0235efe20b7dbb93cc94", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603694, "uuid": "4a1a1a84-6ba8-45ae-b7fe-e6307d0f2732", "comment": "Malware payload (Mirai)", "value": "3544c0dc602d611f7fefc771be0cda4a0290a883", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603694, "uuid": "80d856eb-9ec5-4a2f-a916-193a611d3c06", "comment": "Malware payload (Mirai)", "value": "03dc7d6861694a767327c5e06b165d2d8ca0faa730563c4d4f4597764612160fa4a6945a3fa38c70659d5d7e348d2e86", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603694, "uuid": "f5ed192d-ad91-4389-a4a0-92d8520597fe", "value": "T147B3AEDBF7072191C86247F007C74BDE3E6322119E6BA8E76C0E6A7A0A790DF5916391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603694, "uuid": "c1520db9-d5c4-4fc5-adbc-d181dea20e8b", "value": "1536:BF38syuPgwHMD7qEywla4Wq0z0zkppYjjHBZibxZJ8EkgE/LWk:T38syV0MfywlBtMhihZiqbgEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762603694, "uuid": "0c2f1896-44c7-43cf-910f-3edb813ce156", "value": 116160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762603694, "uuid": "27b733d1-c4ba-43c7-8f39-3d0e25ec585c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603694, "uuid": "04c18436-1ea8-4219-872e-82efaaf3c8d3", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6d9add-bc78-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ngioweb)", "timestamp": 1762588475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588475, "uuid": "a1a3c427-cac2-49f9-b326-8fe55c5ba92e", "comment": "Malware payload (Ngioweb)", "value": "eb686f37e40a329e6dc441a3868f0b9b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588475, "uuid": "8b1f5d97-7c30-4970-96e7-9e8350574d67", "comment": "Malware payload (Ngioweb)", "value": "b83ec68f00187d77fa8bf6d792954470116c098847afd77025f4d1b0eb765125", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588475, "uuid": "c7df271e-fe6c-417d-86e9-c00a5b3e291c", "comment": "Malware payload (Ngioweb)", "value": "61d5c837edab0ce64353287e64914cd92998983f", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588475, "uuid": "c3e6ec43-53fa-4ce6-a313-d0f116965493", "comment": "Malware payload (Ngioweb)", "value": "499930061772d81fc41cd604d6d0154212d7ff3193e1cdd440601351ed9e0dc88ce9d0aee434de1c8afc0ac14e3236a7", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588475, "uuid": "1dbdd505-994b-42e4-91b5-c48a54e1bedf", "value": "T16F0192BEC9685CDAD008CB007C706052511EC7CB6DE90B36B3BC2E7340AEA10702B63E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588475, "uuid": "e9e57d47-76e5-45c3-b16e-c3e6e9c47682", "value": "12:7RDzyi+eqDiyi+eqDxyi+eqDHyi+eqDXgyi+eqDvyi+eqD7beyi+eqD7keyi+eN:19+Fs+FD+Fp+Fa+Fx+Fvw+F4w+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588475, "uuid": "0299fb58-fd44-4f78-aeb1-0fc36ebe587f", "value": 824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588475, "uuid": "1509051d-3176-4f5a-88f6-dcb778a6ff75", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588475, "uuid": "9578dfe9-69b4-4a05-8b9d-cd681ec3115c", "value": "router-atemi-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404bb8a7-bc9c-11f0-91c6-42010a9c0006", "comment": "Malware payload (MassLogger)", "timestamp": 1762603972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603972, "uuid": "581556be-9f67-43e4-b1da-2d9d31674aea", "comment": "Malware payload (MassLogger)", "value": "1688a1608ccb7b197642723f15271e00", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603972, "uuid": "f400e7e1-1386-465e-8540-0931aaf45463", "comment": "Malware payload (MassLogger)", "value": "b8fe102219ac498f855d823704eba0e2973547d2ce5abaf5b91eb0f84d57e21c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603972, "uuid": "cac3dd43-95a9-4e3e-84e1-2842267c4799", "comment": "Malware payload (MassLogger)", "value": "c95bb0f251c99ccef10ee848fb7ddd53b897dbd6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603972, "uuid": "f6c32238-1f61-4661-80a0-ee25a427e08d", "comment": "Malware payload (MassLogger)", "value": "56b299df565f5de3c78e1e1b1db3c713c46ff8dc633b0d70e1666e68b09e9e64c8d0f2db02f6038c2b2ee420ce6c478b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false }, { "name": "PXRECVOWEIWOEI", "colour": "#E5AC15", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603972, "uuid": "4e7d1e87-b152-4dc1-9e06-ecb923b6aaac", "value": "T1CA15AB18ED80DA8AD519F937C9F5B210C77675835363D22F593A9DBA21C23278C8E4BC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603972, "uuid": "627d2d88-12c0-4c18-b0e4-1fcff4a66d67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603972, "uuid": "f24bdf71-b1da-41e2-a036-827d74585057", "value": "24576:9gBB5pSQG72r8ANMNFz3jFHOkwozzLMpHOS+g1tJpNMUS4XbotP9oWKsuCSF0NZ8:yX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762603972, "uuid": "774ac223-cfae-43a9-9ccf-3e3ccf2bcc24", "value": 916995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762603972, "uuid": "bd31aac6-4545-4b1d-9735-4d5716bf50e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603972, "uuid": "e8dc3726-cd4e-450a-a3ff-c7e14a81a750", "value": "3ud41m0ni4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e27630-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620699, "uuid": "fd516c26-59f8-452e-8e76-2b7a903ed545", "comment": "Malware payload", "value": "ff3b6bb35e0b4b3872a59c0e183df373", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620699, "uuid": "8d321240-f244-4fd5-82a4-5bee2d426b93", "comment": "Malware payload", "value": "b96eca1184ad62ba8b23f00236dbf4fc4af3c54fe3cac030fab07131b5e543e4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620699, "uuid": "997d1dde-2c7c-4b8f-ace8-d3fca6951938", "comment": "Malware payload", "value": "cf792d2fd48811f941fbee50d60d2cbb749c4936", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620699, "uuid": "90bd25b0-1efc-4b8d-ade5-13897b4a7566", "comment": "Malware payload", "value": "3694b917a311a830bf15ae2eb5f243dacae1a26564fcd41ca5b4e7875f50fce3666ffd8bf536cf1c97b19378241e1294", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620699, "uuid": "0fb72668-0f82-4ec4-94a0-6db08a1f204b", "value": "T135145F683C035ADC0A5D165E392517C0233F02479DAF39FD82F5B01CAAA2EE5B2B55F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620699, "uuid": "e1f85e90-035b-415d-b956-3dbc9304e718", "value": "6144:aeJ0Fko0SNgxrEFeUx35NQcJb9U/itau6IJ5hyVYQTgmD0hHS7:ahxdwIJuKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620699, "uuid": "698dc88b-29aa-4b7b-b09d-bd9f9292f0c1", "value": 208396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620699, "uuid": "72380a64-cb43-40a6-83c6-1b705b1e3249", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620699, "uuid": "22204430-b460-444a-987a-1acf9b70c96e", "value": "bad.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "771739fd-bcba-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762616949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616949, "uuid": "b05d8cec-fb7b-4d33-ba44-ece2ac066e2b", "comment": "Malware payload (Mirai)", "value": "b0f0e39689b8390ee62996dab4242d88", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616949, "uuid": "df2b4356-0397-40bf-bea6-ee1a5cbf89f5", "comment": "Malware payload (Mirai)", "value": "ba480c051bd44b01c7c235285e646c1362d72e44ae631640d89d4326efb4199c", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616949, "uuid": "676567f8-633e-47e5-8a99-34ade00462f3", "comment": "Malware payload (Mirai)", "value": "1f98235547e55f82c5f1fcc231a073c2bb42611b", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616949, "uuid": "dc4b6f87-4322-4756-8c62-cc0340f91b67", "comment": "Malware payload (Mirai)", "value": "1d11fbeb911d1712c54e91c3795af1614c24825e356b2148651cf031412995d5991172d2a4e2775dc7a0cf09fb888e62", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616949, "uuid": "fb8fca7a-1b9e-4a1e-9526-1d19894470de", "value": "T170D017A8F33221B3122CDE10F1E048C6D09291C8CCAA6BA1FD23587C64B92806150226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616949, "uuid": "e60a9bbc-1988-4e08-a754-e1317d06ecf1", "value": "6:3J3Vg3p9SFqZaNVgfm0IFqZXNVgOuiFqZd:3J3y3p9SF7yXIFmyO/Fm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616949, "uuid": "2e80eb6c-da6e-4ea9-9c75-fc753f098b7c", "value": 238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616949, "uuid": "4273a9d4-bc00-4581-876a-4d8ecb9bcdc6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616949, "uuid": "a3b9de70-11d3-43b0-b5d2-fca56a1906b4", "value": "sea.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6865f221-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620360, "uuid": "e5f87251-cd47-4623-ac3e-7094b1493b37", "comment": "Malware payload", "value": "62299746e92728d02c9fa0283a99f95b", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620360, "uuid": "dadf43a6-7f92-4643-aa7c-ea6cb295613e", "comment": "Malware payload", "value": "ba5429b33b9afcf4c0d66648b76944affa32c1820fc4edcd096b69ae24ae4e70", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620360, "uuid": "f915f261-0d79-4c4f-8823-49ec0f7af59a", "comment": "Malware payload", "value": "57ef355b89b3e3a9a1927f2ca77880c643feb320", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620360, "uuid": "c5578f1a-e1e7-4281-bd46-346ed233524c", "comment": "Malware payload", "value": "2012465e364f19755ddbd7cb8af3adee0592fa631f912c140b8dc3510959ac0b839cbe5dd467b187a58efbe6ef67cbbe", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620360, "uuid": "61e9d438-64bb-4105-a4b0-2c5c95ff0dcd", "value": "T1E0341A234915089CC7A523D23D263B0A07EF263E1170E65D86F2671B7775F49E7BE288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620360, "uuid": "bc49757e-7359-4654-9703-3c3cb0e5f672", "value": "6144:P4U2whmFg2iZ89ErjeGLBnYrse4+y1NkxCi3/SlR5E2cdcDjrBoDYwH:PLBnYrse4+ybdzlk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620360, "uuid": "8f1b7298-80a8-44e3-b20a-62db3241845a", "value": 238594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620360, "uuid": "d0d4e46c-c254-4e26-8d14-020e30bf6252", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620360, "uuid": "8a918d31-bb4f-42b2-95a8-ca4a7817eac8", "value": "RFQ-60045139_251103.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e000be4c-bc9b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762603811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603811, "uuid": "da68ee4e-9507-400c-93a4-b307d7148b6b", "comment": "Malware payload (Mirai)", "value": "8fd27399dcaabb6aec1ec4971efd44e0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603811, "uuid": "97059205-bd5e-4351-bc01-ea0c877b484d", "comment": "Malware payload (Mirai)", "value": "ba6e7075016f44f15ec97991802a90a9dcac2d782d22160c56746d9f8f0e714a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603811, "uuid": "a5d005ea-6a3c-48be-8b05-2df949358421", "comment": "Malware payload (Mirai)", "value": "b369b109b2d1404a6e03e8bbd4c4b309cdde9361", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603811, "uuid": "235b91d0-ffb6-4f66-a4c2-86ed853f6cda", "comment": "Malware payload (Mirai)", "value": "2ff9ed8f52103a268e577105a357ec8e234b8ab0b7adeeacc876bcffca7f58330bf24ad49057fa66586442d231793350", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603811, "uuid": "775267b8-41b7-44ab-a381-b67948ec0e08", "value": "T1569328CAB400DC7DF81FDABB4463490AB931E3515A931B277767BD93AC321A44867E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603811, "uuid": "d2cd77df-6a9b-4d0d-9660-3fb380bcb32d", "value": "1536:c8fF4Jus6GxrbZn/RZiAI00D4H05Oc3JmWYHa8Y6IXFVPQ8IQv6OHbEiYAT5vCHc:cBrdnXcHM68hIXFtpSTifTN+l0fAraOY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762603811, "uuid": "bf451bdb-4ca0-47a4-ad71-145501256d80", "value": 91724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762603811, "uuid": "e506bec0-0e28-4328-b29c-1cfb5e7bdd7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603811, "uuid": "e849c984-7ea6-4dca-b7bc-02facd523d85", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10ddc564-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762620643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620643, "uuid": "37138b1d-98fe-4cbf-82ee-796e4ce8c800", "comment": "Malware payload (AgentTesla)", "value": "8911f1a62b2ea9f32ce604714fa8632f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620643, "uuid": "47c0930c-779c-4f60-bed1-c27ea61048a4", "comment": "Malware payload (AgentTesla)", "value": "ba8e2cb7606faec2de082ea4b97c81b206733dbafa1635a8084525212b7912b6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620643, "uuid": "18751cc8-9a59-477f-88a1-f28b5e16150c", "comment": "Malware payload (AgentTesla)", "value": "a7be1534a146a51ba30d2dfdd73f6af4f639701a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620643, "uuid": "d2f5e3c7-1093-44dc-bae9-bf58bcaf4508", "comment": "Malware payload (AgentTesla)", "value": "b9b2b8a55d101cb09a5b64f2743f05f071edffaa8c26f7d3a374dcfdb971d3535da5c0ebd7c4eba196fff9a777116d92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620643, "uuid": "2f074f97-3c4c-4c04-aa05-7c52a8c5aa0d", "value": "T1454502118EC86FB9CFBC8A1890FE161EE3E0569A50266549FB37BD06AFF7644420F1C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620643, "uuid": "834bcf90-b178-4860-bb24-9eda9b6cf22f", "value": "24576:7E0PuDWMlqzG//xITHRxNlIJ1imAEA37P+wqf+DDa:y47nNuiUoq2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620643, "uuid": "d7df5e15-7391-48d0-a12d-8a9462033e8d", "value": 1264564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620643, "uuid": "75dd4c9e-bb7a-4fc0-b718-f3800d7c4a06", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620643, "uuid": "48765f7e-1564-4116-a530-1853a4e5c769", "value": "BASE.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6670f638-bcba-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1762616921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616921, "uuid": "936be9d7-ff20-4bc0-bca4-5a4370221a09", "comment": "Malware payload (Stealc)", "value": "a9775d2276aba1d560f0edb724a96812", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616921, "uuid": "4069aafb-8d4a-4961-8ff0-e9436a8fb281", "comment": "Malware payload (Stealc)", "value": "baadd4673abc37106f5e1808c2f21d6f1fc9944e4a6e2d7e9fe574dd6ed33db7", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616921, "uuid": "00e9c2fd-8229-4d05-be52-0d8cd66aae5e", "comment": "Malware payload (Stealc)", "value": "e4c931b2717e0fecf9917396a8255289c98d8bf3", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616921, "uuid": "e0ebb9f4-4bdc-4720-8ac0-667c7704a086", "comment": "Malware payload (Stealc)", "value": "dc78ce441c667ae27d839f1e9245b72c4fbee29d643cd37533a62b32f52f123fabeaf3ad49ded4c314e139c91bb29d57", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616921, "uuid": "c86b5f09-bcb1-4459-bf55-e0f1f1bb4642", "value": "T164F54B427C8994A1D1AAE234CAA5BE55B330BC584F3D37C32F15A6721E73BE44E72358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616921, "uuid": "047c3e6f-42f5-4728-84fb-37a5471633bd", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616921, "uuid": "0f65f846-8ac5-41c9-8b0d-2fab0a09d0cc", "value": "49152:SCKiWlMUtOQWAfW6bzyHSdsE+hgsNdbD1:URtkAfW6bzzdt+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616921, "uuid": "fbc5afde-5057-44da-8812-329c38759334", "value": 3563008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616921, "uuid": "ee6d7681-b865-4898-9371-533793cab547", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616921, "uuid": "98024e42-6f04-4d86-bc4e-9c262bb9290a", "value": "Licence_Version_Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "160df834-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620652, "uuid": "4a223472-3f63-482d-947a-abe9f73a2088", "comment": "Malware payload", "value": "27e6197ad28d4bb0545537e6ca86a20d", "object_relation": "md5", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620652, "uuid": "a94a1cd2-0dc5-43da-9690-c7620bd1a4f6", "comment": "Malware payload", "value": "bac3bf5f71fee8b42572d4bb8e41a4fc21afcce31e244e1669dc724b1c3fb6a4", "object_relation": "sha256", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620652, "uuid": "aa9f3d5e-d869-435c-9538-80101d970b14", "comment": "Malware payload", "value": "dfeeed841d88c0568b12986fc78e376395dbda66", "object_relation": "sha1", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620652, "uuid": "e15cc2a3-2751-4488-bc70-52322c383634", "comment": "Malware payload", "value": "38484324823ef7af46c69b5f80a9d11eb114bb9779155f6f5ae8e937791985ed9479f7ef43df5d41c25a6221d24ba58d", "object_relation": "sha3-384", "Tag": [ { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620652, "uuid": "8fdd28d5-e5f3-4d77-a2e6-20aa274a7663", "value": "T17413D8A05ACCF466FD2CEA2749C17E0669D3AC725615AE7E5F1D17D48BF2B300E0026E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620652, "uuid": "db6495de-defd-4d7a-a3c8-ddebdc569f90", "value": "384:bXp+1ncW+OncT4TXlwYuHJ2QaFSzaPSz0KTnSKentN2ArF9sKJ8y8JSNqJ2nlr1H:w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620652, "uuid": "27129e5f-e7bd-4df1-9dea-62d571f07d9f", "value": 44586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620652, "uuid": "45856793-c887-4221-be19-790ed140da28", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620652, "uuid": "d5afd8b5-7544-4c28-adeb-b84003171dff", "value": "hesaphareketi-01.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a25894-bca3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762606934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606934, "uuid": "2b29fa87-cabe-410f-9e7b-da03c7589ef7", "comment": "Malware payload (Mirai)", "value": "8bf21dca6089fcedce7ebca6e9fd72d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606934, "uuid": "a5f66e54-c8eb-4cc6-b763-c55c4f5ef456", "comment": "Malware payload (Mirai)", "value": "badd72291b706cb7d9144ffecf105b574bd5601b85fe75e778c239d2376de3b0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606934, "uuid": "9b74be0d-e995-4d59-82c9-8ad3386b0a65", "comment": "Malware payload (Mirai)", "value": "cfc6d338fc031e1bdf5b3fa60a99faf111ac2291", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606934, "uuid": "0c6fb70a-96e8-40e9-9513-82fedbb49dff", "comment": "Malware payload (Mirai)", "value": "86a448b119d84003b611ac5acdcda2ff67ef27a5b85e69d2aa24d11ff637e0af1a4b0922164ca4232b555a28eb89e00d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606934, "uuid": "b6ad346c-2407-4710-a3f5-2358c32ba429", "value": "T145836C22B9391A2BC4E4A57722F34332F1F6438A24A8CB1F7D750E8EBF1559036476B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606934, "uuid": "165ea7e9-7d10-44cb-a635-086559676060", "value": "1536:xTI32Lb5/wiIPupxaxhBatZ/Ym5/XJoAEntVz:0pEb/YO/58z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606934, "uuid": "388d3d2d-fdbf-4eba-898d-226300e88c11", "value": 87168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606934, "uuid": "30c08cc4-c042-4905-9d50-fdadb1c80967", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606934, "uuid": "d4d70c61-4c70-49cf-9390-ff11c87627b7", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f041a84-bc8a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762596212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596212, "uuid": "f87a7a6e-4576-4a75-8fc5-b32c17c35e72", "comment": "Malware payload (Mirai)", "value": "46ab4b30629f0617f40807e703f3af44", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596212, "uuid": "6cccb894-7920-4c34-b96f-f5f463a48242", "comment": "Malware payload (Mirai)", "value": "bc3afb18a36d71bf98ff4dbf873244ccfa7498912928cbfdd4d6adcfebc07ff6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596212, "uuid": "b6995b61-301e-4d3c-af58-21c1f1eda4be", "comment": "Malware payload (Mirai)", "value": "34abd29b64cd0beee4b4969ea5ead1329c4fa055", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596212, "uuid": "8a66ab25-69fe-415b-857e-65d310a831ff", "comment": "Malware payload (Mirai)", "value": "2f922cb71915dfec3c120e796845b5472c439bfd4f64319e81cd382eb5fc9bec1ae3f1529ac7855a2552dcf5eb14a63c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596212, "uuid": "89f52cb9-6a58-4ccb-9749-f9d348729a63", "value": "T12DC3C71D6E328FBDF768C63447B34F21A798239626E0D5C5E2ACE5045E7038D641FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596212, "uuid": "c38cfe7b-ac0a-42d6-b0b8-a05dec7794a4", "value": "1536:zyuH8rWUI5XiyPBB9+PnssgFSA5mAJxY0mFR+pPKtE5imZ15yJRqP6exakwDLBS1:xIWz5SEwHA0AM0mFKKtE53DPCLBPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762596212, "uuid": "64701fdc-6297-466f-80b6-8febd1382dbd", "value": 119716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762596212, "uuid": "e9bd2f34-e30a-44e8-aff4-12df21d01553", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596212, "uuid": "58b3e4c6-cb5c-45be-aac9-8bc754bf5da8", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37b9e2cf-bca7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608682, "uuid": "6da6e063-b948-46a4-8ab1-b2e9ac182b0c", "comment": "Malware payload (Mirai)", "value": "ad52bf9dd97ce6af2594c75880a11821", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608682, "uuid": "b4208993-f38b-4156-a327-c0eca4037c42", "comment": "Malware payload (Mirai)", "value": "bd87c6a44c6c88d7d8bf92a441cdbc456a04bdba82b4dc1b34eabfffbe894b74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608682, "uuid": "0f36bab0-5836-451b-b663-b8f6ab8f477f", "comment": "Malware payload (Mirai)", "value": "e79d8be783fd41c56c13ff78f289a63ced28a7d2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608682, "uuid": "f88b9e83-938c-4e9b-9490-fceb43b970a1", "comment": "Malware payload (Mirai)", "value": "95df8681f15dfe3205925f4ecc900b78e1917a44d8fbcae4bf74614a1c90259b3fa7750875a3a8a09e8dca5e78a8e06d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608682, "uuid": "6df834e2-8d73-40b1-95b8-233cbcf24f2d", "value": "T1CA130258C965E714C95E51B964AFBF1E2640C1ACA3EEE3F92F4C3034B91DF182A28547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608682, "uuid": "27b1a67f-c724-4f6b-a6c8-5aebbba526af", "value": "768:7jI/MEiT1gcoAmN1LHfKVR7YiDSiEObn0Xu1JtxDpqVInbcuyD7UHQRjv:7kME+JoxHjfKVR7YiWiEc0X0JHlBnouy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608682, "uuid": "002cff9d-f02d-42fc-8c29-689f628c4b35", "value": 43288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608682, "uuid": "30e3eb49-c40c-432e-b697-f33a621eb59f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608682, "uuid": "bb45e572-8e4a-4cfd-8ace-d9a3b23033a1", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79aa4134-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602351, "uuid": "e1a65552-b5e4-40c6-9a52-49f81890efb8", "comment": "Malware payload (Mirai)", "value": "bb3457cedcc7599f52c92a6a784e2003", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602351, "uuid": "c4b5ba1c-d440-4b25-aa4c-dffcd88aa87e", "comment": "Malware payload (Mirai)", "value": "be5544db8a2ab3ddb360385232031904494977add6d5f82dc50d4b40eace7f3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602351, "uuid": "551abb33-8cb3-4a1f-93f1-46e1eac59df8", "comment": "Malware payload (Mirai)", "value": "3bd845499c0cd382237e84beb962ba0b9d1fb65e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602351, "uuid": "3f6df9ea-ad94-4d12-bf0a-551982832456", "comment": "Malware payload (Mirai)", "value": "3d60d8810f9b047d57604f2abe0df789ef60f1e721f84eb76501139cd0c4f9c343f948ed372d2f9cf6a969c51ebb67af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602351, "uuid": "9c3e524f-5496-45b2-bbb2-f3af853fec74", "value": "T1EC73C70A7E229FBCFB9846354BB78F159A5833D627D1D641E2ACDA001D7024E341FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602351, "uuid": "531f911d-9381-48f1-9352-5e1b2c5b6fe5", "value": "1536:bpxe5qoct9fdlQBI6r+mnUFndlBotYG9CJa101Dv:Fx3oANdlRndvomgC4S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602351, "uuid": "ec9f3394-4afc-4315-b8af-646a9ed4e939", "value": 77288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602351, "uuid": "b078212e-a84d-4439-9ace-8a3105c8ec73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602351, "uuid": "533f3ccb-04e1-486c-a820-156d13109066", "value": "uYtea.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f45dc47b-bcd1-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762627038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627038, "uuid": "cf200cfd-d30f-42e9-90c6-e8587538d28c", "comment": "Malware payload (Mirai)", "value": "9a265361ed56c63e2934c99b53eaa897", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627038, "uuid": "e42f492e-8b67-44b0-acc5-e40c91acca07", "comment": "Malware payload (Mirai)", "value": "be81454afc080694878e43b5e7eb281e7d7dcf255538f5a288b30e3c7873fa00", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627038, "uuid": "9bb5b969-f243-4130-b786-c2b701c3f47f", "comment": "Malware payload (Mirai)", "value": "41614948172bd043e18597b34cfd5fb6b495e5a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762627038, "uuid": "a955918d-8b15-4ccd-bbed-6afc530f2994", "comment": "Malware payload (Mirai)", "value": "1415a4762a141f638f461663f6293f9593ebe0f7a1c94a12eefcdfb79b19c70a87f8bdbf6c8f460e46ae365b73eb54db", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627038, "uuid": "cf16cf34-ed66-4892-9879-5982b78e6323", "value": "T128D3E90DBF218F7DFBA982344BB39B259758239637E1C585D19CD6012F602CE642FBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627038, "uuid": "beacde80-f470-44a1-96dd-d92b456db221", "value": "3072:ANkMz5n7VA4tFtSEraju/jufMhegEJZd+xk:YkMz57VXtFtBraju/jXIpd+xk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762627038, "uuid": "8dab3fc3-aed2-40fe-a705-d26455282f6c", "value": 130324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762627038, "uuid": "0d855fac-b78b-4320-8d5c-d0f4c250677e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762627038, "uuid": "33690ba3-fb18-4d99-884d-ccbc103063d1", "value": "executor.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721ba777-bcae-11f0-91c6-42010a9c0006", "comment": "Malware payload (HijackLoader)", "timestamp": 1762611787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611787, "uuid": "eb9ab8a9-a251-4725-b026-8da7c05c0921", "comment": "Malware payload (HijackLoader)", "value": "3d8bea780796b035905f9a196f0e50a4", "object_relation": "md5", "Tag": [ { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611787, "uuid": "a6996e38-595f-4c76-868a-94450c372724", "comment": "Malware payload (HijackLoader)", "value": "bf91cb86e3d06ae3ac4ac6cd2252a387046c10658701ea8a11ffa706397814c2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611787, "uuid": "724e52c9-e446-43a7-a2b4-92962394fab8", "comment": "Malware payload (HijackLoader)", "value": "9f0727e944de909dc0f3377dd5e08ab530a97e1a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611787, "uuid": "5fe3e365-701a-4ac7-985e-bba298f8c10a", "comment": "Malware payload (HijackLoader)", "value": "84611af7875faf14df92e96a1894e505f80e10285d55a486fada2264f36d52db86bfac4c7d4fa987e28d27b05a6cf00d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-Rhadamanthys", "colour": "#54C467", "exportable": true, "hide_tag": false }, { "name": "groveri-eu", "colour": "#EA176E", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611787, "uuid": "01cde581-8488-4ae7-8b16-01c39eb60bf2", "value": "T128C63380D9037662F79A43BE50253AB1EDAB2E65CE046513B7E07F263B3F56731C4688", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611787, "uuid": "f51fd93d-baa2-4ed0-9a90-295b15f99afa", "value": "196608:Nk/VeNKtK2nNBkQllP8e8hCwtYx1KdQ/mR1Eo59NiUaMQv4Rh1XPB0lSwKM6oPyi:o8NKtvnFllx8hM1eGo7M/ap86oPZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762611787, "uuid": "836da027-c725-4c48-8dfd-e602aac3510b", "value": 12324864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762611787, "uuid": "813fb93f-0d69-452d-abf3-fa6d183e5afb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611787, "uuid": "380b21cc-c8a7-47fc-816d-7f93630f0be6", "value": "nnUKj9Yl.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5dae1e-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623478, "uuid": "b136481f-d058-49c9-8ff5-c2d680b9a7fd", "comment": "Malware payload (Mirai)", "value": "a211d66042f63ae7234afe02423fcb9f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623478, "uuid": "e8647fda-7f2d-4c4f-b02f-15b0c7c55dfa", "comment": "Malware payload (Mirai)", "value": "bfb0c8050355bfd81bc2f26f97a18dd3a931a6edfe32547b3dfa6de7e6d6b6ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623478, "uuid": "0358c9c0-874d-4753-a020-dd5bdcad3eff", "comment": "Malware payload (Mirai)", "value": "5e78f4a9bce803d2d6e4a868303f7e912b53ba64", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623478, "uuid": "188ec134-ad4c-42d5-9498-1208b4b258b8", "comment": "Malware payload (Mirai)", "value": "db421b335c9a1c26e5ae3eac09824822862e8b57daae8d49febbd2ac95d10ad52e4c1239e3c8695212d52e73df19ce64", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623478, "uuid": "f056b046-7c93-440d-bdbf-abeea1224a49", "value": "T12BA2D024815A6610DA310D37EDFCC493770707F6E2D331BB2659A9BCF29ADC5C2A8193", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623478, "uuid": "b479d18e-75a2-4cb7-9c22-7553b4bd8f6b", "value": "384:bD+6iwZwE0tYdHKWyp2OgjdRKHdEw9AvkNar44pHhymdGUop5hXP:ba6PZwFtkKWSe3edEYM44hs3UozJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623478, "uuid": "f4d1461e-1dac-47dd-a403-6eedd7fad996", "value": 22252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623478, "uuid": "6f758211-2f52-4320-8656-75886f7ceabb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623478, "uuid": "bcb40c1c-168f-4301-8233-2498d31bc49a", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425d3671-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762588943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588943, "uuid": "cdc31403-1886-4387-8767-b41cfea53533", "comment": "Malware payload (AgentTesla)", "value": "dc170dbcc9f4cedf12b6ffbc99155b67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588943, "uuid": "36521c61-8074-4cf5-a09a-8cf3fa5174ed", "comment": "Malware payload (AgentTesla)", "value": "bfb1926bc0e9f9e60793e812872fa4ce576286b08ef1b7ffc497c86a7d7ba35a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588943, "uuid": "59a663e9-e9ee-4c25-93ad-24dd5f98c81f", "comment": "Malware payload (AgentTesla)", "value": "3323224f3e26b5fe2a6149e09df77fbf84d2e536", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588943, "uuid": "0d8cec6a-47f9-4dbd-9833-392e5069c627", "comment": "Malware payload (AgentTesla)", "value": "127cdc798e29901836651083b8dc0bf0c7ad713e9773d6d2ab93ef5b9cb40297d928abbe34b8430d61fc26fefdc4eaad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588943, "uuid": "0c75ec11-3873-408f-836a-ab50683f9da8", "value": "T14382218D3FC2B17143F360636D3B605EA27B6C927A4CD054D2B9E0E4F965308D6A6A7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588943, "uuid": "56fa36b9-ef4c-4376-9b44-3e826dcf0659", "value": "384:q9/8j7vMys15bT6QvIr5OTaBkW8iN9bPyqXJ:DAysbbhoUyk6Djyq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588943, "uuid": "a529ff95-c2f7-4d05-a499-b735a023e32b", "value": 17639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588943, "uuid": "6d3348a5-1cb4-48e8-9607-5017390b3edc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588943, "uuid": "b5a0e169-bda8-49a6-8ed7-01c9041facfc", "value": "REXEL RFQ-O109X-NOV0018191.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a644b358-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623471, "uuid": "7cfe21b0-d317-4603-b6a6-fb1a52a4ef41", "comment": "Malware payload (Mirai)", "value": "80391b03eb78deaa42ec80df0a3f9c0f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623471, "uuid": "167a1a54-76bf-4b72-8753-9de6c7167104", "comment": "Malware payload (Mirai)", "value": "bfe939d05cd7c127c9baf73423eceb45e2afaf729197835cb1b6245c7c8246bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623471, "uuid": "7a545c92-cd77-4087-9e53-a8b1803cdfab", "comment": "Malware payload (Mirai)", "value": "a8d0c360e387c5ea6768fa8f55bc79e5b14af673", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623471, "uuid": "1b8b086c-137a-4396-b978-5fd94d575018", "comment": "Malware payload (Mirai)", "value": "130d15f1f3a6e1b36751e779f01e4c96941ea23af8dc9e526ed9e49e23972976334974d7e33c493f5c343bc43f99608c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623471, "uuid": "6eb090cd-26a8-4c9b-acab-a0909796fc77", "value": "T11C43F061FA511AC7CCBA8CB091EE35715F5A612936DF87A96B1B0D80B31920F75A8338", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623471, "uuid": "26c2d2ad-8598-4eae-a7f4-6d6bc08427ec", "value": "1536:h8rRD0gn1aEVi15uooQJpP8LIYUK5xUStUm:edUEiOdWF8KK39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623471, "uuid": "9757f3ac-9ca3-4009-84e0-70d51ee68a02", "value": 59984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623471, "uuid": "22092c9d-e21f-468f-a556-2c2d336a5a1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623471, "uuid": "fe8a4b70-6766-4f8e-aa6b-dd7db052fe13", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb83a1a8-bc9c-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762604179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604179, "uuid": "5dc6bce2-c65e-4e35-ae67-c09ae0743aee", "comment": "Malware payload", "value": "a553b78847aea7dbb6746a4ee4b98a3b", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604179, "uuid": "28cd62e9-38d3-4d86-9951-3e2d56766bd3", "comment": "Malware payload", "value": "c040756802a217abf077b2f14effb1ed68e36165fde660fef8ff0cfa2856f25d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604179, "uuid": "f85c0627-80aa-4689-806c-f363fe527acf", "comment": "Malware payload", "value": "60266c9cde361534710b18d18ba4da67002601f7", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762604179, "uuid": "4353766f-57cd-470a-a0c5-8f17a0a10290", "comment": "Malware payload", "value": "1e3f57434bb4759fa7c2e32abbd68cae5aa1eb44560a1819b3a4b2cfed6edf673e3d7ea4422669e2b16589b0b803c678", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604179, "uuid": "b7e74a72-0ab2-4d50-9614-2fc3d8e31104", "value": "T1FAD31210AD0F717BC6259B38F9E09987EC684B473FEB57B36226D1C880A4DC5B7A6844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604179, "uuid": "cba9d9db-955f-4b96-ad39-97c9d1064863", "value": "3072:hlu8Vxw7hDRGWx1fEzvFh4eH3176S+cpY3ylxI9s:7XEhDd4vFh4eHlOLcpYgI9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762604179, "uuid": "45f3baf3-1350-428f-9515-891f20f41bf4", "value": 134920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762604179, "uuid": "5c1d9c3d-4d27-4f9e-8eda-1b801c2c45e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762604179, "uuid": "27aa95c9-25d9-43bf-8f5d-2b1051ad8bdf", "value": "Credential_Verification_System.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2f2487-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620741, "uuid": "5e00ad33-4210-4752-9fee-e1c79620e4db", "comment": "Malware payload", "value": "5dca1ff147cb01875bc0472358ad15b9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620741, "uuid": "40766e00-3b57-4061-b163-dd6cc96ab30b", "comment": "Malware payload", "value": "c062804b11b44241e6ae694fcf958a477e0f2a7bd03283c58d08b31fbb739b67", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620741, "uuid": "77148f7d-d9b6-4488-809b-0cc2289f64e1", "comment": "Malware payload", "value": "208e2e9418b6a8c0a9cb3a170402b1543df3674d", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620741, "uuid": "13aa3bbd-3988-498c-8d2f-def53e2b74a0", "comment": "Malware payload", "value": "e671f4657138d42b5b08c9cb8da89cc49a9715a089166aa88915272132a65e0c0dc9aa7bc4c6c52ee35b183e6becc973", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620741, "uuid": "5c9f66ba-4ffd-4b30-a19e-538f78aee4f9", "value": "T10AA533C45816607B07DF6D67DDC0AE7BA2F4AC7B48619BB4FA711A805D231D4BCB8036", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620741, "uuid": "b0e8252e-458f-43c3-bbe3-075d6de15492", "value": "24576:Hl3QgS7+d3NSIWtkyO+XrIMiIfhg8vioMbIfKaRpvNXjz7DaX69WQIGNytQsRD7Y:Hlgl7rIokyORM6c51vNaqiGQzEfM4fnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620741, "uuid": "903cfbec-08c2-46ca-a4c1-c4e3f5ff7826", "value": 2151987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620741, "uuid": "3fbdd9da-0515-4578-a5f1-e2186df448a6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620741, "uuid": "a94a1bf4-8384-4677-a70e-ce3669b12a37", "value": "List of Pending Invoice list.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf73e23-bcc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621952, "uuid": "a80ec760-b6ed-4529-8edf-94eaf5775d91", "comment": "Malware payload (Mirai)", "value": "0673c53b74853b17724d02f42f616557", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621952, "uuid": "689f5766-e856-4259-bc73-f115fbbfad60", "comment": "Malware payload (Mirai)", "value": "c066ff16215714c96a2f58b9b175c7d86608d8ccde020f2d9fec67311048d0b8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621952, "uuid": "44e74352-623b-4f79-b06e-1973f182a998", "comment": "Malware payload (Mirai)", "value": "5459f90574b77319422cb73822e159e2d952b0df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621952, "uuid": "b7dd8e83-970a-4990-b48f-352935bbbeab", "comment": "Malware payload (Mirai)", "value": "e0d1403bffaaf71027a5cca135a9bfe7ea4005de2eb9ea4117d2ee4618d9682504064eaa4a824f41e1b7f7bbeab8eba7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621952, "uuid": "9bb3ac94-2f6d-441a-9ce0-5c8414cf130e", "value": "T1E0335BC5AB93DCF8ED1506713177EB328B77F03A612ADAD7C3899523A842B01E50729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621952, "uuid": "c3e9b39a-3d7d-4f5d-aebf-c33d1403088e", "value": "1536:3hSgebzgP/AY+39afOsMJRdnhNc6OQ6xpwhNbr/T2:xZebkP/Ad39UMJRlhNdL6bIbDT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621952, "uuid": "6a14e560-500c-42b7-8adc-0707063659f6", "value": 50608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621952, "uuid": "8f5a78df-378c-44a2-8ece-7122b75969fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621952, "uuid": "9f41fe8e-7e2d-40e2-81f4-c6ccb5c30627", "value": "jew.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbae79b-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602357, "uuid": "14ff2cec-72b8-4c8a-9360-8f5079058095", "comment": "Malware payload (Mirai)", "value": "03efcd846418a49af9ffc303d3e44e55", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602357, "uuid": "5818ffe7-e5f9-4c31-becd-6770f7d41f53", "comment": "Malware payload (Mirai)", "value": "c0b7aa1c185712a2961d05030edfb9e0f80b8a0d3eec93d5621bca2de805348a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602357, "uuid": "45cc2e35-d01e-4e55-b1e8-b5e4383a09d2", "comment": "Malware payload (Mirai)", "value": "0bdbbb3dd2c6b2f6a1f6bfd69826d814fb1f0b3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602357, "uuid": "a23c5a1f-f78a-4e66-9e70-6da4c09d2693", "comment": "Malware payload (Mirai)", "value": "edade36f14aba73c1f7ad93a9db37733bc73376292bfcd53c990fb84dbe95b4d424473b9d2951a84b67791cb23af6bb8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602357, "uuid": "936551ac-5e8b-4818-a354-6a9d5dc07d3a", "value": "T117534A32FA762A27C0E5A47A21F78B15B5E117DE21A4C65E3DB30E4AFF606406502EF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602357, "uuid": "aece0bb8-ca9b-4de9-8d40-43457f42971f", "value": "1536:wwkfZJxFtojQlvnrj/Byzn7dke4tuItYZ6w8+BwQSz0XYIfiV0/:BkfZJxFtojQlvnrj/a4LYZ7pYN8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602357, "uuid": "bcc16376-7bbe-46bf-949b-f83e5bc6eebe", "value": 63480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602357, "uuid": "fa0e0d38-59e7-4e77-9ad7-d0b16f6d4d2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602357, "uuid": "8cb0fb17-8760-4b2c-a767-550c63638c5d", "value": "uYtea.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57096bf1-bc78-11f0-91c6-42010a9c0006", "comment": "Malware payload (AnyDesk)", "timestamp": 1762588549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588549, "uuid": "1b1b32bb-b885-4dd5-9556-f9325eef217a", "comment": "Malware payload (AnyDesk)", "value": "1fb7bf58ac9f05d50216c0cbfc78173e", "object_relation": "md5", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588549, "uuid": "22f5e927-d1ac-4582-a3d5-2696b307b07c", "comment": "Malware payload (AnyDesk)", "value": "c111b711e6e58fb95388edba3219c684580265d37d7be96b36299640a2dabbfc", "object_relation": "sha256", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588549, "uuid": "b184db20-a779-4ff1-ad55-e19cf7cdd4ac", "comment": "Malware payload (AnyDesk)", "value": "4426484f053a209204c4d81f93e370cf3c74e97c", "object_relation": "sha1", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588549, "uuid": "5586b92c-f579-4981-af5d-073b16be67d0", "comment": "Malware payload (AnyDesk)", "value": "2756425533b83286af1fade9f4b9df1f29d62d92ccbd4e7a39ff0d95d19d50f60141af3b702c42be2c516224a29b3d9b", "object_relation": "sha3-384", "Tag": [ { "name": "AnyDesk", "colour": "#DC1D88", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588549, "uuid": "e184c1fc-35d6-4010-aa91-fc1d140976de", "value": "T18C1633603BD8C137D2DA0636066E8BAA3A657D755F21C0DB1B9878BC5E317D3AC39702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588549, "uuid": "81134e29-01ec-477f-9873-eb413507aadd", "value": "98304:npIWfAYZbFnRgLqlVR1f7w2N5toJ2HVEww04UZ6Gx:ugXRgglw2NLhHV4U8G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588549, "uuid": "b2de24d5-63ab-4184-932e-0ed95a5f17dc", "value": 4063232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588549, "uuid": "8ee80f16-bd77-48e3-9294-347571e7fce6", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588549, "uuid": "63eade78-2fc5-4edf-aa60-f37d2834fee8", "value": "2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0ca815-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623504, "uuid": "dcf1c294-51ff-442a-a4e2-44798189b8a3", "comment": "Malware payload (Mirai)", "value": "1d3e82025881445f63678b76e9e8587f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623504, "uuid": "392f412c-d1aa-4ae4-b7a6-b57174e049f7", "comment": "Malware payload (Mirai)", "value": "c16607af5b2c29cc13cfdb32428d107c37fb0a65c313fa69f76d404889be0df0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623504, "uuid": "9ebff47f-5ed7-49af-a1bf-b2deaa788a70", "comment": "Malware payload (Mirai)", "value": "f2a6b45e82fc2d8fa2407d9a23fd41de585f65de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623504, "uuid": "3f870525-4fa9-4401-9a63-234b2af96ae1", "comment": "Malware payload (Mirai)", "value": "e4aa2c348985e9507fa766b19d347d41a9f02835ae84a0849f128e2291fa455bb939fd63420fe81979837ad29e36fd0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623504, "uuid": "160a74c0-8ddf-45c7-9fc8-c57eea443712", "value": "T116F33902B30C0A47D2632DF02E3F2BE097EFDA9121E4F641651F9B8A9672D361585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623504, "uuid": "9db98971-5527-46c7-a5fa-d9608563944b", "value": "1536:6W3bmyGKnCcQjYpmtesxgDVT5XVmDKgFi+tk7glvAbR4eTGPN+ErQqZPE2IymQYq:FLm3Iy4mtpxAV/CFiok7nb1EW6hh1XDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623504, "uuid": "73ee90f7-d588-48bf-bc64-83a2923964cc", "value": 158744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623504, "uuid": "9b49bb8e-b949-42fb-93e4-3498d2bfd904", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623504, "uuid": "8eceee56-47a3-4043-b2a0-ae3be1200b4e", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "181d33ef-bce2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762633970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762633970, "uuid": "b1046827-2358-4684-af2a-8e68db9ece40", "comment": "Malware payload", "value": "51c2b98cb7ac92f83be33b50ae2070b3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762633970, "uuid": "0228f96e-03e0-49bd-ad1b-3329383be8ba", "comment": "Malware payload", "value": "c20806aa1b652a292bbfb254c6c0285f01a2afd21ba6edbe9e53d61f9a172e65", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762633970, "uuid": "1a6990d6-01f3-4369-982f-d349b29f51de", "comment": "Malware payload", "value": "e2d99ffe92de8d829282fd5c94171c1e6f8eb446", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762633970, "uuid": "c7730375-3faa-4bfc-a2c0-b6b389558b95", "comment": "Malware payload", "value": "3dfcfd5b80d34c3fd5ad71645a237821a30da28361b80b0d605bf1337bc3bd881af74aae435738af8caa04395fcc567e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762633970, "uuid": "3d36750e-2a1c-48a5-839c-ee54b1c589c1", "value": "T1C32132FAC4252D0638409E90E0AF15F4321E8FF79728AED5D55F362EE3982103426A55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762633970, "uuid": "ff905ea4-2bc8-46c6-b1a0-2c247b8534bc", "value": "12:Uaaov2alhLO2a9NI3+2aWfJAKoQ2aI2avTo3YXHWaD/e2aqR2a32aa2ayOt2aht:IomNICKQfVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762633970, "uuid": "b7674ef8-fc0f-4d38-9279-3377c8dba7eb", "value": 1190, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762633970, "uuid": "1c40b6bf-c070-4286-9d14-967d026c48f3", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762633970, "uuid": "4c1ab494-70f4-489e-86f1-7bcb95e51a6b", "value": "res", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf878080-bc9f-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762605501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605501, "uuid": "e708fcfd-b15f-45f3-92c6-3eae778ab488", "comment": "Malware payload (Mirai)", "value": "620b8fea6bfc9c5c32a0089106563219", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605501, "uuid": "b442454c-ff95-4c2f-8c43-cc32b7b22eec", "comment": "Malware payload (Mirai)", "value": "c20f4c1cc07e96517eda4bd358a32087435b39cb5ad44e0455cf423d9d6893fc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605501, "uuid": "d1d69297-6c1d-4b08-8f2d-4bbd4cd40c1f", "comment": "Malware payload (Mirai)", "value": "708c95da3941fb4d2ac910c18613ce6d97831519", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605501, "uuid": "01d25fdf-eec0-4545-afd5-ed8b4142cd75", "comment": "Malware payload (Mirai)", "value": "79cb56885ed95b8594d72ed65650b45468a63819ad56f6e7d8fd97b434c29b5372f7b2a5806bcd460275ec09a4ec4f96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605501, "uuid": "b93f072e-1c31-40f6-b125-9f71718a1f59", "value": "T1D0737CC5FA83D4F6E81205351277AB379AB3E53E2168CF83C379A676EC13502E91625C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605501, "uuid": "b69c9017-2dcb-4579-9bff-3035c2a31b2c", "value": "1536:+xWcbX4vYlTBOvtOOc4/72D2CYVNhXdCo0ZED:+kckvWOvtOP4CDLMddnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762605501, "uuid": "6456c935-fbc3-4168-ac48-32d5af3a2218", "value": 75028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762605501, "uuid": "088e9d6c-48ee-4a1c-99a1-85f323aa865f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605501, "uuid": "32fefcbd-cfc5-46cd-85dd-31bc3411e2d7", "value": "morte.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c1f3f32-bca6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608314, "uuid": "15ea0199-65d1-4235-9a83-071f4705c69e", "comment": "Malware payload (Mirai)", "value": "392080086c0540b0bb6a8ecd2ccd6f21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608314, "uuid": "bcc905f7-7e92-4057-86e1-f989e1a9901f", "comment": "Malware payload (Mirai)", "value": "c25c488236d609269476a2f123c41710cc769b5f34b249001ef5040de444fdc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608314, "uuid": "9b486a99-3b4f-4b31-9883-2919a6b1b841", "comment": "Malware payload (Mirai)", "value": "a021994bffdbbea7d5968acbab5ce2b02ee18ecd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608314, "uuid": "4aa61e41-54c5-4b6a-9fd2-068aeea94b94", "comment": "Malware payload (Mirai)", "value": "2ee69d09a73ff858929fe04933af9d5b067bcd6e508c99dbcf72335d4d75b8dfbc4ed14cd276e9b40540a2e703d9f613", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608314, "uuid": "58aacaf8-77a2-4215-a35e-a2af7eeaebad", "value": "T12A937E22B9791A3BC4E4A57B12F34332F2F6038A20B8961F7DB10D8DFF156A02657675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608314, "uuid": "45da66bd-bf63-4b20-8984-d4858ac642cf", "value": "1536:PZfQSZ36t5LtZY4n5NEz1fHeXgbk2STsKBtF96Ym5QdfAam4t6Ln:6jacWifXjfwYOQdAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608314, "uuid": "18c85eed-a699-4dba-a8f7-6a2cb3452e12", "value": 94760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608314, "uuid": "2470fda9-89f4-4c54-9a6f-c1d340ace4c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608314, "uuid": "cc89acac-c190-4009-8dff-538ec2508151", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4888cc3-bc9b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762603765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603765, "uuid": "83395b9c-af12-4763-84c6-029f9aae116a", "comment": "Malware payload (Mirai)", "value": "8979bb08b176d884065e7175302cda98", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603765, "uuid": "d9722add-05d4-441c-9928-26a844165499", "comment": "Malware payload (Mirai)", "value": "c35684e1f8ae1b48c827b26eeeeded88b9e9d0d6c081777e3da87e5b3be87d09", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603765, "uuid": "ec5578d9-6520-4969-bebb-c87e8a49a686", "comment": "Malware payload (Mirai)", "value": "b52e83e81134ce0f39f0adcc5c237fb64e8943d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603765, "uuid": "06a257ab-18a3-4b79-8d68-54cae283e3a3", "comment": "Malware payload (Mirai)", "value": "aec2bd50180f66f3c17a8d74d080d3b9b3a5e2d65c1d92f23814510e00d644fa5a2ef8ff125a78135a28a4ba5a243b63", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603765, "uuid": "59d01776-71c9-449a-993a-bdb01705ca84", "value": "T127932A45BD828F13C5C622F7F7AE058D37167BA8D1EB3203DD25BFA1338659A0D6A111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603765, "uuid": "76fac774-4cfe-4fbf-bc8a-a853b9fdc9c2", "value": "1536:QdhD4RzXSLqccSET0DnykOHhmyVJX6s0col0vHV6C:QdhD42qbSRW3HhLJ6WHV6C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762603765, "uuid": "74e2c0e3-ca14-410b-946a-c05cc6d7ef68", "value": 90680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762603765, "uuid": "f98df354-855a-4dfd-887c-0c997ad46045", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603765, "uuid": "6f7c3296-29f1-4556-966c-df822cb0dc17", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ca9d11-bcca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623631, "uuid": "fcad71bc-366b-4976-b519-eb29cb7d70cd", "comment": "Malware payload (Mirai)", "value": "369f7c47d9c2fdf90938b1c20a987555", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623631, "uuid": "04508398-bfe7-4295-b6f9-cee2ac7d89f4", "comment": "Malware payload (Mirai)", "value": "c4b30b86c940431bd16347d6af19d053bf977ea54aaa481b9c1e2a9b0936063e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623631, "uuid": "e8b3f32f-bffd-4df5-83ad-9850b007f00f", "comment": "Malware payload (Mirai)", "value": "ab3f2c021912a818f4e1cc43f48bfaa09bfa28fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623631, "uuid": "a1e61935-8a76-4550-828c-44c495702011", "comment": "Malware payload (Mirai)", "value": "ca17db30aa6b7b132049fa0d30e322747a2ca0dae717f6b9c1273d48111c030fa9f911a94784f4c183da75422f17c84f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623631, "uuid": "8fb3358b-3254-4c2d-88aa-67d87bed5bb7", "value": "T17923F10B82FD19C0D53611B84E7E269E9461FA9F57800E637EA43117B72BF30E578760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623631, "uuid": "d288e7ea-39ee-4ad7-ac32-9027f940c579", "value": "768:JessG0aMqhT6G4SMYpF9/JNg6Jtv8qJUZybFn1TwW5+95coFIGHEb/afnttWZmrI:JessLkSYpF9JNg6PEqJAybl1cz95cAId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623631, "uuid": "5daaeba5-cd9b-4bca-beaf-4ea244b58152", "value": 46724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623631, "uuid": "ef935483-ccf5-4824-827d-65dbb9b1c4a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623631, "uuid": "1bdad75b-5532-4dfc-afa3-08a41784f5cd", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71865f45-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620376, "uuid": "7dd5c42d-b347-4850-b17a-e9a8a9c44938", "comment": "Malware payload", "value": "a73ce898619e024c99ddcee1ed6b8d6c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620376, "uuid": "129e5e85-e382-4e16-8fb0-7067d7071a19", "comment": "Malware payload", "value": "c4be7807d54ca0af99f7b225b44e4fe1e34061172d76fb7e273a47f40c451bb4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620376, "uuid": "a84d3370-ed9a-4b02-8d31-ebfd562940d7", "comment": "Malware payload", "value": "c08a4f8782c8072ffe95151fccc947f2effb503c", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620376, "uuid": "80bcf0ad-aa7e-4a97-8ede-de87d71738d6", "comment": "Malware payload", "value": "d4e24449edc22694feb09e5bd7d56bafa4e1e48f091feff8c7a81ced340ad1d59e607e1c49f4bfe602f9d6597f913dc8", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620376, "uuid": "4442a24b-a3c2-423c-b9f7-de078c8c5e28", "value": "T1B404D0B730B7F1B985F7469620952049A3A41FE7F7105016F8DE33C19BFAF91A86222D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620376, "uuid": "f0f616d9-69f1-418b-9163-e7ee73e432e4", "value": "1536:dZ/P5lJj+TAmzxRKOFl0+WQA5PG5H8v7VR00GfNRl8ZkfFg7uKjmNF:bP5lJj+ThnWQA5PGmjmNF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620376, "uuid": "86deef3c-1e21-4242-b4be-5023e13102db", "value": 176080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620376, "uuid": "60de9e91-1710-4883-b581-0a00c9a3705b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620376, "uuid": "5cfb55f4-ddca-445c-ad08-454f2c5eafd2", "value": "NO-868870-07989-06878-08608-PO# 37600.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56701315-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620760, "uuid": "9c177838-88ca-4ed5-a95d-fa8cc605a702", "comment": "Malware payload", "value": "7ae077d8ac3ecc449c7d0dbf0e474f85", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620760, "uuid": "d57c12c4-6075-410d-b409-0d82175bee38", "comment": "Malware payload", "value": "c4dcad1528dc32272093a347e9db9b23d7f524d1da027923c0b8d345b00aedea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620760, "uuid": "05d34c61-ba04-44c4-88cb-0d0b6d1b4695", "comment": "Malware payload", "value": "5296612bbf8143eca072414745dcb26902876a0f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620760, "uuid": "72977499-9327-4594-9862-519a0ae1237a", "comment": "Malware payload", "value": "68256a881f8aba9e901cb2b19e29438a01fe1580fd89022fce02c5933a6556a453d3a6c571187c31a8bdd95b094c2106", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620760, "uuid": "98169738-1d4b-41fd-8dce-3c4504c885ae", "value": "T1A0F252157BC0786523871F7B773FF8E5F92E095A7A80054BC12ABC84A165B27DEE1832", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620760, "uuid": "4c1a7379-ac03-4927-a990-d2495c4f6321", "value": "768:peaLdihUsGDLtnrY3Kx3UmDo3/W+b0VkRClHBug5scax34Rh19/E/K0Zoz4jM/ml:reX6Z7Q8Bhj7wrZtTGEhnN/UrxL3vPgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620760, "uuid": "07c838c3-39c5-458e-8c5d-0e38ed20ea93", "value": 34329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620760, "uuid": "70b68497-f49b-4ecc-b2d6-ee3c56ba58ea", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620760, "uuid": "865afc33-7e1c-482f-85a7-a1e1cb78192b", "value": "Request for Quotation.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5392142-bca2-11f0-91c6-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1762606799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606799, "uuid": "7a6b94ef-044d-419c-a914-84f5b3168a17", "comment": "Malware payload (LummaStealer)", "value": "40a4a1d97df629dd255543357db55ab8", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606799, "uuid": "7271660d-882a-4418-b72d-cc8a78777483", "comment": "Malware payload (LummaStealer)", "value": "c4e1711c4029933d1a4ec238edf1de5b275e73d7422305447742e5b713a478a0", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606799, "uuid": "79ce7ba4-792c-49ca-b5d8-74eb3bc05a70", "comment": "Malware payload (LummaStealer)", "value": "ba3419ee1e8c5cb081831a593ba97d7c923d1f2b", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606799, "uuid": "6f155370-327d-4b46-8546-5dbfd0ce668b", "comment": "Malware payload (LummaStealer)", "value": "2848ecd68a9aa9b16481f9004dc96d06cef5867adf83287a4ada9e63947c9ed1fe82bf419a8de1e9944a11af1409c45c", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606799, "uuid": "d2a6b81b-644c-4408-a17a-10476b1cdea4", "value": "T166652356EADC80B0DCF952725CBE16C20A38FD621721AACB7316A00749733D7E679F85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606799, "uuid": "5ceb093a-2615-4a41-b037-9aa630889e7b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606799, "uuid": "7711b540-0de2-41bf-bfd3-f5da74a604ab", "value": "24576:u/yNFIZRQvMvnUvCYCJSlKe5G2AxarMok3aYZa1KeI5gKMKGMUV+cs:BNFIZRQvMvn7YCEl7U2AloDYcC5gKLGa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606799, "uuid": "d60242fc-ef7e-4494-9349-0a028799d4d4", "value": 1438320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606799, "uuid": "936465f3-b863-40f7-a821-b2233f4f8205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606799, "uuid": "d1a9d4de-bc3d-4084-a944-e20ac4af4240", "value": "Pro Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc047ab-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762588962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588962, "uuid": "b950d09c-fd7c-42f4-b046-5dd790d85437", "comment": "Malware payload (PhantomStealer)", "value": "cfc611c019cd194c1241df6a0d5f46c3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588962, "uuid": "2f0d847e-a097-4cfb-ab13-09321cfa072c", "comment": "Malware payload (PhantomStealer)", "value": "c5c022414d03e2a097acc3be07b571e83be567313610c4dacb97a153c6a878dc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588962, "uuid": "77929d5d-9358-44fe-befa-a3f18844ca4b", "comment": "Malware payload (PhantomStealer)", "value": "3f531d501cd2eae3f4e8fe0b986f2406a387d6ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588962, "uuid": "ffefe586-c87f-4f0b-a2dd-02c6ae5fe2dd", "comment": "Malware payload (PhantomStealer)", "value": "f60ca50ca864ba3c8703db3fa193ffd02c2127194ac9b7bbb44dfbeba2e98a878857b06b91baa44a19d8df51c8a121bb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588962, "uuid": "300c3fdc-926d-4ed1-9a58-7f534aafb3d5", "value": "T19B26127605F536A3B0A948905AF42DF452EAE85F2D47D02C3348AEFEC7956EC4887738", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588962, "uuid": "28c3b060-7ce4-490e-bead-9c3c43da23c3", "value": "384:pddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddj:x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588962, "uuid": "59d79971-8e79-46a3-ada9-8a7663514dff", "value": 4456000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588962, "uuid": "5febfea1-91ce-4724-8009-0200d86ccbe9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588962, "uuid": "c43f362c-cf1c-4e57-8ca8-236cfe27a83d", "value": "RFQ-BRDECO#2010051125.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46f4b767-bcf7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762643068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762643068, "uuid": "24e5ed45-0617-4198-bef9-ea50cdf24b00", "comment": "Malware payload (Mirai)", "value": "7a20c3c1c674f09b596bc35681844b21", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762643068, "uuid": "b23da8e6-6db3-4e00-b5ca-43fdc8ade530", "comment": "Malware payload (Mirai)", "value": "c5d8a19b138060ead696eab8429432dcc9856d3b35d38a110fa7f8b90be9c4ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762643068, "uuid": "b419cd92-04c9-4eae-a54f-b2ad931a530e", "comment": "Malware payload (Mirai)", "value": "3f52a3186610f4098a9defcbe1b247008093b44b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762643068, "uuid": "509c3e8d-6bb1-4845-81a6-e7df2f8012d8", "comment": "Malware payload (Mirai)", "value": "ed2642c27a203aca678cf1787ea0099334cb9c960b285b4e30a67a550eff5ac29b0c7c93ae55276f37836f01b16892cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762643068, "uuid": "dfb21e96-3342-4036-a325-0a81a698fe7d", "value": "T17013F19FF2BC34E9C86C9A7DA00F43F76A1071C12116866CD511C6EEE38FE4AB44D42A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762643068, "uuid": "faf57488-f1f9-479a-bf87-d131774c0600", "value": "768:6tq7RwmfWPQ81R6F3+ajYSeDA24U2Ch29Qwpqd3gDOiGWHO:aeOmmLSNpjYSeDA24Ubh29HAdwDOsO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762643068, "uuid": "b8ed85bd-2d87-4138-8647-4dc3be95f935", "value": 45200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762643068, "uuid": "f46c0626-1362-4bc5-b567-e09b4bfc4d65", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762643068, "uuid": "b8963ddd-d63c-4f38-85b4-9307faedca23", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eadc0dde-bc87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762595239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595239, "uuid": "561d0c49-f51f-4c08-8b08-f2ffc113ba40", "comment": "Malware payload (Mirai)", "value": "c46ae67801a60d42a6c7b3ba0364adda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595239, "uuid": "52d06669-8d7d-4098-9515-0a52f03e3312", "comment": "Malware payload (Mirai)", "value": "c681545d9bee08edc2f7220ac4278c9f2d8e53f35a54d784e7910d7b3f5bad12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595239, "uuid": "36ece80d-70dc-4fb3-9129-d21e6136eb63", "comment": "Malware payload (Mirai)", "value": "26dacfa8b92568f2061960641feaeef3130ba72b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595239, "uuid": "4842b5d1-a481-4068-8772-1c936818871f", "comment": "Malware payload (Mirai)", "value": "1f084e6c0a80b4daaa4628b076a41bce3058ea1fe0b5ecfc5212c669fb21e4238159ebcc10784841d8dd766fbcf50c56", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595239, "uuid": "92021cd1-6b63-4d01-91e2-5c48374d8cdf", "value": "T1EEB3A50D7E258F7CFBAC863547F78E219249339A26E1C684E16CE9021EB034E745FB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595239, "uuid": "220aa58e-d575-4415-9f49-44f8c80d3b6d", "value": "1536:etA9tODpEJqM9g08qaORdX1XrWr/Lenr2TtbV+HgD/zl/OEfnVTKp25j6X:j9UtEA+h8qam5rWrbr+Hgrzl/OEfnBs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762595239, "uuid": "63080693-6a92-48db-a09e-4e62986188d1", "value": 108880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762595239, "uuid": "018f4a97-5e87-4e2f-abca-770f55fca636", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595239, "uuid": "b368c543-4823-48e3-9845-ac99ea7c3830", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b43645-bc78-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588525, "uuid": "4693bf56-589c-44bb-a3ae-b1edaa06e9e2", "comment": "Malware payload", "value": "2ae84c1fb79a0db74694fc13c19cc1dd", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588525, "uuid": "0f6b8fab-9f96-45e0-9008-70267dc10bc1", "comment": "Malware payload", "value": "c6bec8d1f55ff42539bdd55176ff968a33c43c37eb013b2133224697687d0fe6", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588525, "uuid": "55dc2d68-3c25-4a3f-aa17-f8f86a88a3ee", "comment": "Malware payload", "value": "80d6a61ba1c2a09b477d3e85e48c0d3fd579a6ab", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588525, "uuid": "34a460b5-f4bf-4808-ae81-3de88c81c77c", "comment": "Malware payload", "value": "c7799afd26cf82409568645036c4682367b00a2151340435a9cde3aa97596cbc589e98609aa3bc59225c6c1038238ff3", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588525, "uuid": "2632a3e2-382c-4795-9567-8e0dabee3ee2", "value": "T1DAF0DC751C820B8AE1899B3B90B35B02EE81EEC833C63A9D584E02050D04700A8A60BF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588525, "uuid": "4256277a-d148-4a64-a2de-e12c3bd16650", "value": "12:8O8wnk0D/+WcLlFmpXP80jkJEqI1acTJ6g8qflD4E1:8O8wkLwjPLn8K1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588525, "uuid": "f62dde54-81ed-4468-b4fb-60f5732a5639", "value": 564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588525, "uuid": "601bee0c-40bc-4024-8181-865a0cf76b83", "value": "application/x-ms-shortcut", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588525, "uuid": "22f9254b-2c1f-4416-b63e-21b709e32905", "value": "Belege_Rechnungen_usw_2024.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5cb165-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602355, "uuid": "73865f34-26bb-4fad-9e23-ac9ad86df1e7", "comment": "Malware payload (Mirai)", "value": "44f52b0e6e839e540f6791f7064f1c00", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602355, "uuid": "bb56e4e5-3734-4dee-af59-63f1b13304d9", "comment": "Malware payload (Mirai)", "value": "c70cc4d31ea46af852fcab87b8fa32459542824e37ea8b4cf0f3aca554398364", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602355, "uuid": "6e004045-79ae-4083-a1c4-934a5bc0202c", "comment": "Malware payload (Mirai)", "value": "dafc90070fb1c685fb104e3e3be35cd3846eea7c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602355, "uuid": "956861e8-779f-46f1-ab57-422092e2ed4a", "comment": "Malware payload (Mirai)", "value": "823b1282323beef679e50da2543e1c404a2df8713fc1059fcc18d1afa8a56fa789ae38126b121f021876f269dbf3ac11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602355, "uuid": "32037514-8754-4e00-8eda-a39f1db4b0e0", "value": "T138731991B8919A13C5E023BBFA6E418E372553E8D2DF3217AD215F2477C681F0D77A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602355, "uuid": "9f437b30-2470-43c4-8258-834d0a5ff80a", "value": "1536:/2Z45De2FRCt0enIJ7YbMvavR5j+paxL33A5pmM52IMHXQBHrd:/2ZgDjFosqh+pah3QnH8zHXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602355, "uuid": "5b78390e-32e3-459d-87bf-f3e78f20aa17", "value": 74748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602355, "uuid": "6bb73f8e-a536-4ca3-9da1-3415ac8f92ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602355, "uuid": "e635c358-0df0-46c8-86fc-56a40caecf70", "value": "kowai.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f0c01e3-bc94-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762600588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600588, "uuid": "6e27435f-120a-4902-9bb4-0ec203057c32", "comment": "Malware payload (Mirai)", "value": "52e7847a974513766e1ec986f87d1147", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600588, "uuid": "7ab411b0-2f07-4ffc-a047-42bd7e60e05d", "comment": "Malware payload (Mirai)", "value": "c7cb9fea53983c904fc7726ddeddf692bbce9a7661970c5332306ffff357f86a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600588, "uuid": "f84cb952-69b6-43b5-9289-01d0a6c50ba9", "comment": "Malware payload (Mirai)", "value": "13196e690b326d8a5bb2c85d5a7bc336e0f227dd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600588, "uuid": "127abd00-1d31-4177-b479-b9ae86017143", "comment": "Malware payload (Mirai)", "value": "b59c299f3d4a059dac18f83f1c9100c3f2c8cc4cdf9bb1bb31c5e711e76872787ec93586d9ea532e67838eb09aaffd6f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600588, "uuid": "9fcfdaa0-8cbe-45e2-9052-a292d08ca272", "value": "T175C3E849EF950FFBEC6FCC3706A90B4524CC651A22A83BBA7574D42CF60A14B16E3974", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600588, "uuid": "6584452c-fe55-4c46-9d65-698809319173", "value": "3072:IMjMq8gL0Nxikm5CaGk+okUqWghu9wHbf0:IMjMq/L0NxikmwrVMqWghj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762600588, "uuid": "64046440-c482-424d-849a-a835bc5a0dc3", "value": 123812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762600588, "uuid": "f7fdecc9-8e11-4922-90f8-c234df4527ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600588, "uuid": "e80ea539-287e-4865-b8c4-3c478c8eec6a", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5624ffc7-bc89-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762595849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595849, "uuid": "ea02f58f-5659-467f-adfe-3d9ec7a8a006", "comment": "Malware payload", "value": "3c5f97f6f84ef47b56b7df32ba08265f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595849, "uuid": "61a2b6e3-8c60-4b74-8048-9407b0c7e422", "comment": "Malware payload", "value": "c809455732654c98bc433606ecf280c15a6fb47bcd4dfef0d1308f6fbfd9c91d", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595849, "uuid": "348d8779-48f6-44f6-863e-854978f87284", "comment": "Malware payload", "value": "56ea7940ef1e55c1d7907612c3f8d911d6d484f8", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595849, "uuid": "e0055ecb-877a-40ae-8bbc-1703e6399e70", "comment": "Malware payload", "value": "234e6d1397fe5ed1eaaad1899ae1d412f2b43afa8ae796b6860a77bb36f4d6373f3a8abb6b084d27a24be009cc92f46b", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595849, "uuid": "321fc568-1287-4030-8164-e12f1b883eef", "value": "T1A2B185572D9983080170D3B2A63C02E4EE6DE2EB471176CD3568CAAC1B3D29BC5DE9DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595849, "uuid": "e0a20fe0-9932-4dbf-b81a-e69bdef15aa6", "value": "96:g+WEPbpZQ0GNmoLVNG+eyT7CJ7W1VIFQCsJlr9cN4njnVlka:lNc0ohG+eM7Y7COFpOp9S4jnVlka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762595849, "uuid": "dc8c6d0e-c2e2-4485-821a-793ed94ee6e5", "value": 5350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762595849, "uuid": "46f8fcc4-00d2-431a-b52a-2ca82731e928", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595849, "uuid": "a6429e0e-853b-470a-9756-28f990f0f1ad", "value": "tmp3A1D.tmp.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebc06fda-bcb8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762616286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616286, "uuid": "81b3f137-3b68-4504-8407-680ad660b2a1", "comment": "Malware payload", "value": "f5859c25d0e734bc7a2bd2c6a08f50de", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616286, "uuid": "d170995a-2775-482a-afe9-6efa75af588d", "comment": "Malware payload", "value": "c843644408a2827f80c5fcc62125fa9adacea41b7ded4559c3a2742754e7b37c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616286, "uuid": "a3d60ccb-3aa7-419a-bf78-adaf6e87b7c3", "comment": "Malware payload", "value": "e12c91a8f376f634b0ad64e9fba47a36c1c41e28", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616286, "uuid": "a70850dd-0cb6-41bc-89d0-5ee1425acb8c", "comment": "Malware payload", "value": "85ab47d57bd2c144b5fc7bc4f0bc65033ba77b0f4d71cfb8220f9c5671ccd5828f2d87fbfd1f7c30d44c511dc03c8ab9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616286, "uuid": "d80c58d9-a71c-43eb-811a-4ddf992a340e", "value": "T1D2661221169E6258F2FE69D66B114513F7C2C6CF53830DA7F872CCCAB2F14249C75AA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616286, "uuid": "21bb976d-5ac3-453e-a342-0ee2b95a528e", "value": "96:Wgv2s6DwoYk0DSSc23FW2mVpjor/gIl1HBCnnbBz5k:N26okRAoQbnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616286, "uuid": "41b3f080-5036-42ac-9276-50c689900649", "value": 6535850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616286, "uuid": "d4ad80e3-b265-447c-879e-0aa3ec02b965", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616286, "uuid": "e5fb7b67-fb34-4769-96de-0cd437d3cf70", "value": "Invoice details.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2455df47-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762588893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588893, "uuid": "edbeb52f-e907-4d70-8fae-37b9560676c8", "comment": "Malware payload (RemcosRAT)", "value": "4da8a2477833c840f479e1c0c2fd5d96", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588893, "uuid": "4bfd26d7-1dca-485d-a1c3-89d8451573f1", "comment": "Malware payload (RemcosRAT)", "value": "c930d0c996f5d83b962b986c2bf9bb3c1fcf5761341fce85c1235d7fa8b4496b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588893, "uuid": "2596295c-1ab4-43c3-8402-c70dc651d2d1", "comment": "Malware payload (RemcosRAT)", "value": "43a53a2dddba4239c8c22fce1df1475636a43a82", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588893, "uuid": "0fbb1df5-8448-4245-80c9-7a0ea243f49a", "comment": "Malware payload (RemcosRAT)", "value": "f2744fd0b5b61e6566f76bb76e82a84b95fe0ef9f7120e4358c07c8bd0d7c585d243f087d94c92f8a24efe88bacfed59", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588893, "uuid": "365b20fe-ac24-43c3-82c3-1267fdec7e1a", "value": "T1986612620A8A3BDA4211CBE15F00D6CA73A995CFCF915E3DB41878EC5F53D11E0BAC69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588893, "uuid": "0cfcc7a0-e103-4638-ae50-81c4ebf26bde", "value": "96:0XFTw+llobKe+EK3x4s/az3Wj/mAT6qhFMP:nqrW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588893, "uuid": "06709784-72d7-4390-9168-ed84795389c5", "value": 6718197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588893, "uuid": "3f2d7763-f8d2-49e2-99ab-b61a557f7ecf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588893, "uuid": "8fe451da-fee9-40e7-aff0-6258bf8ba5c1", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b033bb4-bcc4-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762621251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621251, "uuid": "d16c424a-8261-4b6e-bdf5-b73aade9b1d0", "comment": "Malware payload", "value": "325e49b504cc47e1f16956ffe1772795", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621251, "uuid": "eb0cd01f-f85e-4e06-84a6-a4f4eec1944f", "comment": "Malware payload", "value": "cc1dae253b72906cfe2e89c278ab45a9ccc63567919373de7600783a05dd6d0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621251, "uuid": "bc80a199-357b-4dd4-b6d0-bed7bb7ce624", "comment": "Malware payload", "value": "2829933453c404c3fddcc1e349146ad32d1f0ae9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621251, "uuid": "0e71adb5-5df6-451d-a8c2-980a31e08acc", "comment": "Malware payload", "value": "5ca11676f1adaa397bed75da218fab0d35dc142c9b4fd4d0bd533de68ef4fa2a2357001f6d9bb287c1f3a4fdfd9cc016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621251, "uuid": "ec13710f-a894-450c-80d4-ae6b00f85bfa", "value": "T175B43B125FA95254C176C27C23D7EB27E2BA3C499628B2BB48DCC70F2354A0A76DD713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621251, "uuid": "6680b08b-27d9-431b-98fa-89fe4cee7ab2", "value": "882bf2f04e2cb085a1e6b562ddee142d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621251, "uuid": "cb7328d3-f426-46cb-a805-f80bbaa9912e", "value": "12288:BEaHBVGTAcf4sPopWWd/xmJlIcdjbqS/osJGC8:aKBWfKkIxgjdjPoswj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621251, "uuid": "7bbefe79-aae6-486f-a5a7-df97791bfca9", "value": 502144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621251, "uuid": "2ce8d65f-a3bf-426d-9c5d-6f335d409c01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621251, "uuid": "2dbc77e5-e92b-4783-9227-a90f31d8c883", "value": "AnyDesk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1fb4293-bc40-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762564757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762564757, "uuid": "4b8dace5-3666-456d-912a-c5c73cce2942", "comment": "Malware payload (Mirai)", "value": "b127a7f389ecb88baf8cabce14860cd4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762564757, "uuid": "f1e83226-d7fc-4b74-bb43-973a9390c6b7", "comment": "Malware payload (Mirai)", "value": "ccb82abe31dd2edee077e824f883d31939e4a829607369241340d01d686537f3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762564757, "uuid": "54dc11f2-e918-49fd-b00d-91646c3c2417", "comment": "Malware payload (Mirai)", "value": "470d40ac2f78aa85962d75dfc5e7ae74bd3f7110", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762564757, "uuid": "db83578d-3228-4f11-8ce7-10f7740b774e", "comment": "Malware payload (Mirai)", "value": "c127a1599cbde487a509d5febf5ee24a946f5846a7d3fbd85142f73cf60f49f5f126bb67c8089e9e188cca624d1a72fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762564757, "uuid": "34611eae-85de-428d-8b09-87a21e9d9838", "value": "T18B834B47B9C0C1FDC899D178477EA136D433B4BE0239729B63C8FE276D0AE605E2A552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762564757, "uuid": "aae32e52-7797-47ab-8124-845d9ee66b41", "value": "1536:cPk8vzohTn9A6qMA8W9+/Bzlkv9U5C99sey9jh+:cM82TnCLM09Mzlkr99sesM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762564757, "uuid": "7b110abd-051d-4bc3-8243-42a18be7ed3b", "value": 84208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762564757, "uuid": "93fe36cb-8941-4c50-89ba-2557f345db0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762564757, "uuid": "284abd8f-efc3-4570-ac2c-7210308ee053", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99dbc96f-bc44-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762566327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566327, "uuid": "7ac69e2d-1feb-49b3-8128-dba899ed9d65", "comment": "Malware payload (Mirai)", "value": "9bd2061ab1f3f7411f8326569f1b240f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566327, "uuid": "bf29fcfc-9572-4965-9e6a-955ce122ac8b", "comment": "Malware payload (Mirai)", "value": "ccd059163d890d202c4ee988495dcb3fb7c1d9a9e44e7caa62cb897fd4f5b8e5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566327, "uuid": "3fd8a209-effe-4f3c-9e3b-25aeb5c050c8", "comment": "Malware payload (Mirai)", "value": "5faa13cedef0a6ac76c2d24bf96d68fcaef75548", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566327, "uuid": "e9cbc96b-5aac-4551-9753-206b3b2f6062", "comment": "Malware payload (Mirai)", "value": "9a6d68b5db0d086a1b0fe840211d6b5a271f48ed91671c9d882ef6aee86d71196eaa5b5915b1c3523eda68fd5ab29080", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566327, "uuid": "9a81a313-ed32-4055-9270-9a48c08ff099", "value": "T19D03F139C3891EF4CBF9EE73DEE4E6C8BB418B4B5772894261CA6B42911241BD281DD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566327, "uuid": "c30f3808-dcde-4da7-9a09-de66bfb0d5c6", "value": "768:hHyTlJgXCScbxuqoElt0/8hJlSjh5ZC0xKUXu7TkFMNhf7aVWBEz4uVcqgw09c:By5JgXCScIqoEr0/8WtsUXu3fhjrBw4m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762566327, "uuid": "d8368a74-bc67-4dc0-9526-e03a4e75ac97", "value": 39996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762566327, "uuid": "bc23a5c1-7aa8-439e-a330-45016cbffd08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566327, "uuid": "371f2e39-31ca-4c9f-9e8b-b1608bce398a", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d972d2-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602477, "uuid": "021a95bf-b4b0-4d8d-b7cc-1e6347d95e0a", "comment": "Malware payload (Mirai)", "value": "bbfb458b2d67e28d17f3dd62187e2215", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602477, "uuid": "fe4a0e53-0718-4a21-8a65-40840125dace", "comment": "Malware payload (Mirai)", "value": "ccda041dd191052afe78348e5a3bb2683c5eb27836573cf547b98991a2605f75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602477, "uuid": "39b8062a-5b13-4030-9495-858b5a04cfd1", "comment": "Malware payload (Mirai)", "value": "483ec23c3d0e332de2dba9e0ea962bf42de6ab86", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602477, "uuid": "be8f216d-d726-4df1-9028-ba269b0c0263", "comment": "Malware payload (Mirai)", "value": "c71d4b0049d13f92c99a347e3825cbcb9845efacc67a6312aad0382c2380c7f683f4e537d070b0ddd020e06a98a3169d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602477, "uuid": "741fed8c-609a-4a92-9896-0526437b1cf6", "value": "T170631B95F8818A21C5D5137DF92D168D372227F8E3DE72139E205F603B8A96B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602477, "uuid": "3fa96944-d94c-40c2-b97f-760c094e23f2", "value": "1536:hgnAkIP7B9stYVenVQmEct8URqOSQHMgimu2aa7LLJa10ft:ZP19st6en6mEcEku2aa7LL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602477, "uuid": "080d409f-9e22-4672-8c6f-24c21a67ce04", "value": 72264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602477, "uuid": "e12098f4-b273-400b-b295-8d95c1956a82", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602477, "uuid": "72f2682f-05f0-4ea3-81a9-4ad38d4d9502", "value": "uYtea.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5696ae01-bc8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (SalatStealer)", "timestamp": 1762596708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596708, "uuid": "6186e4df-8558-4160-becb-9cc349e39a0a", "comment": "Malware payload (SalatStealer)", "value": "5ed974285dd9ee8a47c63bffb8821e6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python/Kryptik", "colour": "#AAA39E", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Trojan.PSW.Stealer", "colour": "#7C2154", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596708, "uuid": "aa06bf36-fbfb-4f2c-b4d7-1f3f21676aa3", "comment": "Malware payload (SalatStealer)", "value": "cd0bf1d2c7b3f9f72c28a04d1eaaef0088ee35ed1e61d73bb8002e1a81330eb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python/Kryptik", "colour": "#AAA39E", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Trojan.PSW.Stealer", "colour": "#7C2154", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596708, "uuid": "a54db0cc-1f87-4a53-8802-ce3c2db2e2a0", "comment": "Malware payload (SalatStealer)", "value": "819f21f5b9c37eb26f69208b262565843766ed17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python/Kryptik", "colour": "#AAA39E", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Trojan.PSW.Stealer", "colour": "#7C2154", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596708, "uuid": "5429336b-9192-4fbb-87d1-40043963e3e4", "comment": "Malware payload (SalatStealer)", "value": "677eb22655dcc15a47cf0311df7c768486a69d15c12b84ecd7697269481e932e49a668233dc1470f9416266641db97b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Python/Kryptik", "colour": "#AAA39E", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "Trojan.PSW.Stealer", "colour": "#7C2154", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596708, "uuid": "9498e319-cad4-4229-a89b-0278b1451f78", "value": "T1A2C63318B7E904C3E9BB823C4872011DEA213C654B71D68F13D476AB2E673E15D3BBA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596708, "uuid": "a7677211-06a7-4a8c-a4bb-b74e298a30ad", "value": "965e162fe6366ee377aa9bc80bdd5c65", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596708, "uuid": "2d6eb3c8-86b8-4355-8937-40a152a6d50f", "value": "196608:s0oPpGV9zYEQX+UUvytPCUm5896FwSwGl7zj9AKm6gUU8gBk6vdQmRsIkaqdVTVb:QPpGVRYEQavEPUtwSwQ3GH6Yk4dQ3Iw1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762596708, "uuid": "d6a2be38-aef8-4a8d-bf09-939f1c868043", "value": 12112387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762596708, "uuid": "15310f05-f0d6-4407-9559-c06b02a183ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596708, "uuid": "465c8a24-9164-44a8-a1af-51bfaa8f020e", "value": "winx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8516f45b-bc5b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762576170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762576170, "uuid": "ad5c0955-2531-406c-8c8a-c2c1be2d8c45", "comment": "Malware payload (Mirai)", "value": "517f2ba4e0d531ba28f4830b9aed3658", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762576170, "uuid": "45c7698d-9dac-4c03-a124-0a8f42e43dea", "comment": "Malware payload (Mirai)", "value": "cd9995206d79c9ab9b8d8c2f155041bb6acd28e6a9db28f43b66ab7bb0d17553", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762576170, "uuid": "d28376ec-85fc-4a61-a192-48cf49213b52", "comment": "Malware payload (Mirai)", "value": "c0fe351d4f03593f9fbecf0fb9df25210200356b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762576170, "uuid": "740c4c27-a375-4f33-a7c8-fd3716321e4c", "comment": "Malware payload (Mirai)", "value": "019c919e8f6781fc96ae1b487fc2385f75e8281afa605620d2618fbcc31a7190043dd9377f00c4304308ca77b5949791", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762576170, "uuid": "2918cac5-185d-451f-a768-de5ceda83ef3", "value": "T15C933ACAB401DD7DF40FDABB4463490AB531A3511A935B3773ABFDA3AC321A44817E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762576170, "uuid": "a7f4f603-9365-40e8-abaf-9db33179b67e", "value": "1536:X9x1M/zQmDezf6wi4hnUUKSWUzB7RVGqHfY0iW0PU8QALXPU3EULbo5v/rXFgPSv:Xc2f13h9PxN3/liW89rpUHoNoSKJaYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762576170, "uuid": "dc177f26-bf01-4455-8d9a-274c3ea57476", "value": 95552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762576170, "uuid": "e819ff20-9993-4f8e-8c2e-ca96e486c03c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762576170, "uuid": "62d3c54e-0081-4e3a-af15-a1a1ce3c401c", "value": "morte.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09d1a9ef-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762620631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620631, "uuid": "43f1f3ad-2bfa-43c2-9a3f-7d5f49170cdf", "comment": "Malware payload (RemcosRAT)", "value": "1da6907e288136130821df0b239602f4", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620631, "uuid": "73a43066-0e58-4ac0-8cbb-f630e6c9576c", "comment": "Malware payload (RemcosRAT)", "value": "cdc3073ab709cf2284bde59c6927a44712b6c6b59a81fc79d45a51753a90e95d", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620631, "uuid": "5e25e7af-450f-47d7-9d25-b5553c0a6c1d", "comment": "Malware payload (RemcosRAT)", "value": "967bc83f2a9630ea1ef0db88a627bcc733513fc4", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620631, "uuid": "c4845eb0-57dd-42e5-99a4-c0b534199124", "comment": "Malware payload (RemcosRAT)", "value": "a5b1e94b14f9f88c1ce467f9e9ea6be5f73e32fce884b8cb7da7f615288fd25f356f8b2823b09623f5e599614128a041", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620631, "uuid": "48294f5f-75fb-4c74-8abd-92bc255c39d6", "value": "T19872337AA55CDFF00A3E21F005873D1560659317E83A8D2CF9DA8494BF2A7518FA78EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620631, "uuid": "576df6ac-6230-4d73-b853-6ea1e04c2ada", "value": "384:XXeXJVALGhxc8JavTAO3MpkfdkSdxgwaHD8sZ98a+wfL+pNrq0:WrALUaMQMmMWfPAD8k9XKjrq0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620631, "uuid": "5b84f91d-8c55-47a9-8280-b031a96453a4", "value": 16068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620631, "uuid": "54ddd438-d856-4636-a565-7327c0d8c53b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620631, "uuid": "121dbefd-730a-4785-b2fb-bc119340ab63", "value": "SWIFT PLATA din ordinul.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883e46c9-bc93-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762600228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600228, "uuid": "9e8ac8f6-80b8-477a-b9c3-799505e451da", "comment": "Malware payload (Mirai)", "value": "56c00e634a9ffc1a5ff56abdbaca8de4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600228, "uuid": "7fca9236-4558-4d99-948a-7b34e127cbdb", "comment": "Malware payload (Mirai)", "value": "cdd0883855da012ed5d7a16d538a8236a020234ab6cb385d30c441ab4067aadb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600228, "uuid": "00085da2-e55e-4da8-ab38-cf5e1e5e7d8e", "comment": "Malware payload (Mirai)", "value": "57ad8ff0d551ade14eb95f75878b6ff1c38d2d48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600228, "uuid": "10f71000-bbc9-425b-828d-94d7ccc484f6", "comment": "Malware payload (Mirai)", "value": "c127436cd65540d79ef4c39af2edaa4409fe28cc3c056044c042647564325c10a45c365653dfaa35dce50e4078168e5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600228, "uuid": "6a35f19b-b096-4db1-a9a3-006dc5ab823f", "value": "T1C213F13580995DB0C1282AF1A37D48D4128D13F9A5FFD1B22BF256243EB27B931E586F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600228, "uuid": "7c36384f-f452-4fa1-a5f1-d270dbb4ba1a", "value": "768:Szwnj82JCAzMR7fEL3tqKBiecFYPaNPZhboUAXYth3388baLK8hhpEy6OecjPw95:Pg2FMdcL/X2TPPbouzaLjhhpxpPfLlq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762600228, "uuid": "1d41150d-00fa-4b0c-8ba4-53ee376c386c", "value": 42980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762600228, "uuid": "6aaf4bb5-64d8-4bd5-a6c9-ace41ea757e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600228, "uuid": "09fdc4b6-9556-40ee-9e97-a0b9b76e6c13", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c9745ac-bc38-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762561097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762561097, "uuid": "3d247a10-5176-41e6-a21a-a01ff028db84", "comment": "Malware payload (Mirai)", "value": "187743bc9d348881e0c33dd3d310509b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762561097, "uuid": "16556729-3ed0-42c1-b6e6-e636b6c70624", "comment": "Malware payload (Mirai)", "value": "ce6fc5393519ea6105d54d61df4786cd0b44d0718f480baae745552768bace1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762561097, "uuid": "93d66847-3045-4427-9ed4-3d8c4c9ce624", "comment": "Malware payload (Mirai)", "value": "61d816e466778b1a420dec823e4789f032b86417", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762561097, "uuid": "633a0089-9190-435d-b6ff-527e9b436bc8", "comment": "Malware payload (Mirai)", "value": "6fe103f020d9a55050089d88cc1ee40f323d541e9fdc864b1930efa017fa0e97c1d29fa9df9c43dd44aa85e78c8bcbb7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762561097, "uuid": "c0d74d6b-2a78-443d-8cbe-376250e69d0b", "value": "T1EDB3D64E7F329F7CFBA8C23447B35A21A65923D227E1DA85D19CD6011E7024E681FBB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762561097, "uuid": "5550e76f-b344-4a72-83f4-0527c1ba3c65", "value": "1536:SkUa7xt8FyhmfAtOhNE6evz6qPt9/vEXSiy7APk2PK6e/BdHZ7NZ:sa7xRwI2E6eL6qPt93EXSiy7OkAKBZ7b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762561097, "uuid": "8c04d843-21c9-4596-854d-2c08fab0d9c1", "value": 109760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762561097, "uuid": "02000c1f-eb02-4ffb-99d5-1594539bef2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762561097, "uuid": "13db17b1-96a3-46e4-b789-b9990be1b595", "value": "morte.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15cfd5f0-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (STRRAT)", "timestamp": 1762588869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588869, "uuid": "83d6421d-aa9e-482b-8279-24f9529304a3", "comment": "Malware payload (STRRAT)", "value": "860bf5400097b5bf0fa7aa3c8c8c0632", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588869, "uuid": "a9d23266-91ab-4c74-9cf3-5dc25c7d2e1d", "comment": "Malware payload (STRRAT)", "value": "ce762a28832ba9938f3e05dd3d84b8641c8a66fa5d703987bd3761675f75bc4c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588869, "uuid": "4eae8de8-b973-4137-836b-b13ff4f878d3", "comment": "Malware payload (STRRAT)", "value": "83c5bb805e9ed7b9778af3b28b99f6a14e5c11f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588869, "uuid": "7cbafffb-7452-4063-9ceb-b44cb4c84da3", "comment": "Malware payload (STRRAT)", "value": "2a56ca077feb365ea258cca1e30a8ce4dcc6c912592f6ab37454bcfde33488d03b42c1a8df6ff8fd3b0e3c6c1442676f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588869, "uuid": "d11d0288-42e2-446b-9d26-ca4c025ae8db", "value": "T1C0042217D13DDFC9480495A602E74F167FE60AA2B80DACAF27BE83460C07E165B7F444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588869, "uuid": "c25e34ff-cda1-4172-83d2-e1ab05e2c02d", "value": "3072:1dgghvjjiK5ywxblLGC/3+lK95QwMjyAJxXDXS7wkLdJiiT5JFm1mD/kGNJwXdCI:Tggpi94pLGM+VDRzDpkLdPT/FomQO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588869, "uuid": "6458664b-5a85-4e0a-89f3-2215bc05981c", "value": 189474, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588869, "uuid": "5d0a1688-c91f-496a-a896-9e7662fb35c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588869, "uuid": "00daf258-cf37-4a1e-999a-906c222d90a1", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f57aed-bcb9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762616385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616385, "uuid": "94695f5b-1834-4d3c-9cd5-fd74d070550c", "comment": "Malware payload (Rhadamanthys)", "value": "3d420c86ac253ec579178922f1d03475", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616385, "uuid": "5e3b8544-7667-4d56-a466-dd07611a86e6", "comment": "Malware payload (Rhadamanthys)", "value": "ced20a3231bf3e66484b9905571a8ab554e94470dc4475c7059256c1432c988b", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616385, "uuid": "a06f336f-9776-44fd-9e59-cad2286aa57e", "comment": "Malware payload (Rhadamanthys)", "value": "3db2659d1c8f7e6abfeb2a41bda07394c83484ce", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616385, "uuid": "b1f2841b-34cb-4d79-a356-f46f4ab5168c", "comment": "Malware payload (Rhadamanthys)", "value": "0533e476821ec63a8e8d51b9ffe08eb15d71d6da747ccc153f67b054d8900ddd3f7814a3bcab03676001d4c34f6c9c28", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616385, "uuid": "1710da51-67c3-4300-80fc-9228497b30b1", "value": "T18F065B537C518771C8AAE13089B28195B6607C480B743BD32B177EBBEE3B7C49A36758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616385, "uuid": "0a193314-7897-4a74-840c-31d81ac81c3a", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616385, "uuid": "66cd3f9d-7793-4e8f-b53f-eb5a02553c4d", "value": "49152:wOSidZ0eyYrOzqk9IGWqwOrDyNN2e6DATfxYnqiyxRsEq9gEEkwsbPnD1:l7BkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616385, "uuid": "e4767095-81fb-4c27-b1cf-e56bc739a46c", "value": 3670528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616385, "uuid": "4822195c-bbec-4a22-91fa-c73492e0ca30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616385, "uuid": "04473d35-79ba-4278-90e7-dda8b1706b6b", "value": "appFile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f323fc6f-bc9b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762603843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603843, "uuid": "5592d8ac-8b5b-4151-a142-251940eee421", "comment": "Malware payload (Mirai)", "value": "82639baa3b2a8f06d4674d3d098a7026", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603843, "uuid": "cea56031-2dba-43bf-9ced-1f20ffc79bf6", "comment": "Malware payload (Mirai)", "value": "cf1fdbd9a51190d5bf0e15766cec1e025b992f9970189b557631f1a1798ef51c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603843, "uuid": "e3f68f30-fd14-433c-8074-ca48a19ea16a", "comment": "Malware payload (Mirai)", "value": "229884f96f08804a4b2eb18be199782192ed055b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762603843, "uuid": "b42f3f52-03f6-400b-8086-400f7963a6bd", "comment": "Malware payload (Mirai)", "value": "f9c5fbd99568139705b0d82a5bfa79676f6a56fb2b465c346400e2b60fc58e32b3b5086926e3cdf76ac5943650cf2d00", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603843, "uuid": "47a472ce-059c-4c16-b780-097c7de0f35d", "value": "T1D4B33B87F8C14A11C5D612BEFA1E218D332357A8E3DE32129E665F2133875AB0F77649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603843, "uuid": "1abbac4e-7623-44be-bd01-8e94f99e8529", "value": "1536:7wnPf4A8WeSx4XJ5Jq3IRFZkXlSUNaOSbeSRsf7sEVRpF4LCapyO+XfDgARi+2uR:cfjF0BRz7iXRL4LCapk2uHCLz6PdLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762603843, "uuid": "d6f3dd43-2d83-45ca-90d2-79fc35df06b9", "value": 112108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762603843, "uuid": "cbddd893-dab2-415e-ab95-5fbfd408ed0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762603843, "uuid": "06e36efb-d17c-49bc-b8fa-bb07737e6206", "value": "executor.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4689a5df-bc8a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762596252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596252, "uuid": "f8de4a35-fc40-4554-8614-62ef91e03245", "comment": "Malware payload (Rhadamanthys)", "value": "2a88050366df95bba5475123f7773253", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596252, "uuid": "10488012-ecbf-49d0-9880-16194525ee04", "comment": "Malware payload (Rhadamanthys)", "value": "d08e8968930fb7f11e35db8b873e299a3851690b5961561997796c050cc75e46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596252, "uuid": "634bc270-5dfa-48d0-961f-97bcc4b03cd3", "comment": "Malware payload (Rhadamanthys)", "value": "24f3af4780af83e78dd4f39966cc4004ef546199", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596252, "uuid": "b2ab7e5c-484a-4ae5-99c0-bbb4265cf102", "comment": "Malware payload (Rhadamanthys)", "value": "83b9acb231168aa31e47abb2caf89ad96c9172401f38345293566284c2a328d6685b433ba6b7a4fb9cd47b0ee9b1b137", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596252, "uuid": "12c54241-06ca-483e-bb89-5beed1bf270c", "value": "T1C9E423B165F8926CE5E1EDB4C01DA4B5B474F20E971BB3E8592DD072E382B980E1F613", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596252, "uuid": "725084c3-67ce-4a2f-9d32-9857df06cf49", "value": "0b8fc27747798374128089e16d9229e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596252, "uuid": "cfc536c0-833d-4c3f-9ae1-21e4dd9ea894", "value": "12288:fX8cKKAXnVoxoEPG1XbqyMuQGA1iHOte2/ZiQQqWsIYdJhaeIMa6VY:P8cAyxoHbqyktF/PhIq076", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762596252, "uuid": "06365629-c617-4ed5-8a6e-4e8a33069deb", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762596252, "uuid": "f7e605f1-07d8-4d58-b4ae-540002a3c010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596252, "uuid": "0feffeed-137d-482f-8050-f58a431abaec", "value": "mscorsvc.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec9a9566-bc36-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762560453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762560453, "uuid": "2d17174d-3330-47e8-a8fb-3d67d0985a5d", "comment": "Malware payload (Mirai)", "value": "7a1bb2cc5db2e2bd2f7b2ab4b50852d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762560453, "uuid": "84784b74-b5b2-425d-99e6-d102208cec7f", "comment": "Malware payload (Mirai)", "value": "d0b0dd45f9119f2b0b0e46edf91c3ad10c8800485035eb21418df7fc4610a590", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762560453, "uuid": "deccfa4b-55e8-4f80-a987-4d193735e696", "comment": "Malware payload (Mirai)", "value": "206ecadee286920d9464ed5bea79eee447517d02", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762560453, "uuid": "714aee04-acf3-47c8-8107-3b4797cc12f1", "comment": "Malware payload (Mirai)", "value": "27c7a4a8c2eb9ec1ac8d798f018e735baecffc50c1b4910b2ed3dd5f133f97ddbb1e85d21c1d90915bcfcfb653ae6b81", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762560453, "uuid": "acce2ef1-f1c2-4f62-8b5a-eeabc1ca2359", "value": "T1E8836C22B9391A2BC4E4A57722F34332F1F6438A24A8DB1F7D750E8EBF1459036476B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762560453, "uuid": "61bdf5bc-ac49-4c1e-a709-93ac09f400c0", "value": "1536:xTI32Lb5/wiIPupxaxhBatZ/Ym5/XJoAEntoz:0pEb/YO/5Nz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762560453, "uuid": "32019ae4-cc7f-4716-8d3c-39ca2b5137d7", "value": 87168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762560453, "uuid": "47c13c78-7964-4633-97ec-b71cb3a8cf66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762560453, "uuid": "9f8e5261-6b34-4a96-96bd-e4dcd5770f9c", "value": "morte.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba22493-bc4b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ngioweb)", "timestamp": 1762569497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569497, "uuid": "f20bc0aa-2b99-4d82-ad08-03cc1201825e", "comment": "Malware payload (Ngioweb)", "value": "e11a30fbc51aa29573f1bf62762beb1f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569497, "uuid": "0bd0f4ba-4e01-48e2-9c77-f90aad12e8dd", "comment": "Malware payload (Ngioweb)", "value": "d0ca62e68e235aca958e3877ae7ed505c5667207c95d34907bc806e5ffa0b21b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569497, "uuid": "02745d2c-57d6-4425-9faa-2a3612fb91de", "comment": "Malware payload (Ngioweb)", "value": "85e5a2ebe6e7e93eefca0594f703f79f8abf622d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569497, "uuid": "5201fa0f-73fa-43f2-8ea9-961bd6c400ef", "comment": "Malware payload (Ngioweb)", "value": "46f9989f9806f8cae80776aa25cd25ef1d2af97f619199613d9b7ced787cadf48648163aa40bc4b6e1a4ff25b9bacb82", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569497, "uuid": "bc1e6417-8cb4-4a0e-8c1e-c81abcf4d9a6", "value": "T171730A55F880CB61C6D526BAFA5D428C73230B78D3DE72059D24AB353BF7A560F36902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569497, "uuid": "3f9bfa87-c3fa-43a3-ba46-21b4f2d74aaa", "value": "1536:x86RsUMiveqQHP2htLDTggI3OMEbwtrvLrxQJaNJSFOg9MB1Ir:x8bZi3Q8tTMEUNLwjPp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762569497, "uuid": "4e3f3b26-509e-4f09-8e7f-074ddd686129", "value": 79104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762569497, "uuid": "f2036c28-a593-4281-a115-74d26341e30b", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569497, "uuid": "359216b3-08aa-4d41-bd75-dfab7b18fe3b", "value": "frost.armv7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b02139-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602268, "uuid": "1f1b1690-94d3-479b-bcc0-cddb98d12ca7", "comment": "Malware payload (Mirai)", "value": "29833abb4053881dd3584f4c7f69a4fd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602268, "uuid": "959d76d5-18b8-463b-bcca-0c37bf1375ea", "comment": "Malware payload (Mirai)", "value": "d36497c369fe3888656b6631812e02b76309c64e994ee36b1ed7e31beff735bf", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602268, "uuid": "032fe83b-e1d8-4111-82b4-3c302470336d", "comment": "Malware payload (Mirai)", "value": "d7fbe9979a67bfd64356242143930d5ef6d0edb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602268, "uuid": "df44a208-e454-4f4f-b416-8eae17913c9b", "comment": "Malware payload (Mirai)", "value": "452e014729e87253c571d4760fd5cda88a6cf7a315f7d0e5537ce811db0edf651e1901e4352df53293545d9784422b13", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602268, "uuid": "4bff4c19-6c05-48b1-80df-4b06fd955622", "value": "T1ECC36CD5FA43D4F6DD5305B12037BB378F32D07A1125EA83E3B959229CB1A01D61ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602268, "uuid": "caf4770f-e7cb-41bb-ae34-def9c22b76e6", "value": "3072:7W2WA4KfsQDNSHjiz2FBOeF5Bts4ceGM5UQ30hAB1En:Zr4KEKcHmz2F4eMeOQ3Gn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602268, "uuid": "da7e0413-80a7-43dc-a67f-c07ea84dc2a5", "value": 123208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602268, "uuid": "e9b418df-79f2-4050-9482-975c2ad98ec5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602268, "uuid": "8c6d98dc-2744-4423-a7ee-38130fbd2393", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57146de4-bc71-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ngioweb)", "timestamp": 1762585542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762585542, "uuid": "01e2cde8-d0fb-4200-815c-e17cf1882e03", "comment": "Malware payload (Ngioweb)", "value": "ef0db40d9e29034759d5000bcc418c08", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762585542, "uuid": "eed68f66-3b49-4888-80af-1dda2cc390ff", "comment": "Malware payload (Ngioweb)", "value": "d38c1a2f7cff1e5188eb3cf98f0e515a82fd368d77229bec1c1d41c899ed2b62", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762585542, "uuid": "d2e97bfc-9270-4a50-8353-3df5d1859699", "comment": "Malware payload (Ngioweb)", "value": "61c182782ccf095ca1c164749c917ae2f94ee3ce", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762585542, "uuid": "67c975cf-e93b-44e9-b9ba-3f2b5e0675e2", "comment": "Malware payload (Ngioweb)", "value": "3e1db83d40f56f4904d87f1c05294a66b934448086cd1656223b743d78988c7ed7331bffe6d266ef47c67d8a71554cd0", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762585542, "uuid": "47f91786-dfc8-415f-aa6d-2157822f8bb0", "value": "T1BE01218E351316B4E118EE4079A4FB0B511D834955807BE7A0981D37C3AD7497B45E79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762585542, "uuid": "cff398b7-d4a6-468e-b97b-bb4e72c24d81", "value": "12:78CtbSECwbSECHbSECpbSECX6bSEChbSEC7bUbSEC7kUb/:p2pYSz6vt4W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762585542, "uuid": "094b0c78-2b1b-4881-8834-f893e8df6cb2", "value": 800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762585542, "uuid": "05c4b784-506d-468d-8a57-9586bf7704ef", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762585542, "uuid": "d6503809-4a18-4bd4-9adf-e5ca46c9f856", "value": "dvr.lilin-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7907266a-bcba-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762616952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616952, "uuid": "e7266a72-5fc6-4986-a36a-16cb278c1afe", "comment": "Malware payload", "value": "b95c2ccd00098008ff8295ce86049c3c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616952, "uuid": "ee8f80fa-265c-4285-b9a1-59cbe7a677d8", "comment": "Malware payload", "value": "d3e8c3aa02190527ecffb55f6cfe1dda0b626f76ffd9f95ea37787cad24197d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616952, "uuid": "3bff5d0a-3fce-4dd6-9319-de8c3cb16089", "comment": "Malware payload", "value": "d823eab13c5b8975ce46f7868b1dfebc7c8ad7b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616952, "uuid": "65de1e9b-4a77-480c-9106-4fea1899cae6", "comment": "Malware payload", "value": "4dc44bba4f7071edee179d7949426735e1b4081fbe5b08bfccf1d3f5bd2a7c8172192a440f9c28e13bb042c0bd303b20", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616952, "uuid": "e6437a10-a11d-48e1-8ecf-f36534e593ed", "value": "T13A33F84AFD81AF11E4E421BAFE5E114A33535B6CE3FE71029E105B2167CA96B0F7B502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616952, "uuid": "d7344e86-2337-410a-9f89-fbbb550a79d5", "value": "1536:T9nqcY+K5tL2caPbsiU5bqYllULiMhVe9frd:oJ5V23PbsiU50Rh4h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616952, "uuid": "5f41217c-50bd-475c-8b57-8f740e5a0f78", "value": 54676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616952, "uuid": "049eb3d7-7637-4677-84ee-dfebe36c5749", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616952, "uuid": "975e2fb8-3de9-4083-bd95-f4a4f98c3e40", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "767a4abf-bcdc-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762631551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631551, "uuid": "67928132-1aa0-4387-97b4-2aecad267995", "comment": "Malware payload", "value": "36273cf2fda878aae89ea6b409e680ab", "object_relation": "md5", "Tag": [ { "name": "Powershell.Generic", "colour": "#DC3DDD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Trojan.PShellInj", "colour": "#890D14", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631551, "uuid": "cb687ce3-0394-4daa-9975-9f45ede5c678", "comment": "Malware payload", "value": "d5a2c4189ba0adc9c577389ddb124936296f426802661f02bb9e82c44878cd50", "object_relation": "sha256", "Tag": [ { "name": "Powershell.Generic", "colour": "#DC3DDD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Trojan.PShellInj", "colour": "#890D14", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631551, "uuid": "4ad3b7b5-ab64-43a2-ae57-d654b641c630", "comment": "Malware payload", "value": "1767ed3a519278a6b6c0df8199c002cd03045218", "object_relation": "sha1", "Tag": [ { "name": "Powershell.Generic", "colour": "#DC3DDD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Trojan.PShellInj", "colour": "#890D14", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762631551, "uuid": "b4e52ee6-193b-4fca-9e37-f7acb3e3826f", "comment": "Malware payload", "value": "13bf21e2729fa54642da3e752e178f0247d89d39db85c4c4b8d2970452e06caef51f3651658a7c3e0a30f56e705a421f", "object_relation": "sha3-384", "Tag": [ { "name": "Powershell.Generic", "colour": "#DC3DDD", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "Trojan.PShellInj", "colour": "#890D14", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631551, "uuid": "cda6434e-2636-42f3-a924-fc80df49aa48", "value": "T192B5286303851BBDF68D0EC9C94B215B20F2D4677D251298EBB36EEBBC3B9855430636", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631551, "uuid": "a8a1a2e1-fde4-467b-bfb5-f6a0dea8bf6d", "value": "1536:FsDFh7ZF6QrhJu9eMsLYJXapTXMuoyGiERT7EelKI72ZnMJL+H2/RM8xTEdR9oc8:H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762631551, "uuid": "5889aa54-36f4-4079-b580-e40360463b89", "value": 2494226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762631551, "uuid": "c78ea47c-5f2c-491d-bff6-6a8a409ce77c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762631551, "uuid": "1013437b-cf2c-41f4-adfb-9cc339c83c4c", "value": "blue1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa4ec82-bc78-11f0-91c6-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1762588635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588635, "uuid": "40525506-9d92-48a3-9653-2731f3398f6e", "comment": "Malware payload (AgentTesla)", "value": "9284b8b98f1a372ffbcf33b2b209c210", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588635, "uuid": "406afc12-70bf-4589-bad5-a4d6d01cf3cc", "comment": "Malware payload (AgentTesla)", "value": "d5f36995dfc44e102f37faa200f0bbb4cffe348a658fd8a3ee019168b1caf9ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588635, "uuid": "76872420-2601-4025-b44a-5e1b877253e2", "comment": "Malware payload (AgentTesla)", "value": "f6628fa6fd73956ba0a423f1af3eecabf2c87ba3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588635, "uuid": "05920afa-ca01-4796-93e0-846824c2014e", "comment": "Malware payload (AgentTesla)", "value": "ad3ae2020ed764618897528925b079c9b3f1710c705f350f3948a045f2f07947600d4165cb2a3d6e0d7da7191fd61876", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588635, "uuid": "e1634c47-54ad-4d59-ae6e-016205367ef0", "value": "T17F35CF1373DE8361C3B25273BA26B741BEBF782506B1F56B2FD4093DA920122521E673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588635, "uuid": "042fbb12-6082-40bc-be28-aa79cc2b00fe", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588635, "uuid": "c9c19b30-f289-4ab8-a5f8-aba738f0566e", "value": "24576:Vtb20pkaCqT5TBWgNQ7aTzDJKMoPVfn/56A:GVg5tQ7aTz1LaRnh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588635, "uuid": "fc2e0a23-3690-4d05-88fa-2ce26f9cb486", "value": 1081344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588635, "uuid": "78321a7d-7217-4018-93b4-7175a897180b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588635, "uuid": "5de2ad05-209a-4daf-99d3-1e14437d310a", "value": "DHL STATEMENT OF ACCOUNT - 1301023274.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6946e6b-bc45-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762566912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566912, "uuid": "98969c73-0849-4723-9ff9-5937634ffc3a", "comment": "Malware payload (Mirai)", "value": "c3c0073afd8034aa03d4a8255d01d811", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566912, "uuid": "091acb26-5e69-4adb-a54f-2b526a115033", "comment": "Malware payload (Mirai)", "value": "d6db986665714539d3fea90b246fab904c303a4557ef62c724010b72bc916b2f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566912, "uuid": "4721afa5-741d-4cff-a6f1-8c6261e1fce7", "comment": "Malware payload (Mirai)", "value": "1e27b3fb7c072bc8aa516467ac6bdeac3ba1b98f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566912, "uuid": "2a182574-09bd-4e84-9717-1650a4eb396a", "comment": "Malware payload (Mirai)", "value": "f352e7b48a30545995dcfecd5301c11c6aa22e23ac57c7c2b2cbe4a9a330c4c5bced771c58db98beb91b5f71307812a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566912, "uuid": "099571af-78ba-4817-a610-d5c1e22e2b27", "value": "T1E2C3BE97F74B2491C86207F407C74F9E3E6362129EAB98E7AC0F663B09790DF5906391", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566912, "uuid": "50da1e0c-c541-4eb6-8ac2-8620d09b5eea", "value": "1536:6Q1TTG64PDj4p4AqCZNju3acm6HQRQzvvIXBVejxZJ4Zg29/LWs:6Q1Ti7DMXZNju3N9IQzoxVeCZgOq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762566912, "uuid": "dc514475-d431-4e6b-95aa-5b810417d21b", "value": 124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762566912, "uuid": "ac8c556d-29d8-4dcf-9fb9-2ba24d193712", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566912, "uuid": "898235e7-c74f-4ba7-b041-318763e790d1", "value": "morte.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee5fb8d5-bc40-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762564751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762564751, "uuid": "44d364f4-263a-4faf-8c26-c27f5e19196e", "comment": "Malware payload (Mirai)", "value": "30029b234d23a2b2c4853f7e4eca54f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762564751, "uuid": "97998c31-5fd3-4b2e-a096-c4648abd86a8", "comment": "Malware payload (Mirai)", "value": "d80b180c53cf88f1faea677b49df604351c4b9fb896d58c597b6ab1ecdfb4819", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762564751, "uuid": "ab68a8ac-06fd-4266-8025-48e55b2d3ac1", "comment": "Malware payload (Mirai)", "value": "fa33d6269fa9a29416266d4721b88b2369367040", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762564751, "uuid": "5059745d-0ed4-45db-99ae-e9d6c9e51d58", "comment": "Malware payload (Mirai)", "value": "cba653c216985cb30be61dea974b575c37ab7e189c9871447c3c75e8acc20b5d85b632a419ffa7c99ac85989a93cf567", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762564751, "uuid": "dc75e5ce-3b2b-4b13-91c3-6707c3aeca8f", "value": "T1A213F126E22FE935C46F6174146F928251178508A9042BA7CEFF777F986FC605EB2F80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762564751, "uuid": "00a7131c-70d9-445a-944f-5a68033ae688", "value": "768:awg1pV7PtJ/KQGK/JN0UzZ4UDPHMpW1UVTUpDgYmbENJaS3dTpx05+o:7OV7VdFJN0kjbOahpDgvgHF9A+o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762564751, "uuid": "66f81034-4089-44e5-b623-355e58f08184", "value": 41812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762564751, "uuid": "cd9c0286-9e74-4215-ac8a-3bea7eba536e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762564751, "uuid": "22cf8d56-24ac-4533-8bb8-467135c110a2", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f1f067-bc73-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762586295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586295, "uuid": "10c402ac-26fa-49f9-a998-474c58e68fe1", "comment": "Malware payload (Mirai)", "value": "c3bde2822dd79fe453bfc570bd36746e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586295, "uuid": "f542ae29-413c-4a13-9d2e-be1617070488", "comment": "Malware payload (Mirai)", "value": "d873cf5d7c643d4d4e902fab63cd0d6cd3f0be40713cd9f60ed1124fd19e60c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586295, "uuid": "7822fcf1-0b1c-4e5f-afbb-a9585ba1d5f0", "comment": "Malware payload (Mirai)", "value": "aa0d79e248aea333cc4d9c0b33daec125287e9a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762586295, "uuid": "2207483b-5572-477b-a613-13889bec3fa3", "comment": "Malware payload (Mirai)", "value": "8d97bb3182e73892cc1a0dc9ac9383350e053e49d782ae484f1c9e80848c8f28ce07c89c5c72127a95a3b41ae822d348", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762586295, "uuid": "60b6cfb2-12c0-4a9e-b838-1437c863e3d2", "value": "T164836BD1E643E8F4FC2601786177AF775672E5360069EF8ACB69B9329C26102B32735C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762586295, "uuid": "7e265dbe-b3a3-4b74-88be-9c19d4d165e4", "value": "1536:K/iCx9mK2Idtv7+yX5HRjZEoFX+7jEkiSlwSZu6o8:KqXIdtD+A5NZXXM4k7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762586295, "uuid": "7f1009de-020f-44a8-bd62-5554071a9138", "value": 83316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762586295, "uuid": "1812338e-1da3-488b-a067-95ecbc62fcda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762586295, "uuid": "b035fafc-2adc-4085-89e5-7d4265772858", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9757fae3-bca0-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762605836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605836, "uuid": "c879fd77-91b4-4e66-aa34-f660d12cd510", "comment": "Malware payload (Mirai)", "value": "e74039f2459502e30cdd39447bda68d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605836, "uuid": "a1eff2b7-565e-4ae6-9533-08a2f46872c7", "comment": "Malware payload (Mirai)", "value": "d876876166b2d1ea391a0e3f3f237e4b62625c2d9f8fd1f7fa2a96940cd718c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605836, "uuid": "38b1896c-f11e-4acf-890f-00116dcff460", "comment": "Malware payload (Mirai)", "value": "553674479254a37e72f705cfaf38c5ecc3261442", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762605836, "uuid": "c74c6afb-fc8a-47d8-84a2-4d82098b35a8", "comment": "Malware payload (Mirai)", "value": "0fbfd7c74027a17748e85d5e52f734e6c54b192b7fe81b620855fe0aa7a3975678d9334860b95c83038b0d664155a636", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605836, "uuid": "9b06b2ce-4820-418d-9862-4c0a8ba76b34", "value": "T16403E02CDB005CC7CA9B85FD425C37A1239AF49836C493AB27688C46DCF79DBF186954", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605836, "uuid": "b48c9d48-dcec-437f-8336-f8ed084b3ca9", "value": "768:dphUhz/daTmU9PGzCgj+I7EmbEEULHd/AX56WlOI:vhmzU6QPGzCg69moEUh/Apdf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762605836, "uuid": "aa749582-0388-4790-9898-904090d6428c", "value": 40112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762605836, "uuid": "4d5ff385-c9af-443f-904a-3aec76949445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762605836, "uuid": "39fc2034-c0a5-44bb-882c-4e4d60c33220", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45605fb7-bca2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762606558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606558, "uuid": "501cccf8-0548-4b56-a92a-697cc46da7c1", "comment": "Malware payload (Mirai)", "value": "ed79ff0dfcd53d1a0a9f2d6c23b0f2d0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606558, "uuid": "a7594164-defc-4d0a-a3d0-49c0ef74750a", "comment": "Malware payload (Mirai)", "value": "d8e562358b3646a559fe594104ab1f8817c0ec8292e9a6b8dd51647ec77d89c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606558, "uuid": "21e9be1b-2b83-40e6-917e-f2b4b4ec37c8", "comment": "Malware payload (Mirai)", "value": "03817383d03439d1e89289c4f5f727e817320f51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606558, "uuid": "ae113699-57aa-4899-a9b9-f2547ea9fee5", "comment": "Malware payload (Mirai)", "value": "cce9ea6c236124a06c6633d47be12c859015637b62cdb1572045eb406f5b2b0851415ed25d06eadbe865e74b0808ad73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606558, "uuid": "ee84c44f-f36f-4ebd-bc46-f08480cde555", "value": "T187934CE6FC01EE7EF40FD77744534919B230A3A129931E357393BE67A8351A94863E82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606558, "uuid": "87f5da9c-d462-44b2-ae50-a8e0296616af", "value": "1536:71OjYCM38Ccf+TaWp18iYyR7l6hUKTCHGzpnnd9FRTSV9ngHV:Aj/MsHmTaWpQyR7lcTCm9zTSV9ngHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606558, "uuid": "90f8b582-c14a-4e06-850e-1426e691e220", "value": 91988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606558, "uuid": "0a0c2ea1-05be-4699-9516-989837402d3a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606558, "uuid": "0f0b29a4-9f62-4c69-b0a6-b3ac4b55b52c", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4ec86f-bc8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762596716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596716, "uuid": "3ff0e6ac-bb52-42ee-812b-c80e6eb724ce", "comment": "Malware payload (Rhadamanthys)", "value": "73c65a6d4428ae6a4d00bdb158062522", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596716, "uuid": "f50666fd-887d-4306-ab40-ca5c9e5f4fa3", "comment": "Malware payload (Rhadamanthys)", "value": "d93b35b4d5d8555f8f413c4dd635572b442c35124efb9362bbe72add522e35f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596716, "uuid": "3d389e72-fe45-4dfc-b7ce-fa0084dd7792", "comment": "Malware payload (Rhadamanthys)", "value": "6c944b72869bc4b07b4ab44bd3db266de6ac3c85", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596716, "uuid": "57894fca-bf9f-477e-b4a0-399930f0f2b0", "comment": "Malware payload (Rhadamanthys)", "value": "d57122bd35157e17783783b19fdb8655f5c74ae3d3acf04f0bc66193fd43d4abbe84f2d4058f4138cef84c8219d48645", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596716, "uuid": "8a0cdab7-c4aa-4594-9bd3-6aa5266032da", "value": "T1A936AD4F794795F5C4AAF1398971C191A670F80A4B3037E32B15EAB61E373F88A36358", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596716, "uuid": "7dd12e1b-13f7-49d2-8092-e246defffd13", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596716, "uuid": "02fac6f3-ea51-44bf-ba30-2dc623eed975", "value": "49152:KWibUDevlED/OuwuTWyniPIAtgEEmbcbD1RiJT+x3OaDGap/9zommqmIOvP2eJCg:OUPpmKiJT+xd6aj6qMvOeUo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762596716, "uuid": "8edbdb0d-bee1-4312-9076-ea5fc6ee6a5d", "value": 5215176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762596716, "uuid": "02215623-f2f7-4e7a-b7a0-e47b0d60ac3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596716, "uuid": "f9e37581-bf6a-436d-af03-01960fa7ea4f", "value": "tech.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88fbcec7-bc93-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762600229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600229, "uuid": "13f516f2-b435-4226-b863-fb763063260f", "comment": "Malware payload (Mirai)", "value": "f4264a75f209aa674e83de2e17bfee84", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600229, "uuid": "411822f3-1ddb-4528-89f9-815d6de86bd2", "comment": "Malware payload (Mirai)", "value": "db6614071dfc05b97d2adc9150ed42403d32897f162e4a09ea6b093bfa4b9f37", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600229, "uuid": "e9ff1c9d-8b80-4a13-83e9-af3b754212c5", "comment": "Malware payload (Mirai)", "value": "8c43c08c5f2802fc7c24fbe4786abe63751ff3aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600229, "uuid": "85a6ee65-28b8-480f-ab19-19606b93a708", "comment": "Malware payload (Mirai)", "value": "7bc9c71c4a51d078ae17802ab1ea7dc9d86c0817496cbb3630db43e2700b103c4017fd0fac47058cc01905e4b7908428", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600229, "uuid": "4ac0ff23-7613-41a4-93cb-d3275df76c25", "value": "T115E39FB3F30B1091C82306F417CB6B9C2E2315425F6B86D3BCAA313A2A765DE5915BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600229, "uuid": "daf29d9b-e523-4021-ac68-dc614fcec0f1", "value": "3072:X/1HeTDitCaG9y+y0+Xk+cdLfSFztgQg5CvugQt5SPub01yvq:P0mGvy/aKFztgjCvattvq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762600229, "uuid": "fa732a36-cfce-427a-b531-284e99df5f9e", "value": 157136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762600229, "uuid": "fd6b729c-d11d-4b27-a0bf-c0be206f8965", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600229, "uuid": "f649c848-6845-4a4c-8240-902a15111033", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67722746-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620359, "uuid": "d0bf4beb-d651-4698-87ea-4af3fced8998", "comment": "Malware payload", "value": "8e94e47fa60edbc84831a13f96e065bc", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620359, "uuid": "e9fc5cd3-08e0-451e-8cc4-49b112b0ef9d", "comment": "Malware payload", "value": "dbb152570394959b70c678a0507f8a71ba2de30702187bcf1c948dbb25a9b53a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620359, "uuid": "ae2191c1-6c24-4c77-bbf0-c96c7e3d0db1", "comment": "Malware payload", "value": "7accaf9ee47ce008a1e2d8aae92757400b55d179", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620359, "uuid": "5765957e-a80b-4304-be04-cd3970cc466d", "comment": "Malware payload", "value": "866c407d70938c7280e6526455ed8b8b5fd8088f39e918319e60abc5e0f91135a9ad2bf96def5f854f44cde06762f82e", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620359, "uuid": "c00aea26-1f99-4c0d-bc18-d2c5b46a4881", "value": "T19115CEBB4910F85FA6D327D629F63A6E05EE090D4170A14E76D262E83F35215F3BF188", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620359, "uuid": "2d6969b3-9774-4b68-9a85-98b9108d710c", "value": "12288:zNAlDDdUy2RribREl0spHQ0pxdB78A5sdHHmuszRvdWwJptJi:WIRi1UpHTdBQACyWme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620359, "uuid": "83ae696b-0ba4-4f5c-b956-7f1f0657af3c", "value": 924184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620359, "uuid": "715dc21b-f195-4acc-9b1d-1dc888d44927", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620359, "uuid": "6e242fac-985b-4425-ab98-471c617398d2", "value": "SCANDOC11625.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2ffd0c-bc63-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762579754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579754, "uuid": "2dd47c70-becd-4832-be6b-20b3bbe65d5e", "comment": "Malware payload (Mirai)", "value": "7c53c2c72bd1c258ad61e55df08f6788", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579754, "uuid": "b0d75040-0869-4c72-a1b1-ab2deeb5f92a", "comment": "Malware payload (Mirai)", "value": "dbb7cdce5e68f5ab87a5a643808d2dfe5fb06a3d2434be554757b36936cd76cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579754, "uuid": "936b371c-857c-42f8-869f-78ef8e717199", "comment": "Malware payload (Mirai)", "value": "4e80b18800edf2adefbea52599a1e6228c9f775b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579754, "uuid": "73743443-456f-409b-81ed-b344b097757a", "comment": "Malware payload (Mirai)", "value": "7cf9843858b8cead6b3a659144c5feee6124bbb0bda658c626e991dde598cba94f6102e79369b8fe6537f4ec31c6b6f2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579754, "uuid": "5c8360e1-fa93-453f-a9f4-b65c017bb201", "value": "T1C713F1FEE8B46849D878AB7E50E436E34D0A728077446F6CB7675E90A13998738CC4F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579754, "uuid": "2457aadd-8f22-45c5-a0d2-d493f0e1ad4d", "value": "768:ixUkUPOmbATqjcIv5arIiKoYsyE1tS65riTxvs1ljhXlcgXuCvV+Gc1xx5jmWG:JkUTpaXKpsZ1tSwriNsBXvuMYT1xxZi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762579754, "uuid": "cea9afed-4b66-4314-a244-b09cd647ef77", "value": 44220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762579754, "uuid": "8f00b3e0-6836-4371-b75c-77b52888e8fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579754, "uuid": "bdb097fa-7b45-49a0-9e8f-897e582bd297", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6deadfd0-bc5d-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762576991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762576991, "uuid": "ec2ca3d3-6ac3-4732-bf64-15315580fb65", "comment": "Malware payload (PhantomStealer)", "value": "727aa41ff30c29d03673d950c7792bc4", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot8499361235", "colour": "#7472C2", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762576991, "uuid": "3d649da8-1cec-4a78-9512-14068fb36ca6", "comment": "Malware payload (PhantomStealer)", "value": "dbf210eabaaad8dccd9111c94cbccdaafb00be70ccfdc866a4c19a5b2d2fe44d", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot8499361235", "colour": "#7472C2", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762576991, "uuid": "2d18d983-73a1-4b58-ad27-4be54c1f59e7", "comment": "Malware payload (PhantomStealer)", "value": "40f289e27632fd991780bec28d01f88864730e30", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot8499361235", "colour": "#7472C2", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762576991, "uuid": "8bafe97b-2ed2-4c52-a1ac-374637871082", "comment": "Malware payload (PhantomStealer)", "value": "fcb714a18399f32f41869f5f71e5095fe591052ae8932df2acf5fdb553b63ea3dc1583332f05a44e1959ca7cc65f3495", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot8499361235", "colour": "#7472C2", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762576991, "uuid": "3cb69d25-fc74-4c89-a308-e7238fb7e150", "value": "T141D4237E0296720206DB6B2DA57E8DBC2B22A51CCFB955256E303F70D67C402F215FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762576991, "uuid": "0b5ad4ad-1cb0-4d03-a671-b5afc1fc3752", "value": "12288:mUd6yx1n7qqOVKTjMgmgl6Sd4zM3ZeZKrs4X3snYKP:mG6COnLcd1CKA4X3snYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762576991, "uuid": "ff9b348f-f37b-4b20-8c37-166afef168bb", "value": 618858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762576991, "uuid": "4db9c006-181d-4d88-b282-a2ab6e5dcbde", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762576991, "uuid": "e97276b5-de87-458c-bbbd-930573fa21d6", "value": "Teklifinizi a\u015fa\u011f\u0131da yer alan \u015fartlara uygun nitelikte taraf\u0131ma ivedilik ile iletmenizi rica ederim.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be03d54d-bc89-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762596023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596023, "uuid": "9d3a22a6-4cf6-4a3f-9532-a4c1a14b1882", "comment": "Malware payload (Rhadamanthys)", "value": "017b69e92d650fa7bca7ec3f5ff76aa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596023, "uuid": "4ece8d0e-f2a8-4149-aca0-3d6f390293cd", "comment": "Malware payload (Rhadamanthys)", "value": "dcb523eede51fc39711989d020d5085fb0dbf12cfc5014f238881542dc09c515", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596023, "uuid": "a55c53d9-5768-4d47-b831-c31a6f780f9a", "comment": "Malware payload (Rhadamanthys)", "value": "70b9208f65d3e720c935d053be6103c6b6a2e4c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596023, "uuid": "b6396cda-b66d-4e63-8c1b-750afc875822", "comment": "Malware payload (Rhadamanthys)", "value": "bf020db5be7ccbee4e3692ab22313117bcbfbefdb9e4b8bda36de222fa2b0ef3b4098779c1e08cb43e06f5b54ae1de72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596023, "uuid": "0bf82686-4eb5-49f2-8355-cf29c9ea95a2", "value": "T1BFE59D0BFCA158FAC0A9A27189765196BB61BC452F3123D33E90B3782FB2BD05D35B54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596023, "uuid": "af20c491-ae50-4666-9a2e-590dba1828c6", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596023, "uuid": "524b8c62-e5ee-4885-88bf-761419d84221", "value": "49152:8SX5+0Kx3UCLroB6sjBaVMVfSuEKQLUYGADcUmd:8SJQEB6wBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762596023, "uuid": "7d5a8f6f-7ef0-43f6-bf41-9b857ef153df", "value": 3077632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762596023, "uuid": "4bb07061-9da4-4776-a6e5-96ef84b0d790", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596023, "uuid": "70c43d8e-ff46-4b4c-aa17-6f81a2418d11", "value": "PrismLoader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18de948f-bcc6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621945, "uuid": "00898a23-4ef1-4f95-a102-19fd76cbc81f", "comment": "Malware payload (Mirai)", "value": "7a36bf875136d37d82e61ba680282fb4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621945, "uuid": "d19696a7-ceb7-42d7-be2b-3497fb17feaf", "comment": "Malware payload (Mirai)", "value": "dd04e2416bfa5514ad6be68722cc624d5500814726f94a0dd923c7d66a03a7f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621945, "uuid": "72e979bb-3f95-4a45-9dd5-900a75dee320", "comment": "Malware payload (Mirai)", "value": "9d27b0ea678a994150f8769f87c12bfec096ec48", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621945, "uuid": "bfe2a1da-582a-4827-a5a0-b5da572d754e", "comment": "Malware payload (Mirai)", "value": "1c8ce85fe9aae62c5b0bf9bbe2a83a3ed18cf83514790bad8ef904d9c896d022ea9c20f3ffe57c6b267db8fd62a40912", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621945, "uuid": "1a5c0cd7-0687-4728-8f47-ef80063df48f", "value": "T1B2435D43321C0E47D1A25EB0253F17E093BFE95124F4B689265F9B5A8B36E3B1486F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621945, "uuid": "cce966e7-b7dc-4e6a-b7fa-5cbfa85d5e06", "value": "768:lgbf8RQzh1r3FgzRaN7+faVt7Ymuiygu1HoGczEpGVuz2GipH6TnSgGAB7:ybUg1Jgzz4Cqu1Hisi6nSgG87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621945, "uuid": "5805f0c1-fbfd-4422-b232-d0bb5c6e8aa4", "value": 55472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621945, "uuid": "095e05ea-2d49-4909-be60-cd495a4686ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621945, "uuid": "5b8b6b5e-dcac-4b79-bb34-73b0f2f41c61", "value": "jew.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e1d84fb-bc78-11f0-91c6-42010a9c0006", "comment": "Malware payload (PurpleFox)", "timestamp": 1762588534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588534, "uuid": "2a307587-f403-4041-bf0b-295dd4f695bc", "comment": "Malware payload (PurpleFox)", "value": "066b44d1237fbfe11f597f3c7ca7c9ca", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588534, "uuid": "e2ec3c9e-e670-405d-8e39-7e8babca080f", "comment": "Malware payload (PurpleFox)", "value": "dd615f60bc6c364b15ffdf93880e3dcdef9e7a2eb5444cd913c6e3a58b0943d5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588534, "uuid": "6a143868-0f39-4e76-85f9-fbd9a008c2fa", "comment": "Malware payload (PurpleFox)", "value": "d29960464ff482bd4b9096aee0442db369278062", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588534, "uuid": "0fd7974f-c1db-4f7a-9fc8-7ee2f52338f6", "comment": "Malware payload (PurpleFox)", "value": "51ddc511b78db44844528a3bc58348967109d1fff9bae96dade8779296565a597b3de34ca2cd01346e31cc9225fbb0ae", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588534, "uuid": "2ee048e0-1fe5-4076-a378-ff152f0f1f79", "value": "T18BB73333644D8B74E9F08AF6C06EB76E6290BD82525D64D4F18CFFB5987294B40F188E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588534, "uuid": "167c4bfc-3498-49c4-a9ec-0a362cd3e067", "value": "786432:D6vaoBJtf04xNmRHREafHMfUqcLMlWtWf8DGwXCIBWPDpBuGXd5Lv/TNoOx6OFPT:DxoL9hNeancLMl1dwXZBWrpB553nxNe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588534, "uuid": "cb697f2c-e3d2-4df1-86b9-f8854da92a2c", "value": 49090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588534, "uuid": "18bf3243-7c5c-414d-8217-e63195a9f928", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588534, "uuid": "3fe11d54-5d53-473a-8441-53312de226f0", "value": "telegram.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be77996-bcba-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762616957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616957, "uuid": "d53933f0-c907-4584-9928-7d18c18b7ab4", "comment": "Malware payload (Mirai)", "value": "a52109cfe0aac5d44a80429457c4a6d4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616957, "uuid": "76b50d01-1825-4421-8873-6e48292cdb8b", "comment": "Malware payload (Mirai)", "value": "ddee7c0191a31fd487e0bdadd32958eae39bdf3fd15856feabc931212f5a4522", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616957, "uuid": "75c0a686-ef14-4d76-be19-8f43a7ef5716", "comment": "Malware payload (Mirai)", "value": "83877a9b273a3b44357f2336ef903c4cc1858b7d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616957, "uuid": "e6f6c1df-a9f7-42a2-a5aa-fffc6dd33b17", "comment": "Malware payload (Mirai)", "value": "c93f1806de094bdfb92678542c471afda287aa04c861af57aa1549783b8e58ffd068096cf28864e81ec8b0025abbaee4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616957, "uuid": "dffdf184-ecab-4c8b-8f13-c617d1e2de7a", "value": "T104E22B01B70D0953C5377EB43E3F1FD5C3AA9E9021E8E1493A1D9A89C179E718286EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616957, "uuid": "48210a65-f4c4-493c-ba6a-4cf1caa01ed3", "value": "768:qW7gL6YAa+eGm/bHb6NhuceMba2lqKjvuuBMXBaZRV:N7WbHA0ceMba2lqgbBMxa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616957, "uuid": "1cd89d41-ce0e-409b-ba62-ee62592e71da", "value": 31788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616957, "uuid": "40b05a5f-513d-453d-861a-bc4b69a47a6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616957, "uuid": "e792c69b-b562-4472-b29f-919d0c1fb512", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea9528b-bca6-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762608345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608345, "uuid": "bd2b5d0b-8a13-4b3e-b26f-93f01c5d03b4", "comment": "Malware payload", "value": "9a405582e8c7b9ec1f1c26f11bc5f018", "object_relation": "md5", "Tag": [ { "name": "agos-rappler-com", "colour": "#162559", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608345, "uuid": "2083244c-992a-44e3-85f3-444f08c3193a", "comment": "Malware payload", "value": "df318a3137b6aacae44140f3884d0907e62b98439af6174b2e987b1186246799", "object_relation": "sha256", "Tag": [ { "name": "agos-rappler-com", "colour": "#162559", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608345, "uuid": "7a4e7f37-c747-4951-bd61-838c34393747", "comment": "Malware payload", "value": "67b8257918fbfa39dd9b292c588735d93f0246eb", "object_relation": "sha1", "Tag": [ { "name": "agos-rappler-com", "colour": "#162559", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608345, "uuid": "a9468f68-d4dd-4879-acc9-03b7eb09dade", "comment": "Malware payload", "value": "01942990473de0e6e2de6134ae942c0ac227b43721ea232c3bc1f4a02615099f9506e05a65d47a1a7ef16ca4d5371c2c", "object_relation": "sha3-384", "Tag": [ { "name": "agos-rappler-com", "colour": "#162559", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608345, "uuid": "47879e26-11b2-4bd1-ac83-609ee8b3dc2f", "value": "T15626BF43FBC7C0B1D94E56B911AB977F093AAA144338CAE3D7512E59CC311D26A3E389", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608345, "uuid": "c3eeada0-a35f-4c7b-8e74-36ee0ce96d68", "value": "21a44579f3251b35c2294168532214f3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608345, "uuid": "b04f6a79-8182-40f3-a998-f121a25abb82", "value": "98304:1v9HXXyyAy/PegGtNXITUhDQ0ma8SkjlBXJlpER:1ygGtk2DQfaJilVnpER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608345, "uuid": "e02a39d7-20cd-4b90-87a7-cc3be4adf144", "value": 4450416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608345, "uuid": "2f7ce4fe-0135-4009-a76e-a4a0d5a1b7c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608345, "uuid": "10ab070b-a627-4dae-b5a9-ba0bca276d0d", "value": "help.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b43c3c-bc62-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762579156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579156, "uuid": "05afb617-739d-457e-9367-37adce024cf3", "comment": "Malware payload (Mirai)", "value": "89a087297def26b925d8a98adb2ab526", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579156, "uuid": "ba9db929-4e30-41eb-8ec8-a9723605b44b", "comment": "Malware payload (Mirai)", "value": "dfa77ec4ccf04f4cc5ba1437e380dae9f27aaa45cfc95a5a93e97d65e4f62db9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579156, "uuid": "35c5afa0-57a1-4337-b7d5-563df154e102", "comment": "Malware payload (Mirai)", "value": "d49193c63cfe6af8b05d86486f1c923498ba2597", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579156, "uuid": "ad5d3611-9d37-4e4b-9ca5-d4503f5d3673", "comment": "Malware payload (Mirai)", "value": "7cd34e97be8e1b82598a73283eb9d504e9d3f1559d5368ee1b2b1027005956750e98553970b8411d993e53249bf43785", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579156, "uuid": "aef3b3f7-faa0-4585-acea-2268a558d5d6", "value": "T1D2932A46FD828F13C6C622B6F7AE058D37127BA8D2EB3103DD25BFA1338659A0D67511", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579156, "uuid": "b8f3f2ca-32b1-4b58-9331-e2d8a2fce30b", "value": "1536:nrDxFyoNiHLpsyXBBYTXNUb0Dn4MkGnaagFJX6s0dQ1kvwJym:nnDyoNVyzYDN5PDnaJJ6dUym", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762579156, "uuid": "1d686334-4aa2-4e0a-92c4-362aa45f7e6d", "value": 94812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762579156, "uuid": "311b805b-7cce-4299-b2e5-198261c28afd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579156, "uuid": "3e65612c-be3d-46b0-bb42-c06e21a40360", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4d286e-bca2-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762606677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606677, "uuid": "c0ce55a6-c5ed-41ec-a2db-c90a26e045d3", "comment": "Malware payload (Mirai)", "value": "0d8a0201bbc0f53fdd2e5967a7c299cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606677, "uuid": "75eb02a2-47d2-4142-89a2-5a16b76e1d1f", "comment": "Malware payload (Mirai)", "value": "dfc50e42dfbbe221ace7cdaa4ac3601ffbb5afd23788f21fd83d851cf97abb4e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606677, "uuid": "7534331d-ff07-44a8-bffc-6282fccf2f70", "comment": "Malware payload (Mirai)", "value": "77f60a2af21d074b753c461d73fa2a7f0246d7fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606677, "uuid": "59b95cb2-763f-4cff-8264-e4e0039dc81f", "comment": "Malware payload (Mirai)", "value": "24c2cfca17b8df847eee36b933b0c83687544ebfb498de890d36020fa8d16ec32ca58927c5b7a3098fa6df768ed68c3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606677, "uuid": "3bf1fcec-cb16-4c92-8bf1-582721079edc", "value": "T1E633E1BA961256C5EF73FA630C8FAFE4EB2619D5E35B878192456F40146B0743118FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606677, "uuid": "e8f5834a-1f29-4015-9117-f3995e67cfff", "value": "1536:FVaoF8CDX+KpdO7URfCYerKAa5UKFu/AjINnfgq34u+qgw096:/aovZsIRfoPaaKYaYoq34u+qgwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606677, "uuid": "fc1c8d63-19e1-4d81-bf5f-db8a124d2ae1", "value": 53116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606677, "uuid": "51a67fe8-1556-4f39-9e64-dca0dbc036ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606677, "uuid": "88dfcb03-61aa-4101-8264-a291e5b9abee", "value": "boatnet.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6538f583-bcd8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762629804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629804, "uuid": "efe0ff97-ccc6-4fff-9ba7-950d98cf0893", "comment": "Malware payload (Mirai)", "value": "8d70c330e79ad7a31b4b0492ad3e4280", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629804, "uuid": "4758f33d-6141-4bd8-b282-99a1efcd1ef1", "comment": "Malware payload (Mirai)", "value": "e09b274adbfabf152c53e6c7e0f611f46789b399f1a150afc9781b169f34e26a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629804, "uuid": "02f9851d-ab29-42e6-b8b7-4fcaa5b580e5", "comment": "Malware payload (Mirai)", "value": "8f2f1b34117a42a35923309bfa366b34c2c9c52b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629804, "uuid": "b3fbe692-1ceb-4543-b503-e6ea7e95cf58", "comment": "Malware payload (Mirai)", "value": "bd2c19c33448549fcad46dfbc1f19af3c8a603fd3a8d2c80daffa02c467dba56602da9bc799b1c2e6ad8fcccc41de106", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629804, "uuid": "cfdad092-4369-4c88-bea4-e3631bfab612", "value": "T17313020949A7872DFA0D263B607FC2CD2626E24911CCF7D09F78605615FEFA32760A84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629804, "uuid": "e93cf051-8691-4168-af74-d5d49bdce1ba", "value": "768:XPmlq5gJ0gSrRdgeaX4231NlgjPSF8HcMsc4WnnbcuyD7UHQRjr:XOw5gJjSFqeaX4s1NmjPkMs1Mnouy8HM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762629804, "uuid": "1254af1f-1c3b-4157-b72c-66eb8a3e4183", "value": 43288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762629804, "uuid": "7c491b3a-e45f-4a5f-8198-7248ce05e7a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629804, "uuid": "82a19bb1-0569-49ba-9ce2-bf27310e5c10", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d57b761-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762602223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602223, "uuid": "48e4734f-8637-4519-8796-4f4ded93b09e", "comment": "Malware payload", "value": "6c5a57d1b6ee03d41a25334edc42d40b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602223, "uuid": "b368877f-a6c4-4fed-86d5-6cc26494cd81", "comment": "Malware payload", "value": "e103fef26444708c1b9e4716464225945bfe20cc2ad2eb4994cdc9295d556fda", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602223, "uuid": "225c2a16-f904-4ffd-9e91-d846f98d04da", "comment": "Malware payload", "value": "837cbf5f3c67b2b924bc119ac69f0e923cd01af8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602223, "uuid": "752c2393-4170-4d85-b4f8-0e10d6cd761e", "comment": "Malware payload", "value": "d3ee7369a0661a4def137f94469c8ef5f2bc1d6dffec0ada9766ea2428806dc8375f7624ec72fec91579cb740f6be4be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602223, "uuid": "de5ee159-2bbb-41f7-a7f0-6161a8613b41", "value": "T17FE36C2B71C18DF5C00286B126DB62549923FE7F0BB62147B7947DA0BF398C94E69BC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602223, "uuid": "54a7296d-6755-494f-99f5-abe99011bf47", "value": "3072:62R0e1gfKJfgKvGPAXXRRV0sfHutJ8adPF4KQTjscJQiv/hagOAEebvfcivGmS+b:6I0tmzXBReQutJ8adPF4fXJJQAEebvfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602223, "uuid": "bbf0fda7-d011-4c67-9f96-08c91062ecf7", "value": 151932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602223, "uuid": "3a14c83e-8cae-482f-a958-a0425846dabb", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602223, "uuid": "16c89c91-a1ab-4ff1-8c26-3e987e6d1529", "value": "bash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a125483-bc78-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ngioweb)", "timestamp": 1762588473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588473, "uuid": "7249db82-d9fa-4c45-899a-cf5db2ab30d3", "comment": "Malware payload (Ngioweb)", "value": "59062b7ab0a869aeae0b6e0f1da96145", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588473, "uuid": "c2c61ec3-a129-45f5-a269-13a7f820c408", "comment": "Malware payload (Ngioweb)", "value": "e1c3f7b42e3266079e0800de42709d05cd0a509fe179ab6b078a6bb4a19a2407", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588473, "uuid": "e071be5b-04ea-4824-86d9-952e260ebe40", "comment": "Malware payload (Ngioweb)", "value": "cb5bb45cb20d91a6af86608d94ab93f527d89611", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588473, "uuid": "acaf99e3-ab15-4829-ad1d-058d30fbe4a3", "comment": "Malware payload (Ngioweb)", "value": "e0179e2f3cdb7649d70a849a98afe99e707ba5555bb6d70ef75cde3f199408e155cacaff331b806bcc5f949c3d495ed2", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588473, "uuid": "66d43a4e-d3b0-456a-8ffd-93cea989f246", "value": "T1E10148E934967594D038C740B951D8CE5181DBAE11E21B10B36CDF71805EA9EB06DB06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588473, "uuid": "d3cbb3d8-e57b-400a-9f38-1d27366e490c", "value": "24:1Ul44Fl44ql44Yl44zl44uZl44vRl444PZlG:1UlBFlBqlBYlBzlBuZlBZlBoZlG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588473, "uuid": "f67fe035-fbba-475f-9bac-56d69ed8fa06", "value": 824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588473, "uuid": "a1767575-d7fc-4928-94ae-134caa1579d0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588473, "uuid": "c9fb3c20-a573-457c-a27d-38b5f757e8e5", "value": "router-atemi-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5066b37a-bcc9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623327, "uuid": "8ff862d7-4f95-4dfe-bd48-ccc63a252704", "comment": "Malware payload (Mirai)", "value": "3307f14a9462a0d0b0332371baf8dec1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623327, "uuid": "8339367a-9952-4692-bfee-33adf63930a4", "comment": "Malware payload (Mirai)", "value": "e2743dbb506cfec3049b4f7e8ef640f194f47918262856cd7baabeec677077a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623327, "uuid": "a2272a68-03ed-4b26-8701-a3e95d152081", "comment": "Malware payload (Mirai)", "value": "43759d63ac37d95f64f0731933cf6c0aa1e9a867", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623327, "uuid": "8c51e956-94fc-48ac-a1fc-9fde4fe1ab24", "comment": "Malware payload (Mirai)", "value": "6f299169a6e5bc41aa9315d7ad756bd7bb3710a12ae84e72d39f76a351e57d3371ffa783f3b086adf96e62f9d5e4da95", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623327, "uuid": "22b5ae24-01c2-4556-b9bc-6a92ef5f4aea", "value": "T1B7837CC6E747C0F4F8668572213BE7329633E53D1068EA83D369A972FD13542D61A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623327, "uuid": "2cae36ef-91fb-4945-b8db-202a85e6a302", "value": "1536:M/bNuNDe5cjwUA1E2o1DVE/V3cRiMsjJ+7s3Uk2u:Mzo8uwPE2o1+/V3ckMsd6MT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623327, "uuid": "42a9ffcc-792e-4ec0-a71a-a785838a559a", "value": 80912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623327, "uuid": "e1df2b21-cbcf-4425-887d-7397c0cb0467", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623327, "uuid": "5021433f-ab57-4e2a-8a50-7c579bb32a83", "value": "titanjr.x86_32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44809a40-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762620730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620730, "uuid": "9cdddc05-e691-4eca-bedd-6740dde0e84b", "comment": "Malware payload (RemcosRAT)", "value": "f227976c43b7d71a5b43efd897096381", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620730, "uuid": "586d7757-cb65-4895-912b-93992cac54e7", "comment": "Malware payload (RemcosRAT)", "value": "e2ae3121af3fd9874ba17612b0c012ca1962dfd918cc1d479384dad7bf469c64", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620730, "uuid": "c527ccdd-59fd-4614-8828-24a530a07d31", "comment": "Malware payload (RemcosRAT)", "value": "171ca9b8edd6d1ba63616681e0f9f9cfb4ca79c5", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620730, "uuid": "eafe6c5a-b7e3-49b4-9766-fd0f88493440", "comment": "Malware payload (RemcosRAT)", "value": "96b6ff66b866e5724a978800707bca3df5e48efe99b5fb01cd7a968ad79837fd3226b67a0b8399840f915914d862db06", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620730, "uuid": "482993be-92b8-4283-a3dd-df1aadc4b445", "value": "T118168A10EE3BA3CA955234D1DF793D01963EDF1F8605AB48EC62E8B005FC5434ADB99A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620730, "uuid": "49169988-cec3-4bdf-b5dd-e47f276eb9fe", "value": "768:4ffffqffffffKfqffffqfqffffqffffffKfqffffqffffffKfqffffqffffffKfG:O1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620730, "uuid": "26992dc8-4e65-40c9-827b-4fb405388cfc", "value": 4353662, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620730, "uuid": "0acdad80-48db-4b82-b80e-416cbfca30e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620730, "uuid": "41e8b25d-86ad-4c68-8ffa-334a38948b06", "value": "31agosto.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6263b2d1-bc96-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762601453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601453, "uuid": "8d27419c-8750-4165-bd92-9afe0d392016", "comment": "Malware payload (Mirai)", "value": "c40f239b62addc396941f9e3e2eed733", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601453, "uuid": "5e70eac8-9bfa-4671-90a2-42ba961f2ef4", "comment": "Malware payload (Mirai)", "value": "e3ca1c55a82868e34f9eaf5297e22e2b7c3b9cd08a81461bb532d6d9ab6fc92d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601453, "uuid": "ba230c88-cf8c-4537-9aa7-f2709242a1aa", "comment": "Malware payload (Mirai)", "value": "1173f93cfc40a0770783f61374989ecc05d59421", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601453, "uuid": "c94978d3-eafe-4bb1-912a-1cad602d9a01", "comment": "Malware payload (Mirai)", "value": "38e0b675bc218a006e210b7a313f42b722dacfe16b28d57d1d58cbc402bdd503be1992a7ee9a6cd399fe7c03077c1cbc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601453, "uuid": "78300b70-a8da-46b0-bd19-e02cbb320292", "value": "T1F9733A07798081FDC5AAC439437FB136C463B0BE123AB29B53D8FE262D0AEA01F5D955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601453, "uuid": "375a9e4f-8252-433f-8a51-8db3bcd1833d", "value": "1536:X21xbHR/B/wnd/BR7qf7DqsmztgeyBlsPUVjxfq/kxeM:X21xZB/wnd/jWDDOztGBls4xfq//M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762601453, "uuid": "f00b1b7b-9b1a-474e-9565-231dda259a35", "value": 80624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762601453, "uuid": "3c6f8ff9-17f5-48b8-b653-851b41cc4c62", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601453, "uuid": "dd99d56d-f667-4068-b409-653f8374ebbb", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65545847-bc62-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762579124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579124, "uuid": "284d28d6-629d-474b-820e-f7bb80467f4a", "comment": "Malware payload (Mirai)", "value": "3a3bf817a634a2275c44331671514d6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579124, "uuid": "e638bcac-207a-41cc-b96f-0678e6292d3c", "comment": "Malware payload (Mirai)", "value": "e40ebba75f3c7095b74fedfbd56a86628df76b9bed6621b961f3af416850e3ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579124, "uuid": "0f44bf06-036e-4f6b-a694-1c074be1c80e", "comment": "Malware payload (Mirai)", "value": "fe4d7ebd89176cc06481efa89829bbdf3557c830", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762579124, "uuid": "769f2273-d943-4ab1-8797-029a6524ad62", "comment": "Malware payload (Mirai)", "value": "911277d42f3e9125558cbbf18583252d73d2cc1944f2173bc92e986b4af17f5fad54212bd766a8e2765a94be9ebe7119", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579124, "uuid": "8e5e0e19-166f-4f8d-b84c-20b5f41e2e8e", "value": "T1BE13F11D29927521CFB01C377D248ED1722B1BFC9AFBB0B81918920C639C5DE6F7864A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579124, "uuid": "0ceb3680-a55a-47f5-aa0f-c35b9c35a928", "value": "768:A5TFTFcu6pHdRZLSslmCeh7SdL3il/VtrodlwDOvzMns3Uoziey:A5ThFc53E1h7uWRVMKivAaziey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762579124, "uuid": "04a46b8e-7b9f-4c28-ba53-ca6607306870", "value": 42032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762579124, "uuid": "bc610673-2f7d-49c5-bf1d-d4eaa9b85e12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762579124, "uuid": "6d6d55d0-be88-4b52-b7a4-56eba91e0425", "value": "morte.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ad51a94-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ngioweb)", "timestamp": 1762602218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602218, "uuid": "18953bad-0f1c-423e-abd1-b0368d3a2e1e", "comment": "Malware payload (Ngioweb)", "value": "f65141a8bb9c8cd5018d3a116fe83cff", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602218, "uuid": "9d8fa220-b23f-48a6-ae78-a1fc14823a1c", "comment": "Malware payload (Ngioweb)", "value": "e513b052f35bbac9e2678b3197867ee47ec0354c58af44d6c1574633f96de934", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602218, "uuid": "19b7fb1c-34a9-4982-b00e-acc1acb12605", "comment": "Malware payload (Ngioweb)", "value": "d409869449cfe7c2e9534c548e60507fc30b73ef", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602218, "uuid": "2e510dd4-7883-45e9-a052-5b26b6674f9e", "comment": "Malware payload (Ngioweb)", "value": "e39423187940939c7bb6c91f81838a645d392273f4a51be9614bc1f2eff5f9e9214fcd0735c34e0119be7ee8bf0e652a", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602218, "uuid": "b5394ff1-fede-496f-b465-7ada01105a32", "value": "T1D90140BA0CBD65D4A41DD740BCA61887D201E3CFB0ED1B10B37C7D72C0A9A14F0666A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602218, "uuid": "1be14508-912e-40bd-b58e-82ec255b9a9e", "value": "12:7RDV5MjwlCDk5MjwlCDX5MjwlCDR5MjwlCDXO5MjwlCDp5MjwlCD7bo5MjwlCD7l:1nlKulK5lKjlKIlKblKvClK4ClV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602218, "uuid": "a4c6c3d6-f125-4d6a-b3bb-f0c3779e60cf", "value": 824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602218, "uuid": "fbc22b12-4050-4cc9-b575-18136d40fa7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602218, "uuid": "b09b576b-1fd7-4a39-8fb9-eb5b6825b65f", "value": "router-atemi-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d532b85-bcb9-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762616530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616530, "uuid": "23d0ccd5-fa9a-4025-b02e-2360eb48e393", "comment": "Malware payload (Mirai)", "value": "3c5b83357f1f46cc3a705039d5e19ade", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616530, "uuid": "e4c75298-84d6-41fa-bb96-28f012e62b8a", "comment": "Malware payload (Mirai)", "value": "e57167e245cd9e2adc6ba3ae7f1b13423e87551f67d31a4e21c926ae8955d627", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616530, "uuid": "e9fa972d-04c2-4c0f-bcd9-541dba5f3a62", "comment": "Malware payload (Mirai)", "value": "16ef8cfb4be5ddd0df91a6d2ed8a65f5f0f6011c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616530, "uuid": "0c6d8993-1b56-4a2d-aefa-ddd11b414817", "comment": "Malware payload (Mirai)", "value": "3a611e2e1bdb9bfc7b7f17b088379b84fce78836ff54a50d45356ed2b81df1134302134d2460a626880f327dc656f092", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616530, "uuid": "08be79ba-b1c3-498e-9e92-5390035a9932", "value": "T1DDD22A46B981DA03C5D06277FB1E428E3B26536CE2FF33035E166F616B8792A0E3B550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616530, "uuid": "11537964-5fc8-46f8-934b-a6d81a080d2e", "value": "768:mjhE9AmImW9qwpjhY3PaVLVCGHoAm8w7:QEX67phWPoL9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616530, "uuid": "07ae1d67-77b3-4bd4-a064-29bf87885609", "value": 30596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616530, "uuid": "40ec0243-0b06-4777-b0b8-837ba8e7ba7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616530, "uuid": "54483d88-ed5f-4b56-b969-0474e5895f3d", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07cbd9ae-bca4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762607313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607313, "uuid": "9ed89886-c7a7-4b75-b09f-f0106fca0565", "comment": "Malware payload (Rhadamanthys)", "value": "285abce1f3d82da429611e9985fc93f3", "object_relation": "md5", "Tag": [ { "name": "176-65-132-69", "colour": "#93FECD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607313, "uuid": "954a107a-d28a-462c-9dc5-7237bcbc54ef", "comment": "Malware payload (Rhadamanthys)", "value": "e62d1bbffa90f426d1eee8fbb196327959219f2d140f92d1228e8561af014bb3", "object_relation": "sha256", "Tag": [ { "name": "176-65-132-69", "colour": "#93FECD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607313, "uuid": "9542d26a-deaa-469b-893d-2ce929586fda", "comment": "Malware payload (Rhadamanthys)", "value": "ca0433fdfab96fe16a65bb44a118f3a434b328f0", "object_relation": "sha1", "Tag": [ { "name": "176-65-132-69", "colour": "#93FECD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762607313, "uuid": "db5e54ee-48ae-41a9-bb4e-bd2d252263fa", "comment": "Malware payload (Rhadamanthys)", "value": "251ef2ad1db3ffe8131b63fe0be320dbd264fe5ecd99cd217bf0e876f3860d046d7a1d6db227dbaa93f66f6dda9c5557", "object_relation": "sha3-384", "Tag": [ { "name": "176-65-132-69", "colour": "#93FECD", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607313, "uuid": "f8c02012-fa14-4ff4-9035-df97530f98b6", "value": "T1A8D523BD68B5BD9EF5C04377C2852CB6DB3CB040D7993D9B8D205246BE8310D6F1A8A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607313, "uuid": "93620709-254d-4f98-a3cc-d8f494737364", "value": "49152:ADyDeQ1NAqVyo8WR674XXa4PTg93yah4aX/3ZsSU68I6r18g3qy:ADXQ/4Pe674XXa4PTg9p6ahA6yr2qd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762607313, "uuid": "53f7fa66-1940-49b1-becb-69d43c2286b1", "value": 2861437, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762607313, "uuid": "711be3f1-d0cd-408b-b826-7f604d5d8ca6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762607313, "uuid": "c30b34ea-d7c2-46c6-b6d8-28b821a0e166", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f9199b-bc5d-11f0-91c6-42010a9c0006", "comment": "Malware payload (PhantomStealer)", "timestamp": 1762577004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762577004, "uuid": "cfb53c3b-1f57-4fd5-a400-00b6927068b1", "comment": "Malware payload (PhantomStealer)", "value": "adde5b96122fe5b27fb03ada27295827", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot8499361235", "colour": "#7472C2", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762577004, "uuid": "4f75988a-1afe-46ed-bb6c-fe2004ca4b9e", "comment": "Malware payload (PhantomStealer)", "value": "e650efeeb765580304062ed0892048f7c208991cfb3988bd2298e27215e05e75", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot8499361235", "colour": "#7472C2", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762577004, "uuid": "549e0e93-bbf6-47a9-a0ae-ae2c90c9676b", "comment": "Malware payload (PhantomStealer)", "value": "cb46894465b84dc9e9cf248b3d89f92c590847ff", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot8499361235", "colour": "#7472C2", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762577004, "uuid": "ad0fa0c5-3e7f-45dc-aea3-274554674e4d", "comment": "Malware payload (PhantomStealer)", "value": "ab7881c40e91f4f40c610c86af7c57c9a4337808e43726d7101fb43efad76b9607fdf97b574343c5400fe06f8d543de3", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot8499361235", "colour": "#7472C2", "exportable": true, "hide_tag": false }, { "name": "PhantomStealer", "colour": "#45FDF3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762577004, "uuid": "95a348e6-b7f5-4d99-80e4-b573353a6ad6", "value": "T16C25CF3B8DB4994FBBF626AD1876372D10EA89199572C15EBBC343752B38101F3BC099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762577004, "uuid": "a90bfa5a-b9f5-4852-b2d7-f408dadaef44", "value": "12288:qt3QSnQEMTJ2Ls/rS0YVDPUFOUfWOrq6/KcVSGNhjdDcW0B1Vzbf7tnFWngSFX5N:HEYG0YxMz/ljdb01bf7tFWgkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762577004, "uuid": "7f933a86-e50a-48d5-8d98-13272e279350", "value": 986083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762577004, "uuid": "c56c0652-b30c-4adb-8d1d-ac2a1ae97828", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762577004, "uuid": "87365748-eef9-45e4-b014-eb091e250464", "value": "Teklifinizi a\u015fa\u011f\u0131da yer alan \u015fartlara uygun nitelikte taraf\u0131ma ivedilik ile iletmenizi rica ederim..vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "113d6997-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (CaminhoLoader)", "timestamp": 1762588861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588861, "uuid": "e48b3f99-f33e-42a0-9a3f-f6202293e3b2", "comment": "Malware payload (CaminhoLoader)", "value": "95b5d5a72416837ef859e62fb0a1d241", "object_relation": "md5", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588861, "uuid": "e12c8c6f-16a9-4061-83a6-cd68cd807daa", "comment": "Malware payload (CaminhoLoader)", "value": "e69e64ef9264ce48bb1147cc3648499a082a6127a6934784b1036aaa808dad0e", "object_relation": "sha256", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588861, "uuid": "19af7b5b-051c-4bbf-b46e-02ff345e735e", "comment": "Malware payload (CaminhoLoader)", "value": "1858030efbb46e3b1c809903d21e06583fc41cbb", "object_relation": "sha1", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588861, "uuid": "3bc59a40-4f3e-460f-acdf-257db0caebf3", "comment": "Malware payload (CaminhoLoader)", "value": "8169d366b089732f50a829bb5ffb9cc7b01af43d87b615578e7fdcbe40438a30b6c85f53e564ec8a16e7f639c5060dd5", "object_relation": "sha3-384", "Tag": [ { "name": "CaminhoLoader", "colour": "#3A2DCF", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588861, "uuid": "9f4cdef0-20c3-4438-9efb-8b089d04bebe", "value": "T1EF661265AB0951CD9C3A63BB0A943038BA188B8F9671F1DEB1375CDF16F244983F7821", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588861, "uuid": "ae8587fe-ee87-45aa-9986-9cc2d5685225", "value": "192:dZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZF:ZPR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588861, "uuid": "7d1621c8-94f0-470a-a5a1-1843d07d8e3d", "value": 6953875, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588861, "uuid": "bd12ee90-8ffd-44a5-bbe5-a90ed7671a00", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588861, "uuid": "310c2adb-f940-4a84-8f89-8a84d06da7bf", "value": "PO_E002594522.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d45da13-bc92-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762599753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762599753, "uuid": "fcbe13cc-bc55-491e-8e03-850437413f31", "comment": "Malware payload (Mirai)", "value": "2de5a85faa9abe71b96beb54c327262d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762599753, "uuid": "2ad7764b-becc-4a43-aa99-e35faf7ac7a4", "comment": "Malware payload (Mirai)", "value": "e6e5ed27944b9b91084a6781094af3c8fdb8f647150a502b94bf0b1d84c258d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762599753, "uuid": "a51f2fdf-8366-4c43-b929-4784a4b0efa7", "comment": "Malware payload (Mirai)", "value": "e4636f032d900c5410f1da17ca3e8af37daf9832", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762599753, "uuid": "cd26c7e2-5928-4470-9338-e79e22e23278", "comment": "Malware payload (Mirai)", "value": "a9667d19fee364207f8c7343ddedd6e8c0e8eddc96d6459a261a5c81a3833f50857dfa256b3aea73fcbdf7edea466f5b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762599753, "uuid": "ffcfad46-da64-4617-bd49-55410a526510", "value": "T113934A55BE41D612D6C125B7FB0E428DBB2B43A8D3FE72438E355B61638E86A0E3B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762599753, "uuid": "f66c5082-6dcf-4974-8941-ba8407027707", "value": "1536:KACqWZZXpYqUGveHE9W7V5HTWv2pQpZOtpemf:KA1WzXpYqfvGmKV5zZpiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762599753, "uuid": "6fe6e90f-7a8b-4700-8d18-9e8def5dde0c", "value": 89360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762599753, "uuid": "8c24292c-1fb4-440c-91ab-f2d040483394", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762599753, "uuid": "5727e586-d512-41df-be67-c44f8dd285f5", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f518f693-bca2-11f0-91c6-42010a9c0006", "comment": "Malware payload (PureCrypter)", "timestamp": 1762606853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606853, "uuid": "7235a346-b581-4f41-9c9e-5c39ef494736", "comment": "Malware payload (PureCrypter)", "value": "cbf43170a90365375acdf35dc8035a19", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606853, "uuid": "7bed3166-a89c-4cc0-a852-f44a20df8c44", "comment": "Malware payload (PureCrypter)", "value": "e77adb6c127732172a6dd5af1a8004e84e001ec726497a5f8dd292383a2e4fe2", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606853, "uuid": "952b1c81-4bfe-42ca-8e1e-3d1b5cecdcfb", "comment": "Malware payload (PureCrypter)", "value": "dd8c7e43d023c7ec0eb46e09a0e21c06a8448f46", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606853, "uuid": "b8e35066-53cf-48b1-a4bb-58ea93c350e9", "comment": "Malware payload (PureCrypter)", "value": "030b93527ce7b05e667c91aea223eed8da2308b368ed91bd8f59cb7ebde4118812e52cfa5408bd0e88345d1df0fa83c0", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606853, "uuid": "57bcc0fc-dcb7-4e66-845a-44865a8000cd", "value": "T1793633B0FDC98806DF88D1F96790CA9D05D3767ECB6342B87A4E504FA7BA183D125B60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606853, "uuid": "7890ad77-445d-482a-805d-53d99bd7d1b8", "value": "98304:2C0qREb95MSLUtRaDIN5gBC00SCc09ujXmBiA7i3yuWUxLh:8qRaPcNBZK09uj2gxyuWUxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606853, "uuid": "5e149710-8c7e-4e83-9a2b-d0aaff537852", "value": 5097472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606853, "uuid": "755e5dc9-5f9e-4d53-9d6d-41f7c78a1244", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606853, "uuid": "85910600-84ca-4dc9-9c11-476245057826", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d7375e-bc87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762595237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595237, "uuid": "8c90517d-b133-4382-9c4a-636faebe9e2e", "comment": "Malware payload (Mirai)", "value": "5d5e17dc802d23ee77d39bed48d4a385", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595237, "uuid": "1f25c526-0820-4376-934e-0211211982fd", "comment": "Malware payload (Mirai)", "value": "e79e69b9e60d236ab5a699ff36dbdcbb9018c3c7e71c639e284a4be7be7ce99d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595237, "uuid": "93271d10-8305-4dec-a521-abe1398f6a4b", "comment": "Malware payload (Mirai)", "value": "b07e0317164b6213832ad7fa843585c42a985825", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595237, "uuid": "85f07953-7188-4fa5-84ff-89f218492781", "comment": "Malware payload (Mirai)", "value": "ce8188c6c41b2e9c25b862d4c5d016c36dc07882ee2a3f29b0437e56ffb588548e67923bd8c88a31de68cd93982fabbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595237, "uuid": "4dd966f0-3512-43c3-9a8d-d766dba8bca1", "value": "T122735C0277580E43E5621EB5293F17E093BEF99021F4BA89294FDB0A4635E73254AFDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595237, "uuid": "cd265a03-3ad5-49d3-89f8-3a671c491ef0", "value": "1536:N9hUUIZ7FTVMWz5jXmeS9NXXRcgcI9TxIQ0:N/UU0/hB/iXvcI/G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762595237, "uuid": "ae39cd43-6c3e-4e6e-be1b-4d137b5eab75", "value": 80688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762595237, "uuid": "f36a6167-2e02-41f6-a8f8-3e8acbdb4b4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595237, "uuid": "eee84c85-eda9-4000-9a18-18998aa73f78", "value": "db0fa4b8db0333367e9bda3ab68b8042.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8811d3cf-bc92-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762599798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762599798, "uuid": "b396a274-cb0c-4fd5-b153-d8e47c82c673", "comment": "Malware payload (Mirai)", "value": "af0076ff02859e8feb976cc671d2a4ea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762599798, "uuid": "230a280d-e8b5-4760-8c99-67138f6049d1", "comment": "Malware payload (Mirai)", "value": "e856e7968f4fd0c314be0cb4b71450e56c9815af37133c17cf27df3b3542a32c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762599798, "uuid": "36ee8aa7-4feb-47bb-8495-f86847ff653c", "comment": "Malware payload (Mirai)", "value": "5f4273bfeb798605fdfa58393dbaa6b0d90bc290", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762599798, "uuid": "00076491-f7a4-458a-9f64-f89bb6dca047", "comment": "Malware payload (Mirai)", "value": "b300a8012823ae1a60b31a3f532244e4cf2fff44b9e7205a68a5f741ed82c35d7bae2cb54d1a59201de54e66f5be7377", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762599798, "uuid": "acaa350e-3c1f-4276-be1f-9d2f8e08c720", "value": "T1BB833A917D416612C2E5237BFB6E428D331663A8D2DF721BDD22AF103BC691B0EB7641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762599798, "uuid": "55f8f86e-28fa-4e1f-a157-0733904dc342", "value": "1536:p3kZxKSB6oWb2fbsfb+kTC5RKBnoyjiEsGTKUg8SIXNE27jFRTEO4TbzuDvjuFvn:p3kjhmiQD325ezAGWD4dE27PSkmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762599798, "uuid": "c9b5ae66-1105-4d2a-aa3e-79109fe893c3", "value": 87176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762599798, "uuid": "a9f7f9b0-e0b6-41bf-bf8a-cb0be61b7952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762599798, "uuid": "551163eb-f601-49b0-b9b6-ff716493c1cc", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d46833-bc96-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762601433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601433, "uuid": "0c020732-e4cc-4d5b-a276-255fe768a156", "comment": "Malware payload (Mirai)", "value": "1ca15ab37d22fe5329a28faaa0f45bce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601433, "uuid": "05030e09-4327-4ee7-99a9-01796f79b785", "comment": "Malware payload (Mirai)", "value": "e94fa4bf74ada4f4f30a756ee12752d05e64070f610e50bbd6958fd0d89f1b45", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601433, "uuid": "5b169aae-3f7e-484f-af36-2a1b4b09525f", "comment": "Malware payload (Mirai)", "value": "f40a6367d0787f556c411b6023a68602ada28e59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601433, "uuid": "1dc26f7f-fcbd-4a6f-a4ac-7440e62dad17", "comment": "Malware payload (Mirai)", "value": "7033b346005fd71c04bb17ef4a862a3b13f9f38c92fa35ffe739b0b04a80d9ab0fe743a5c583f52498a1beb2aee4b405", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601433, "uuid": "d2fade49-6148-47c3-9b50-0bbaff62f8b4", "value": "T13503F16E957FC4B9D096E0B3683ABB81FAE13B0338DB435A34B431179D258253675C20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601433, "uuid": "2bb1ae04-f313-4f20-95db-bf349cf99d2f", "value": "768:NkUD9pmD5dMXz34vbrzmAky8+qZbeyGGvv/J2tx3ak/Hx0YE:euvMdOoHzmAky8RbevtxxxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762601433, "uuid": "09bb994b-7572-4e8c-be44-335dbfcb3f68", "value": 40068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762601433, "uuid": "cc0f5fdd-a6f9-429d-94f1-16b2c821917d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601433, "uuid": "c2b7e743-4461-40b1-8dd4-045aed117707", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2603e6-bcae-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762611668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611668, "uuid": "3648d5be-60f0-427f-8bb5-039f9067e066", "comment": "Malware payload (Rhadamanthys)", "value": "79cd544f9b664a112cbc47b9d1f5b068", "object_relation": "md5", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611668, "uuid": "0299ccbf-0645-44c5-873b-b8d06ac09bb9", "comment": "Malware payload (Rhadamanthys)", "value": "eb63c0a295fb8a630fda49318f90f65caed7cdcfdedd6233304aeb51217b9a6d", "object_relation": "sha256", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611668, "uuid": "501c4a9f-8e3c-4cb7-92b0-07c2faf32c7d", "comment": "Malware payload (Rhadamanthys)", "value": "d2887f255ea47016448c2a521cc67ef2ccbe87f0", "object_relation": "sha1", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762611668, "uuid": "fc5eb7cd-aa2b-4330-a624-328c8e6336d7", "comment": "Malware payload (Rhadamanthys)", "value": "8aaf5c9533286dd4add8707df3326995501aecdc7b0a21d7ff2838f4c5ac3f14fa6e66b7a0b6679d64fb5f3fe4c85f1f", "object_relation": "sha3-384", "Tag": [ { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-2025", "colour": "#C019E2", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611668, "uuid": "43304fc8-2440-4283-835d-2a7dad2c9c6c", "value": "T14EB73358F7891219E7CBDDF7EC4A2B9D14B3D08BD322B60FD26411104DDA6BB5B0E24A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611668, "uuid": "3dfe84d6-0b34-426f-94dc-3a21988f2521", "value": "1572864:ObMbty2DnOSS5r7We6kYZ3IysBbeOcpcp0qGq+f:8Mbty27MdyFvZkb/xOrqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762611668, "uuid": "87c59f29-8c06-41df-aee3-770f5d850fd9", "value": 51847782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762611668, "uuid": "8b64fba4-ea7d-42ba-b134-4acbc5605864", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762611668, "uuid": "eefaae98-6709-47f6-9356-14da06b27e68", "value": "#Pa$$w0rD__2025--0pe\u0274_Set-Up!.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779fe22f-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620386, "uuid": "7b7d2073-0c42-4b45-a7a7-a673366d28be", "comment": "Malware payload", "value": "75a341a13e13f70c598d9a9b4bbe472c", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620386, "uuid": "35b7fa90-d444-4f07-9601-3ed84d078979", "comment": "Malware payload", "value": "eb92fd512aced6503edbe52a19c8b5d225e18fa65a079e250c8ddb90f387c4d4", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620386, "uuid": "a73a4ddb-2a45-4a84-9d80-69139449c8a3", "comment": "Malware payload", "value": "01fb331e4e367416dec9a68ece4f49b969d237f0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620386, "uuid": "8056ceaa-74bb-48e7-b10b-d84f3d992f2f", "comment": "Malware payload", "value": "faa990455aed2561794c432fb485875afa57a8d3f80d010b42a0d6472be03aee4b846165a11af5009047a64e0352e5fb", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620386, "uuid": "b9662cbf-28e2-489c-ab1d-354594dc663c", "value": "T186E447BB3912095C869513F92D2536CE86ED2109F032BC7EE6F772987A75148F2BC61C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620386, "uuid": "8928d9d0-085c-44c2-9693-6afab24d719d", "value": "12288:nv4AHhX6S13rskySglmxZbhYzlk5ujAwG4IPYhTDrQ:dHFBx25qbdG24lh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620386, "uuid": "7bcb3233-41f6-4155-a5b5-b2f59978fb53", "value": 659665, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620386, "uuid": "d0c5c43b-8049-45c0-af2b-8ffd3ad4ee12", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620386, "uuid": "201930f5-b6f7-4bd0-9d02-838a833aac68", "value": "Manikaran Payment 05112025.jpeg.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fc3ee0-bc44-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762566381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566381, "uuid": "5cee3f09-9465-4408-9c01-75aea33cd7bc", "comment": "Malware payload (Mirai)", "value": "9db6cd605244642a821aeca70c10d16e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566381, "uuid": "a8678327-2ae0-47d5-a7f4-7c13f93140f7", "comment": "Malware payload (Mirai)", "value": "ebc6140226f0cc4697244371ea5e53ad8dfe91fe78a6fcef7f648ec535862a49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566381, "uuid": "5763d6b1-e017-49aa-b551-8f4391b2b3de", "comment": "Malware payload (Mirai)", "value": "e2407f04e8189da1907b756684e3667d6f81de39", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762566381, "uuid": "d1cdd1e5-b984-44ac-b3d1-54f0da234910", "comment": "Malware payload (Mirai)", "value": "e613c094ef2ce16f93263142f06fd8a32c5260185172eb007d340328b6be444a35fe7510454844e98fcbd01724a4ebd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566381, "uuid": "9a0e84c5-0ece-44d5-91f9-c878f35d7e9e", "value": "T1C8834A0273580D43D1675EF42A3F27E583AFE59122F4FB89650EDB4A81B2E73154AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566381, "uuid": "07fc71a1-df1c-4cda-bed6-f40e4d240ebc", "value": "1536:SkBVCcuip7JKLsnEF59c+wuoP1s5Y26g0k:xVCu9G9quH4k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762566381, "uuid": "bce79071-ce5a-4e2a-997f-66a6dc633fa6", "value": 87624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762566381, "uuid": "c940df37-533c-444d-b63b-3b06dad7f416", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762566381, "uuid": "a1b6d7c1-4add-44ce-a22b-633993c70835", "value": "morte.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2eab818d-bc6a-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762582468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582468, "uuid": "3c3eda2c-dfa9-43fb-83a6-6c20c0f256f6", "comment": "Malware payload (Mirai)", "value": "a7f47fcd2389b115f3952e42c72fc18b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582468, "uuid": "27d32847-27d1-4a8a-9149-aa9a2db61941", "comment": "Malware payload (Mirai)", "value": "ebfc070a6f27ce801736f4cb09a8b06c9a6b33a4dd7547de37e83cf674add323", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582468, "uuid": "4c4d24e1-f75d-4be9-a02d-74ddbb0b330f", "comment": "Malware payload (Mirai)", "value": "3dc9893deaadd2b743b9ea38b5b192ad6178db67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762582468, "uuid": "dd799908-0708-46a6-94bd-0aa7d141216d", "comment": "Malware payload (Mirai)", "value": "8a0e9cf3678d0a6e293a005cb7038453a65a1d9f86fbce9cbc9026f5bd7dd7bc3cac3954318fdc08edd987e702effc9b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582468, "uuid": "edc7aefd-1ac2-4698-99ce-9c84380f57be", "value": "T17AA33C46B9918E12C5C212BAFB6E514E33136FB8E3EE3212CD24AF6173865DB0D77416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582468, "uuid": "4be87374-90e6-4a7d-aaa4-3a38c0c66fc7", "value": "3072:jcfHX5AZQh+KzhafwNMVzgMdOFRTo+oy:jcnh+K9a4m+MdWE+oy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762582468, "uuid": "6948934a-0d60-4609-8a51-ff8707dc6020", "value": 103168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762582468, "uuid": "b1c7755e-9ef2-4fa7-8b59-e76bafabb697", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762582468, "uuid": "002d1f8d-942e-4eae-a63d-9863b95b05ff", "value": "morte.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33aa41c5-bcb4-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762614259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614259, "uuid": "76b0046f-d264-4bc5-99e4-29e353f1a1c6", "comment": "Malware payload (Rhadamanthys)", "value": "0d890de0d3866aea14b286ce5e52ade4", "object_relation": "md5", "Tag": [ { "name": "23-94-252-123", "colour": "#E7231F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "softlysky-com", "colour": "#CA7238", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614259, "uuid": "892f86dd-f08c-430e-a199-1f5dc0d0be78", "comment": "Malware payload (Rhadamanthys)", "value": "ec5744a8477c6506099751a74c85c6087f737044a51bd6e2702f7555ee61876f", "object_relation": "sha256", "Tag": [ { "name": "23-94-252-123", "colour": "#E7231F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "softlysky-com", "colour": "#CA7238", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614259, "uuid": "a0582ece-1f07-4462-b8b5-6719b649305a", "comment": "Malware payload (Rhadamanthys)", "value": "870ad14ae9b8d2d90f94af7e6ed29ea2c1fe1a55", "object_relation": "sha1", "Tag": [ { "name": "23-94-252-123", "colour": "#E7231F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "softlysky-com", "colour": "#CA7238", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762614259, "uuid": "bee2a5c2-d058-4d1d-ad60-596a21d38558", "comment": "Malware payload (Rhadamanthys)", "value": "d72b5a8b129fc8cc6ffbc634d849ee0bfcebf265dfdc70d13c66fb3f4ddc4a17975a3652779997571c6db18d0914793b", "object_relation": "sha3-384", "Tag": [ { "name": "23-94-252-123", "colour": "#E7231F", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "softlysky-com", "colour": "#CA7238", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614259, "uuid": "35ba1167-ec88-4c33-aa48-bef13120b99d", "value": "T111852343C2E42562E8770B7115F24227A67334526F3562FF12EDD2E54BA32D0AD3A72B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614259, "uuid": "2bb2b4ea-8bb4-4c69-b012-fb05464df44f", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614259, "uuid": "95f89bbd-374d-46d1-854d-4a340b509bb1", "value": "24576:0FZMm8TNV8dl9+MXb1WrdC3ex6DQ1YG79Nht5T+/bEBVB4h+a73WIrIBrARVT9Iv:bdV8XR1WRREQ1YC+jGV2+a73Z2r6f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762614259, "uuid": "62d1a71c-925f-48c9-b23b-28eaa390e3fa", "value": 1725328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762614259, "uuid": "77485546-c293-407e-b1bb-bf94604f27d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762614259, "uuid": "a9a085d9-7110-45b5-bc4f-30b0fc52e2be", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb542cc1-bc83-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762593522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593522, "uuid": "3c675e0c-bf94-4494-9492-fe392510c988", "comment": "Malware payload", "value": "0256e79adae34acd4e016cfec4aeba38", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593522, "uuid": "87a98f7c-1628-4da4-a8d2-72a7ab5bd4b5", "comment": "Malware payload", "value": "ecf58acaf11bf3aa20dbec39d9f83297fce0d6ba1230189a61031116c7a9b4dd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593522, "uuid": "e08d0e5a-7a23-47bc-b0b9-8b4a02e79598", "comment": "Malware payload", "value": "a26cc85413d00b989565e8c666a5e0df29c1ef40", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593522, "uuid": "bcf20ee5-84f1-4f2f-b0d0-8833b93853db", "comment": "Malware payload", "value": "903a6a1370988b67b9a42e1fb47d2e70acfd05c2c2f8e3d53aad06093c806bab020ce8220c7008ec0f8d499411b34b86", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "ClayRat", "colour": "#03CA68", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593522, "uuid": "3f211679-e291-4d4a-a817-57588fc7d584", "value": "T1EF460146F344952EC8FB13360A3A12601663CD2A8F83D797296CB37C6AB75C81F65ED4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593522, "uuid": "e8824a6d-4da4-4714-8a9d-a25bacc51cc1", "value": "98304:YPJEhVDPFED9pHW4zsvmPmmhKfiN5ikYgIpPo3wojEuhZ4jtXKkNw2tWvxSk3qP:YOAnzNfhKfickYg2Po3w5uhZQtakNwvg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762593522, "uuid": "9d947499-0b10-4931-8acb-a77a5e3e761e", "value": 5706521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762593522, "uuid": "d39d46c6-10ec-45fa-99c3-aa00f8eba57f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593522, "uuid": "3965a80f-64f4-48f6-82d2-303991fc8ac2", "value": "UrbanRoute.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15b94e2-bc8b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1762596941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596941, "uuid": "d16222d2-223e-4334-8aff-58d3e2afd4cc", "comment": "Malware payload (Stealc)", "value": "4df029a14b4d271974bd48b7c2ddc6f5", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596941, "uuid": "78f2d4fb-08aa-401f-89c9-62cc8f00ceaf", "comment": "Malware payload (Stealc)", "value": "edd4d42bf28808c12572eb00c8aa3c8ceab95f65026c09490425606afe53a2af", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596941, "uuid": "bb3188f3-85ff-4560-b5e8-c16cca120413", "comment": "Malware payload (Stealc)", "value": "5d6498fd5d9b987057032bce491270e5606f5bac", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762596941, "uuid": "c003b6ac-a95a-4e46-8659-739961bfd8ab", "comment": "Malware payload (Stealc)", "value": "bf2e7bef9de866b9a86fc99cdf868096046c73697ce9c2b383e15382565855dc00af2c938669c1df03bf1aa224cbe5c8", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596941, "uuid": "d4c4ffdf-79fd-467c-8490-4973c6f3d206", "value": "T160E5232A22932E48D6B84FB52918F338F7958C517F7BC24F7B2438B9AF30654495335A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596941, "uuid": "26edbc9e-7e0c-40cb-b4b7-aa889c45358b", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596941, "uuid": "9992f1eb-44e4-46e9-9eb2-33ce86877e31", "value": "49152:IQPzd18OnCXugXcD6O3B8Pzx38GPvl9w9pW4kzRr29MxoiTqCeLZUdglXdcKeN3u:I8fCXhcD6OQ/rKkzRr29MiCIZUql2TVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762596941, "uuid": "04184290-088d-4823-8186-cd72820cd611", "value": 3125824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762596941, "uuid": "26846a9d-594d-439b-9f3b-e417c133606f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762596941, "uuid": "e353949c-1e2b-462a-8c3d-9fcf7ac90730", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c936636-bc93-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762600047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600047, "uuid": "ebc35d5d-fcae-43e0-9c81-5fe88de03d51", "comment": "Malware payload (Mirai)", "value": "25a25551a3d7b3f7ecd5bc59848ba2eb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600047, "uuid": "be25f1a7-30db-42de-b33d-9bcd5af34607", "comment": "Malware payload (Mirai)", "value": "eeb5646cc6ddd679a4126bc8c10010b813818f129a533f65fcf170fa79f27ce1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600047, "uuid": "0d3306f9-b731-4249-941d-0ae582f9b957", "comment": "Malware payload (Mirai)", "value": "52e70aae998cd4ef110e578e78afb32ef6308456", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600047, "uuid": "4f007f28-f0c9-4f7d-b34b-f0714af63a7d", "comment": "Malware payload (Mirai)", "value": "8fc4acd41015be7388a808678d2c0e412a6970982bc5720d6af18ed6702d9c855a497e15e8e410f01a38eece95ddb4ce", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600047, "uuid": "45743f5c-a2c9-4e8d-a8c4-e51fa1c65be1", "value": "T170A36B21B6B9192FC4E054B612B35322B6F6429E1874AA2F3EB10ECDFF115D027277B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600047, "uuid": "20361082-2c82-423c-90ef-e001ce32fe08", "value": "1536:gxCbSAPaMALDJVSkfAC3FiX/bMS52sCdZ0oKaJZ3ytHNz5Ym5c/41twPlDtpCX7:FGS4mC3FyUiLIZi97YOcQ7RX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762600047, "uuid": "fa8fe804-f2d3-4799-8715-8583f5e65321", "value": 103792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762600047, "uuid": "ec82ab4a-ad48-4039-bc32-68776a4af186", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600047, "uuid": "7bf80e30-e5b2-47dc-a584-0b1b6939b30d", "value": "executor.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9183fe17-bc66-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762580916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580916, "uuid": "4307ae16-95f7-4f01-8997-2eea6b5d504a", "comment": "Malware payload (Mirai)", "value": "80a5f0e7b3f52aef5dac6f50fa7cda65", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580916, "uuid": "d8ca6bee-257e-46b7-8353-c00b53a3627e", "comment": "Malware payload (Mirai)", "value": "eef5bcc48b9e0a7db4cc164a652d73c25b9d793ca1c4ea37795ddd2f7be1c94a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580916, "uuid": "ba67271a-84c0-4bb5-bcab-8f89bfeb83da", "comment": "Malware payload (Mirai)", "value": "97b0d50846133ac7517c501e2623bb8dc683f677", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762580916, "uuid": "48e81508-be17-4f58-87d1-41282688ad07", "comment": "Malware payload (Mirai)", "value": "30ef5d4d8c5c48fa648b32d1eb170094e7bb756f91ce4859ffaa35bf6190812aa2c5861786151fed8076b6df2232b3fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580916, "uuid": "05ace1b9-9e75-4659-add7-d139eb38aae9", "value": "T184043B56E6408B13C4D32BB6BADB424533239B64D3EB730A4928BFF43F867990E67505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580916, "uuid": "698a2264-f619-4ffb-9f20-ed1279af43c4", "value": "3072:3KlAI9e/KmSaA2mLHnGdkCvgtY9+AzdIGuCb7N52M/9j+O1Z5Bj:3Kzo/rSaA2mLHnmkCvb9BzdRuCb7NAMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762580916, "uuid": "f8a935f7-2865-42bf-80b6-c9d77a20c48b", "value": 186471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762580916, "uuid": "f8852dad-0707-471a-9abd-788a050548ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762580916, "uuid": "d8cd3640-9850-4c1d-bb13-99d54cf79805", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ede599fd-bca6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608559, "uuid": "f8e56803-be3a-423f-926e-590c96d57a8a", "comment": "Malware payload (Mirai)", "value": "f0ad34352a5f3fa211d0d9da263b1727", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608559, "uuid": "fb596b89-db1c-4c74-a67d-1d58358d2fc9", "comment": "Malware payload (Mirai)", "value": "eefbfbf65e024fe52532cde30c41b702d0721e5b6e53f10150f833dded02fdd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608559, "uuid": "82f4c9e1-4b91-4936-805e-5eb11f4d4171", "comment": "Malware payload (Mirai)", "value": "e61c3a6c1df7904d1eaf36ffc2edb56f299d153a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608559, "uuid": "90c553de-c89c-45a1-b555-6e13e6dcfbbf", "comment": "Malware payload (Mirai)", "value": "8225cf8c0147122c74cacb238a5513602ce3f01f252d6766c77f346a2a49618ddbbb944aef62e755695be4adf46a28b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608559, "uuid": "e6d0d96c-ce95-4022-abe3-cf2229e6ada5", "value": "T12CD3BF97F24B2A91C85202F007CB7BDD2A53A1219EAB9EE72C2F753B49791CB44073D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608559, "uuid": "2ca85a23-7797-4335-8908-abe706aaf73c", "value": "1536:IZ9LeGAOOUXtXUt0cVlY0097aFleyFMMFThxFnbyfWJxZJrKgI4x/LWYb:29LeGA29XU8d97it5VhHbyWTKgI4xq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608559, "uuid": "1d72d518-ab1d-4fc7-a99f-ba7adf44ed14", "value": 132560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608559, "uuid": "d4f7d8e6-1802-4025-b29c-9acb441bc666", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608559, "uuid": "5282e168-f2c7-422a-9e20-efc90f7f76b0", "value": "executor.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b618b6d-bcc5-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762621547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621547, "uuid": "6aef29a4-0f5c-4f06-b102-5adfb9459149", "comment": "Malware payload (Mirai)", "value": "0e32a30b06f59fb6ca3e2761eec92a87", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621547, "uuid": "2d94824f-21a8-4673-acdb-7ff3d1f77082", "comment": "Malware payload (Mirai)", "value": "f02fdb03a4faf2769c6bd75a5acfd9f34d36951a3b3ad2f9febb87dcf2d7a3f4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621547, "uuid": "a820c4f4-62c3-4323-b211-65080350a3d6", "comment": "Malware payload (Mirai)", "value": "8c096e901e6429426982161d88bdbdaa53437c2e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762621547, "uuid": "4fae84f2-bd7b-47a2-beb2-5eec29cf797d", "comment": "Malware payload (Mirai)", "value": "370fff70479655db8e3a15382553bec65718a0529d1ec8235df0fa58c1e8feb59b2df4e6967e2b91dc017ac229a5386f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621547, "uuid": "a6d53948-a65b-4fe1-af00-e8a46b7a1c0c", "value": "T1D1243A42EA408F13C0D717BAF6DF4245333397A593E7B306A924ABB43F8679E4E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621547, "uuid": "aeb4427d-31d4-4ea0-82a9-13ddd58de76c", "value": "6144:tvERpNp86wShWU3NmaDTsOZWuv7wKeaxrkQ9M/RBGnwmH2WBLB5n:iRpNp86Z3NmaDTsOZWwMQyQG/enwmH1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762621547, "uuid": "86a9eaba-cb72-46a1-80b0-d5717480eec3", "value": 225035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762621547, "uuid": "6e954f0f-b172-48fa-96a3-ba81815aacb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762621547, "uuid": "1ee68826-6f38-4ce4-b1b9-ba28dde72031", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc47d900-bc4b-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ngioweb)", "timestamp": 1762569498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569498, "uuid": "a3873625-9c74-47ba-835f-d3312e58de60", "comment": "Malware payload (Ngioweb)", "value": "f529a2f082e338ec467222c6c3865bc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569498, "uuid": "4543b145-8dad-4187-9fc9-0fa452fdbac3", "comment": "Malware payload (Ngioweb)", "value": "f08d8c43beedbc8d45ea133b44dd09e13d80d725846eac7615141dee9064907e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569498, "uuid": "98f94918-547c-4387-bf04-6d9d9cf5b1c5", "comment": "Malware payload (Ngioweb)", "value": "1993b65d35e47fce3427216ddef30066603707d5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762569498, "uuid": "7a1c0484-cf00-4aa1-a79c-43c147b71e46", "comment": "Malware payload (Ngioweb)", "value": "33c2af1113e7be5900ca02accde0b881d4ac02a375e26302241294f5822d6ecdf297655e0d16ebe78ba5e025ba8362c0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Ngioweb", "colour": "#D09D71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569498, "uuid": "8c84cf57-3ae3-4647-9460-42bac3eb9d31", "value": "T1F3730A55F880CB61C6D526BAFA5D428C73230B78D3DE72059D24AB353BF7A560F36902", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569498, "uuid": "249278bd-fd9d-4b77-9166-20fe9c9eb300", "value": "1536:x86RsUMiveqQHP2htLDTggI3OMEbwtrvLrxQJaNJSFOg9hB1Ir:x8bZi3Q8tTMEUNLwjPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762569498, "uuid": "9656bed9-67db-4614-b4ab-206c2ea45fb1", "value": 79104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762569498, "uuid": "6171f9d1-2e59-42fb-87f8-0a591be925da", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762569498, "uuid": "98cc08c8-009a-4d4e-9cc5-2e0d53ba3a52", "value": "frost.armv6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956a0cfc-bcc2-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762620436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620436, "uuid": "d89f6159-d7f1-4db8-afa5-2c7474fc05ca", "comment": "Malware payload", "value": "5c1ef200af81edd53d662eb297c78a88", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620436, "uuid": "e95d9344-b64d-41ed-8563-bbf0dfe91108", "comment": "Malware payload", "value": "f0c701e1915e2623fee87920b7ee51cdc153bf15781488e94e38c9a2d13b5378", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620436, "uuid": "cdc5d19f-2f5c-4a46-8d3f-88e0a673ad1c", "comment": "Malware payload", "value": "31d06da45c1921372211b84fb3cb27a9a88f62c8", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620436, "uuid": "699cc22a-c7c6-414d-9226-7975ab70e6cb", "comment": "Malware payload", "value": "414660da4c55a031732d8fbf84ed0fa8706f4769d961d9ef4d3722878b84e56eeb329b190102a1e5305bd0faff0d8982", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620436, "uuid": "cd7036d1-a161-4277-915c-9c4f6a1eef9f", "value": "T18125E0EF371F185AAA8D10782A1EC6EC9A4C7120F1123D7DF4B6789C4947518FAD9B8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620436, "uuid": "af9afd5b-44fb-48a0-ac6b-f9c84c6bfcd0", "value": "12288:40mYYFKsrctZPO4dhHj+C8WQlxtGrQlllKJMlAq4XZxsGH2WVuqRYX3+SaBvbS5q:4bKswnO4dMC8W1QnlKmlatS3+SalbS5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620436, "uuid": "9e8e03cc-f01b-4318-9445-a873631bd21c", "value": 979770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620436, "uuid": "1ec80bd7-5f57-47b3-b7ac-6a53ebe3ba74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620436, "uuid": "4a407c39-a596-4954-9e38-ceb5f83b9777", "value": "INDONESIAN MARITIME AUTHORITY.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b31cb1-bcf9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762644037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644037, "uuid": "de5e62bf-8809-495d-b704-59c2ea16e739", "comment": "Malware payload (Mirai)", "value": "fc9582635bf1522429abf664fd06d6ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644037, "uuid": "1eb37c60-37c8-41f0-84e0-3cd32f974004", "comment": "Malware payload (Mirai)", "value": "f17f977aa428a675fe52dc2e6a3db196541b87c343ce74844dd5462aea9fb197", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644037, "uuid": "4c0fb6b4-a247-4715-89ac-6d59b451e1de", "comment": "Malware payload (Mirai)", "value": "018164db0855c0a559ca4097051eed9f79ff6857", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644037, "uuid": "ddbe63c9-a83e-430a-88e2-d449f6f26046", "comment": "Malware payload (Mirai)", "value": "b595c8a7e912a942b41e669508be107cab2ff31d3c8d98cef9befb2f3f4c7705e3f6af571f2baa6d76304f601c4bd0e9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644037, "uuid": "0ca7d22b-c3ad-4050-a6f5-8e0ab2034264", "value": "T13AC3D709EF654EFBEC6FCC3706E90B4524CC691612A83B7A7674D42CF60A14B4AE3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644037, "uuid": "78682fc8-d81d-4919-905f-e09242268107", "value": "1536:E92NylFeh7go837K2eKxM43VeooGbrZfo01IZwyNGUhYZyWRWvSLi4oXTPFDjemQ:E9BlQhUDKTkzlea2rYoLXPFB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762644037, "uuid": "12818345-7d6e-474a-8d95-b8a503e212e9", "value": 123784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762644037, "uuid": "a8731344-57d9-423e-99d9-ed41da0ac1a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644037, "uuid": "adb3250c-45b7-424a-b01d-052365333426", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129c34cf-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762620646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620646, "uuid": "2dc6cac5-ad4d-434b-bb10-d5b41b1853f2", "comment": "Malware payload (RemcosRAT)", "value": "ea0ad51d363b927e826a120fce06af75", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620646, "uuid": "65a0b255-c046-488b-818f-29b75f1161bd", "comment": "Malware payload (RemcosRAT)", "value": "f36fa0d933bc573a7d37d5dfcf503fd6d47ee5294dbb2fcfc4f8c6bf4d67e152", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620646, "uuid": "0505a460-926d-437e-b458-78ac976d9d47", "comment": "Malware payload (RemcosRAT)", "value": "e824dcaf5da2c9241ddc336cede05e4c60ea115b", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620646, "uuid": "4edaa716-328c-4021-b0fb-13463a949379", "comment": "Malware payload (RemcosRAT)", "value": "bea3e72ffd88038b9f7c77e7d197e72ec171f768d2616ffd2288bfbe74e5d3a68182f4af9963a73dd6a58f5366084657", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620646, "uuid": "6c9cff2f-8db7-4fc1-aaab-f12d55183aea", "value": "T1FC72443A955CDFF00B3E21F415873E1560A09326A83ACD6CE8DA81547F2B7519FA78EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620646, "uuid": "e42f6d86-e399-4583-b548-1354c3360355", "value": "384:XXeXzWx8tphfhc9AuVTnMZBM/7AoWSgmLBVNFkGDXX8MFKw6ML+wKmBZWwMpNrq0:WzBFCVjMZI7etABnFkGj8MFKw6MlKmBi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620646, "uuid": "39b65c5e-cdc6-4fea-a2e0-57ed231d1880", "value": 16167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620646, "uuid": "6a364a5f-c9c5-454c-a199-88f2cbb1a441", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620646, "uuid": "4c4ef779-9516-4671-aafb-d97e0fa84a20", "value": "Invoice_301.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475a7377-bc88-11f0-91c6-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1762595394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595394, "uuid": "f10acb10-b0ad-4883-9ff0-9230f0bea9b7", "comment": "Malware payload (Rhadamanthys)", "value": "eb32e81c53cec03e329862a8850505cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595394, "uuid": "8a1fd37c-5ae0-4b1e-8f2f-0a323ff8b06e", "comment": "Malware payload (Rhadamanthys)", "value": "f3aee4384a06a63d46be79a241b7d625fadf93669efedd073556a5f025287c1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595394, "uuid": "209f5497-8473-4914-b6c8-1c098e4ff10e", "comment": "Malware payload (Rhadamanthys)", "value": "cfad1f43daa423c7ad22e2888f1f2929ced4e5e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595394, "uuid": "0e7c902e-ec50-4c08-8d4a-a367b96fb1aa", "comment": "Malware payload (Rhadamanthys)", "value": "8537c77a67a1be9de8cfa604b93cc5c43b723d1c685dce291417a8490d657fd354964df53e59288133313dc10e35ff22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595394, "uuid": "f6d1bb70-04a8-4a73-8f48-0942a27e141b", "value": "T1D6A5339696F34C76D85C2FF108F543A30A21FCD11EB9C2E72BD9F9961423E85353622A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595394, "uuid": "5cf0c509-b477-47bb-9024-1c09d82c8724", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595394, "uuid": "42ccacf6-eed6-4d9d-a540-0dc59e0a30bb", "value": "49152:SKzZFlYCLYkRmwq2d0j8FI+HN9RZHQGHCXxjB+NPd4PtMllI:nVrLYcq2LFFHNHxQGHCX6dktMle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762595394, "uuid": "6694c241-387e-4c04-a45f-195d28247e4d", "value": 2182256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762595394, "uuid": "4dc28cc6-2684-4115-aae7-96aa55988839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595394, "uuid": "3101c4c8-3396-466d-b516-fbccdf250242", "value": "G\u0430laxis.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3829035-bc95-11f0-91c6-42010a9c0006", "comment": "Malware payload (Ngioweb)", "timestamp": 1762601132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601132, "uuid": "5d1ad3a2-aa58-4cf9-8783-debe6c4c5021", "comment": "Malware payload (Ngioweb)", "value": "634668be5c5bcc2f1488e2c2d08edf31", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601132, "uuid": "c5213096-4d2b-4295-bd60-7caa77abca02", "comment": "Malware payload (Ngioweb)", "value": "f423bf3c71770f069ab5d6bd0109c000c0f97234ee6a8d543d769d195e18ddaf", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601132, "uuid": "f36eb7aa-e78e-4eba-9b58-9a779ad18b51", "comment": "Malware payload (Ngioweb)", "value": "c604845251427a277c56522007af30805a11ce02", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762601132, "uuid": "2ee303d1-2804-4618-9411-b336ffb81c74", "comment": "Malware payload (Ngioweb)", "value": "dcb8e14cb975aaee9ddd1849fc259de18fe3c30a227fb22857e9ddb4daf01492cfde9c7a19fa7587d90a7f5f31156205", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601132, "uuid": "1b18e4e7-bfec-48a9-8b9f-ee25ae1c09f3", "value": "T19F015EEF23871396F238DA0A7868BA92715D82C228C47B1461CD2B3FC0EF621F605F51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601132, "uuid": "617385d0-faf5-47fd-9bee-d2a329b24258", "value": "6:lOz6/F/K0eCT5Kr7MECZr7MECyr7MEC+Vr7MECXrr7MECCXr7MECfTbVr7MECfTK:78CVbECmECzEClECXoECNEC7bqEC7kH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762601132, "uuid": "f864ad90-e6ae-4d44-bedf-c9cda5da4678", "value": 832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762601132, "uuid": "4dc44e8c-533c-46d5-a3cc-d4291538603a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762601132, "uuid": "e1a3dd8a-cfe8-452b-a3e0-e9aadac287a5", "value": "ipcam.goahead-rep.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1efcefdc-bca6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608211, "uuid": "39f5d681-8253-47e0-af03-8ab47cd77538", "comment": "Malware payload (Mirai)", "value": "304b14af441c6811d77aa718e726da79", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608211, "uuid": "1fc9e3f7-fbb6-4171-b01d-e907b8ee92c9", "comment": "Malware payload (Mirai)", "value": "f5078af8462ce355cb6867e90a426c394ae40802a42831d2e1e740090e8b18e6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608211, "uuid": "3daba04b-f87c-4e28-b62c-9fe079e2b9e5", "comment": "Malware payload (Mirai)", "value": "8309db5b3d4b7ac7e85e294ebb00dedd776331bd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608211, "uuid": "481b9b5c-06f7-4f4c-8e0c-6e5056111800", "comment": "Malware payload (Mirai)", "value": "1dbef6af5fcb70c3738920190f6be5ec2f3091540c9ebd2d6d20941b3529f200e87cd84f9218e66162cf9e6451aefed2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608211, "uuid": "3f76ac3e-1633-491e-9252-4feb1bc0ab44", "value": "T12D834947798080FEC499D17497BFB536D473B4BE0239B19A23C8FE273D09E605E2A552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608211, "uuid": "c811b535-3463-4cbe-b2ef-d0d914083f5a", "value": "1536:8/4MezAOnszqlE8qYqU6uzFRvUKIaREhWoewd/H:8gMPOnseliYqmzFRQaREhWjsP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608211, "uuid": "4fa17577-007d-49e3-8f15-82782dfe0efe", "value": 88144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608211, "uuid": "a6fbddce-3efa-43ed-8ae7-06db7afcf949", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608211, "uuid": "1e7d9c7a-6b14-470f-ac7f-86cd6267107a", "value": "morte.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77bc3416-bcba-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762616950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616950, "uuid": "7e0b0551-99b6-4826-ab2d-821c81fc1ff3", "comment": "Malware payload", "value": "5ee3c6094575f5ffce93ba6fe3427c8d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616950, "uuid": "e383e551-71a0-481a-881a-fbe55c5ef4fc", "comment": "Malware payload", "value": "f5179d3210eff6d7757baeaa585c30c99402efdf37f19dce645ab1d5e47126cb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616950, "uuid": "42199411-5b6e-4c90-a71e-10624f172c67", "comment": "Malware payload", "value": "ce161127d750f2889c024f6f9ca2021163760a68", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762616950, "uuid": "5e5e9cfd-a3e1-40cd-bd3e-05c17ef80a22", "comment": "Malware payload", "value": "a2b1b4d0190b29c3eceb31de3adad6748716e9502416b3a9e01c9b9ef0252d8c49fc55a8677de981ea489282103586cb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616950, "uuid": "283d7873-7c40-4e0b-833c-236b5cf35599", "value": "T139D24C66C8292E64D24ED6F4B1208F796723C555970B4EBE696AC6B48083FCDF1063FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616950, "uuid": "3ace31b3-412c-4b05-8d38-04945201b3dd", "value": "384:KWOdJpzYlMTL47jD73UDlZw1ZgbAAfYv7uwvfxV9ofW/jpqBFHCd7Q+mjp:KzYlg2wjKAAR7fomloCD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762616950, "uuid": "1f5308de-9db8-4df9-83c0-fe457d770d74", "value": 28712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762616950, "uuid": "5d33b28b-6c69-43db-b8cd-342dd39bba46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762616950, "uuid": "12643432-a893-47c0-8697-ec96e6e31e61", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c1e602-bcc8-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762622985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762622985, "uuid": "6b702f73-3536-49ec-85b4-100c0ecd632f", "comment": "Malware payload", "value": "975b105a8cf50ccb702378231f568c81", "object_relation": "md5", "Tag": [ { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762622985, "uuid": "e8c238dc-2b05-4f0b-8106-b7bc9290d208", "comment": "Malware payload", "value": "f5253bc6fd4e5428fc42c6827a3b2906ca00f14d50a4ee0f35449c341a1982bb", "object_relation": "sha256", "Tag": [ { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762622985, "uuid": "83ad78a9-c415-4562-8f41-5cc35031e614", "comment": "Malware payload", "value": "68ee24a9fc1163d0f6cd62cf11d4fd5c21d503a2", "object_relation": "sha1", "Tag": [ { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762622985, "uuid": "48341e71-680a-4dd7-b4e2-f7b1c7a94d81", "comment": "Malware payload", "value": "30c2b7dcaa4484b6320b7f89aa06b3693656e7871c3dd3b2509022d435fca0e4d3ef2765de725dc3e7f27a884e74a5dc", "object_relation": "sha3-384", "Tag": [ { "name": "BlotchyQuasar", "colour": "#41A281", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762622985, "uuid": "4bd6752f-f300-4508-a157-dc389c5bc1a5", "value": "T1D264291923F88A18E2FE1B79E83184054B79F41BA96BD74F1B70949D2D72781C990FB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762622985, "uuid": "9ae6bf75-3fb1-4e11-9396-93b0a244d038", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762622985, "uuid": "b8cc6ce2-d8c0-431e-980c-1d87363f69fc", "value": "6144:qgmUD0o/d6aj74kdkiw0Q7LP6WWERq0ib8T8FQwMGw:8s006KFdNgDe3K8FQwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762622985, "uuid": "16f4da38-a166-43ff-97be-0e5ea01213c4", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762622985, "uuid": "a51ac37e-3341-4acb-ac14-c462fc953353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762622985, "uuid": "16e18547-7c25-42c9-8767-36cba07411a7", "value": "f5253bc6fd4e5428fc42c6827a3b2906ca00f14d50a4ee0f35449c341a1982bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2b0dde-bca8-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762609089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609089, "uuid": "e211209a-e7c2-4c3e-8bad-7d88b6ef626e", "comment": "Malware payload (Mirai)", "value": "5bff493339ee17618a47f49f849917d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609089, "uuid": "96b4b716-dfbe-4a8e-8eb4-56fdcb7adf5f", "comment": "Malware payload (Mirai)", "value": "f530fc1862dd337e90e7e114b8ce6682934279ed7404cfc9e015082276dda499", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609089, "uuid": "16d6319c-6469-4e1c-85c5-8c5dc4955532", "comment": "Malware payload (Mirai)", "value": "e92183bce678df0eb29b5fd9e46d051e51d94771", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762609089, "uuid": "fdf940ba-1e47-4231-8909-cdd469da210e", "comment": "Malware payload (Mirai)", "value": "bfc78fddd68a1e0a936c53e1c5148fcacf466c55832e68089bfdf6d904691a1e77f6666259055812f4c2dfa63176a759", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762609089, "uuid": "db60212e-be3e-46f6-9a5f-d9de5c9054e4", "value": "T196D2E170E5893831E662183DCE69C4C53A434E7EE370B3AF58452BB12B85A1B07FD74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762609089, "uuid": "83acc22d-6831-4e2c-afca-96b759be9013", "value": "768:6KlJUL74UVANZNmoVSlU7Gg3uuKDs3UozBq:6Uc5V2J7ZlzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762609089, "uuid": "8458552f-000b-4d5c-9a98-1ec9423eff59", "value": 29212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762609089, "uuid": "d2e1028f-1dd0-4035-8049-15c9d63e00b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762609089, "uuid": "2dfd8c45-b4f1-4e79-9cb0-7467de1e20ac", "value": "executor.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5168b4f0-bcb3-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762613879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613879, "uuid": "e0254fe5-e0a3-4101-860f-768e263da949", "comment": "Malware payload", "value": "7f97465be965db31173d5e440366dc03", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613879, "uuid": "ece3a474-2aae-46f8-8151-e67f227dfeca", "comment": "Malware payload", "value": "f54a5092a0ad6234aee9f5b3c82f5444ea51cc3f4e7b23ce2076bd4f02a18a8e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613879, "uuid": "0cfe7f0b-2d20-40b3-b114-453f103d35ba", "comment": "Malware payload", "value": "97e2bf6fb663ce3c29b5a0a70be1760a54dc4257", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762613879, "uuid": "c4f3e815-29e5-41fa-a84b-f3536b118d22", "comment": "Malware payload", "value": "1a4eb75c14b4368ffa93f01e7c09621aa07e6b630e00bd7d1a1691baa0c18502d00448b4c885afeddc1280fed3509682", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613879, "uuid": "0e2e623a-72f7-453c-bd23-aa2db2f3c3fb", "value": "T1F073F10F3F519863F406477EC68DD93AF4205268D345E2AF4180AB781AA5E90BF297FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613879, "uuid": "4151ffd2-0453-418a-b957-44d737bd9eb7", "value": "1536:s4LbSpWajMvrD9aezUrrUEer7Nw/5JVZ2OUnCBuyYbWUL5F:5HEWWYH9aJrUnJwhJBBYlF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762613879, "uuid": "74aaed85-3b17-4f4a-9378-73ac9476df3f", "value": 76815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762613879, "uuid": "a1af0786-cf79-44f9-8fbf-a869f5949f59", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762613879, "uuid": "58befdcb-0ffb-4b71-b82f-c99ce2df7893", "value": "donutsmp autodupe 1.20-1.21.6.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28735163-bcc3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1762620683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620683, "uuid": "d1abcc76-dcf9-4003-a001-e5e81e2a80ac", "comment": "Malware payload (Formbook)", "value": "66b2bbab4b6d4c28e9da1ee07231e6c8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620683, "uuid": "74f93564-199d-4b58-a3b8-d22f6e6490ed", "comment": "Malware payload (Formbook)", "value": "f5de17c8e0c86e16ec3079c80f99181d12743d56309f036d6ccca352857b01c5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620683, "uuid": "f4ff2e49-d05c-4932-b712-29ea1bb4066b", "comment": "Malware payload (Formbook)", "value": "a1644e5362d32ddf2933d8380ab6ff202aa44c9d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762620683, "uuid": "1713f6d4-8e4a-4f67-9462-a729d4ebc528", "comment": "Malware payload (Formbook)", "value": "c92e4664016d1e473aa40ce8e4dcc636be0af9277f47b108d4ef13f9a442fef47ea8b07b6b5ae60c7e9d97d966982b12", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620683, "uuid": "eba0fe79-a1f4-4afa-ae07-47278e1af29e", "value": "T1E0231A3B4C2B5E7D259CC34BC98BA153E38467E35CB7BDC39BD915A26BD8C800651A0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620683, "uuid": "ff21c8e4-fc98-4976-92a7-0dfb30bc759e", "value": "768:V+bulsrIASgwt+8F+pcKOCB0zY3qbj2g4Ckez72H3w7NZ:4z828FUc/KtghZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762620683, "uuid": "665836f7-ac44-4813-bd57-47192fa979b2", "value": 47263, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762620683, "uuid": "966e8f7c-29c2-47fd-b184-d99c3323a967", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762620683, "uuid": "a3373df2-ea16-4be8-939e-28ef2b8433cf", "value": "Payment_Advice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9645019d-bccb-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762624303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762624303, "uuid": "5e360ba8-7dbe-4af8-bc05-0ad7538b1049", "comment": "Malware payload (Mirai)", "value": "2ed9ea302344b18a37966fd939016b0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762624303, "uuid": "fd5e08a9-2555-4399-b1c6-3e2609732541", "comment": "Malware payload (Mirai)", "value": "f67f3289b85d0e32cc684daef675b73790f1a38c6772ec30d85f6429135d39ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762624303, "uuid": "0305194d-f140-4a43-95af-71c1a352cd16", "comment": "Malware payload (Mirai)", "value": "a120078e0fe4f7b12c567510f92addffe0643f60", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762624303, "uuid": "8d46772b-ac58-436f-8d44-2da72abb2043", "comment": "Malware payload (Mirai)", "value": "4cb5cea75dd52f4334a33fe677988a51c4bd3858e68d2fc05ba93f3f01a0a155dc9cdad9d899d158e0c38711026c0a3c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762624303, "uuid": "c4ad093e-9a4b-4e22-9fd7-24ef0cef2882", "value": "T15B933952FD414A22C6C116B7FB2E428E376713A8E2EE7203DD255F21378795B0EBB641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762624303, "uuid": "56a87377-d6c0-490b-9e62-60d501acb9be", "value": "1536:/JuY1u642b2I6j2R/MLc7+S9+wOJ93sOW5MeVnq7svnHh:/JF1u64u2pRc7dYR93BC1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762624303, "uuid": "68c7c465-4bc2-4b7a-abf0-eea478a625b4", "value": 93292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762624303, "uuid": "bacab474-b5a7-48fc-b3bb-b8bbbac59a66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762624303, "uuid": "101b25a2-d603-4c09-948b-b04e4e89d986", "value": "titanjr.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677ef1bc-bcf7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762643122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762643122, "uuid": "3eaf2089-5bd6-4a07-b0b6-c96650f87602", "comment": "Malware payload (Mirai)", "value": "05acb53cebfb8c3765a8cb299e729dc1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762643122, "uuid": "ced8b76e-5bed-4852-9eef-7b3b00885d83", "comment": "Malware payload (Mirai)", "value": "f6ab73c00ba35252fb8137a4d81185c48f545342d91a9c12f4b08407446744b2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762643122, "uuid": "29fb626a-5077-4507-8d6e-f6e08cf71720", "comment": "Malware payload (Mirai)", "value": "8cfe20a53f0b5f4de3e2d8739ee4aa738db82837", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762643122, "uuid": "e13802dd-b50e-41b3-bb18-e4066ff053e8", "comment": "Malware payload (Mirai)", "value": "81aeece9cc2a057fafcef99ec911ac6a87991f2d59c6a57ca9a46995854f3c586ed158fcca3f054c89a79ece6bd12a87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762643122, "uuid": "667bb170-8292-4f25-afa8-8d04cf6fac1a", "value": "T1F3C3E94AAF611EFBE86FCD3709E91705248D692A22A93F757530D81CF24B24F19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762643122, "uuid": "7c60a3b4-9953-4384-a051-034e5cc32481", "value": "1536:aoo2cVFgDAKdnUd7bdKexgGBxPssTknQlMdA91J8dRAvkXZRivIipL/x7lJkVEzn:0vFgrUd7BKexgY1PP8dR4kX+Vl8Ezn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762643122, "uuid": "ca0a3aa1-a7cf-42b4-938f-cf224bf830db", "value": 119848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762643122, "uuid": "9c2132dd-b83d-480e-83e6-a83f9340da46", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762643122, "uuid": "5298ad2b-5737-401b-b2b3-25fae666fa5a", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46fee8d2-bca7-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762608708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608708, "uuid": "48de9823-bb48-471c-9eb2-7b29f81efa9f", "comment": "Malware payload (Mirai)", "value": "f1cdd75cb7193d97714c857fbe040cd8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608708, "uuid": "98bef947-d1e5-4eb5-a676-26750182eebb", "comment": "Malware payload (Mirai)", "value": "f6cf4676ea33b84b98e9c8d1f36c26f3ef3150f8ce6b985d1bc98659fb1e9ecd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608708, "uuid": "0da23c6f-a181-4652-a3d8-41ee66b1767e", "comment": "Malware payload (Mirai)", "value": "aa4ba9b9be0689af1129c21f29d117a74c3b1eaa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762608708, "uuid": "0e87f33f-cfbe-4eac-928e-441afbc183a7", "comment": "Malware payload (Mirai)", "value": "a58b31d3521273431f26b8e8b7e95fc99522c6ec87fd9f359e45b2f333414657aca76ca2f2ef2e0b66f2172f93e0eeeb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608708, "uuid": "9a6ab143-4ca2-4aeb-8670-b145842736c5", "value": "T168837CC6AAC3C4FAEC1306382177AB3659F7D43E2265DA83C3F89836AC22541D51765E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608708, "uuid": "3bd4b783-f42e-43fd-8d89-e1af10a414c0", "value": "1536:pZ0w2uD4KBFNXnrNHAnZGpQs0jakpdBtQSW78RtSdzQrUBo:p8uD5b3rNHOZ/9jbdXlWzQwBo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762608708, "uuid": "6b63e07f-17b3-498d-983d-22ac2f2c500b", "value": 88084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762608708, "uuid": "be39a22b-40ba-4bd4-bc0c-e664057b0bdf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762608708, "uuid": "ebd8cd00-983c-4b59-ba3b-8e60e44e5915", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a913c916-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762602430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602430, "uuid": "bf7c36c5-fde4-4a15-af97-833a600da4bc", "comment": "Malware payload", "value": "c5f69232efa730ad0df50f0953315b87", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602430, "uuid": "6cb62daf-d347-4e0a-a816-38db03a486cf", "comment": "Malware payload", "value": "f79cad889011ca59277df1491c8338246e1f25130f5563230602f2aed951a0bc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602430, "uuid": "e8691fe7-b5c7-4e94-9e9b-599d2660c778", "comment": "Malware payload", "value": "2367e84f10ea40d29d9b90a328eae46006c82307", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602430, "uuid": "c4ea4a7c-ea6b-4f45-9814-a8ba685b218d", "comment": "Malware payload", "value": "8719751f15bd6c541249b49a0fbb4599b66edeb6ca9b9dda3dcc1c1edf30c37b3212fb9faa22557c16701a872325dd3a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602430, "uuid": "4ca79f6c-a0c4-47f9-a6b5-09f6e81636c2", "value": "T141A533EDABDD59409249F12BBF5C9C251828E0FCAF39E11927C16E8853F0A67C371789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602430, "uuid": "1846e017-0ba3-4ff8-b80a-a5d7a1f9ee98", "value": "49152:R6z7NKuRFGc7DFx2xtdDXwHAks46LYovQtrYyZxsNoJVS7hIttQkCV9:RM7NfEtd8HAkILJqEyZLQ7h0tQ9V9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602430, "uuid": "879975f7-612e-4c13-868f-ab95f1068be6", "value": 2238330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602430, "uuid": "05c73001-6fc9-4329-8ad1-2efd9687b12e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602430, "uuid": "9c9c4ea9-9821-4f0f-90fc-40d737d3e340", "value": "REQUESTXFORXQUOTATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fea1c234-bc76-11f0-91c6-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1762587971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762587971, "uuid": "f2a85d8b-c46a-47e5-9847-d7c9347b84ff", "comment": "Malware payload (RemcosRAT)", "value": "2bb16ef0192d98ab08d5cdb2d4a2d04f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762587971, "uuid": "82f818ca-f79b-49d7-8639-ac6e2243a968", "comment": "Malware payload (RemcosRAT)", "value": "f7c88eb25216b886d7f675ae5c763670ce40fecdc07b6dbeab4d4749995389e8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762587971, "uuid": "0fde3f48-b898-4625-980e-74783ff975b2", "comment": "Malware payload (RemcosRAT)", "value": "97382550d9d88ffd433789b4b9b89fdb16bd689a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762587971, "uuid": "6c2c5472-858c-415e-b81b-9b58d7769761", "comment": "Malware payload (RemcosRAT)", "value": "1256fcb1dc3ae1a2d9cfb4eb4806414a831e2ba6e96c5f040e00a6c23239aac07e55aacd22f321e49edfc877a8b79db2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762587971, "uuid": "bb7acf2a-ab16-4451-9e53-bb597a03c713", "value": "T10A56128B721C85DC5BAB62026AA44178FD10303F9B93103E3419E5C7EBFD57EC1E65AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762587971, "uuid": "6500c801-1c57-458a-996d-61b26232c7c7", "value": "3072:GpDqCdk+h5ZjegTkTIj/UzGohnyGGGM5N:G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762587971, "uuid": "309835a7-b33c-4e4f-a2b2-2e744ed54297", "value": 6356224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762587971, "uuid": "647046c7-1b10-4666-abaa-136675242a40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762587971, "uuid": "1b6663bf-130e-4834-a491-1b1ebb00f5b0", "value": "CopilotDrivers.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3627ce33-bca3-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762606962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606962, "uuid": "dbca1450-8122-4f69-9bf3-7e80db4bd983", "comment": "Malware payload (Mirai)", "value": "de8c31616e39239fdfcf0de7a9b5396c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606962, "uuid": "3508d8d5-e010-421e-b7d7-45334f0baecc", "comment": "Malware payload (Mirai)", "value": "f89f59c3fda9f72a861fc6f4832322932c358c4607cb079af842f444825400dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606962, "uuid": "8a4f0b20-e95f-4765-9ea3-66cfe73a1c85", "comment": "Malware payload (Mirai)", "value": "03a84419d8662877be434fcbf5b143e6cd21ac12", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762606962, "uuid": "f1d0d654-e66a-4e7e-a6fa-7f81c17993bf", "comment": "Malware payload (Mirai)", "value": "a16df21d929873d7dc22d2b1a29151182dced1c6ef58fd02c4d551ba8c18196c3d5dcf3f50073878aaa860eb7cebd5b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606962, "uuid": "28e217f5-8713-4492-893a-bfe6f51901ad", "value": "T15DC3E70AAF610EFBE8EFCD3706E9070524CC582622A97F79B574D918B54A24F26D3C74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606962, "uuid": "0f3949ff-1292-4477-b633-87cde82db7b1", "value": "3072:TOj4d/L7N/WQYDutg8nZOaqwNgNMOLh6/:TI4d/L7NWQY4goAaqwNo1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762606962, "uuid": "f292555a-78f9-496d-a1fa-6f8fe2097d2e", "value": 120276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762606962, "uuid": "f5c2074d-028c-4b06-aa92-0f71c8ac2862", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762606962, "uuid": "3c91cb2e-292c-42ac-b310-06d4e9776d09", "value": "morte.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f97e4f-bcd6-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762629084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629084, "uuid": "53173fd9-563e-409e-a918-8d442d7d16b1", "comment": "Malware payload (Mirai)", "value": "f9bb88d285f473960207109f5572f1e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629084, "uuid": "4a4e45da-e1c4-489c-a0c7-11c8e7999cba", "comment": "Malware payload (Mirai)", "value": "f8a967aeaf609b68ecc8abce5f49bf54ca78dc0e801dd53289f5a9cc50112c0f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629084, "uuid": "35ce71a3-11c2-41d6-b30f-bb0360a35c67", "comment": "Malware payload (Mirai)", "value": "2be16f3e407945fb751d87788ffbca2c1f312448", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762629084, "uuid": "7faaf5c0-7527-45fd-9f7a-9488f53be862", "comment": "Malware payload (Mirai)", "value": "6d32849d51de757388aa212f909e3097226e3314c53a61928b38a2af004f9cb1181ce7c67f0e4c398be7f00a96680639", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629084, "uuid": "748f5511-124f-43b4-9549-de8efdcfbe0c", "value": "T104935BC5FD8BC1F6D8078434606AF63FDA32D8794074C69DEF9A9E36DA33501921329A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629084, "uuid": "b1c399c7-3e92-4481-b675-452a5ea66923", "value": "1536:+zmSk1QiHfDZStcYZEQV9+EBy5vTLEcHWyCKkJ9rZuW26QSsDh1nskdHkkkkkkkJ:+zn4BbZIcYZESBCvUXJKkJ9rZr2Ta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762629084, "uuid": "12a62c74-e7f9-438b-9640-3aef424be7a7", "value": 91412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762629084, "uuid": "c5dbfd63-4f0e-41db-9fef-5368e6382873", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762629084, "uuid": "4897e6cd-4473-4526-81b6-37ef93e8dbc4", "value": "morte.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc93d17-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602361, "uuid": "e18a243f-8a1b-4ea8-add4-cab7ed554b56", "comment": "Malware payload (Mirai)", "value": "60a49a582c2a9c99409d090ca4a6f278", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602361, "uuid": "056a0d63-0671-4f00-9f20-218592f705d9", "comment": "Malware payload (Mirai)", "value": "f91c3b3389950682e12aa0a48f9ab6f456af2b097859eb4c0f7c7f34579264f9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602361, "uuid": "7085ca44-b15f-47c1-b0af-76a8826171e7", "comment": "Malware payload (Mirai)", "value": "a3fc9bfc17bc6f0b9dacfb4b117cca3ff431785c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602361, "uuid": "c89e1a0a-2ed8-4cd6-9833-c5c31b37cd8e", "comment": "Malware payload (Mirai)", "value": "576fbf1e119a42de0c441a8aac40caa79658219bf46eb28382449ebdf3be5f7bb6fb309804a375be21ca44eaa6771bac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602361, "uuid": "b52c6696-2387-4fb5-8035-1411768abfbd", "value": "T185432B95F802DE7DF80FE67D44164E09BD3063C261830F2627ABFEA36C720966D56D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602361, "uuid": "552b7204-c38f-4a97-bf4d-fc9b5e1f6b99", "value": "1536:/+dPsTgnLbMuv5tEbaXnb7f98V8TWl9ouSQy8fNLsA:23rEbobZ8V8T4oHQD1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602361, "uuid": "3f5f9d1e-3375-47d8-81d2-658ff8fc496c", "value": 60452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602361, "uuid": "4acb04d1-cf18-4c69-8e5b-da5bd8f4ef08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602361, "uuid": "55bd24c3-7af7-46fd-b522-6b22c650d024", "value": "uYtea.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0098dc8a-bc84-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762593558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593558, "uuid": "ca0940a7-dd93-490e-9655-583efe5187ce", "comment": "Malware payload (Mirai)", "value": "3d099490e4e6f1061854af941734610a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593558, "uuid": "6adbf3e1-220f-40f3-97df-7155d72abe78", "comment": "Malware payload (Mirai)", "value": "f92763a082281b6a8707d141daed2c7c5169fadea95e03173c2c838b56efda74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593558, "uuid": "38da2688-388c-42a2-a2b4-a7fd5d918fdd", "comment": "Malware payload (Mirai)", "value": "ba3a34e0947361444d959204a64baa236b0c48be", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762593558, "uuid": "f11cabcd-1631-49f9-8d2e-86a40775ec81", "comment": "Malware payload (Mirai)", "value": "ca84901663fd46115b3209bccbda3310a594de1839cb5fe5dc40203d7c2f23862e7502f781377e4ce5ad0b9cc7790e14", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593558, "uuid": "094c515d-a5e6-4ca0-878d-41e731fb66c6", "value": "T11793B71E3E22CFADF7A9833447B78A21A79C378627E1D685D15CD6011E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593558, "uuid": "3fd02f9e-2711-457f-b786-e051d0af153d", "value": "1536:isIaF89/G3IN8aR694zP8aYV+t6Xgtg3+IxqeFV/riKdV:isIaK9/MIN8akJwtg3+Ixl/rT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762593558, "uuid": "6999172d-6599-42d3-81d9-f987a1ca89dd", "value": 89496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762593558, "uuid": "4a99be49-8abe-4d4b-b320-41326fdb32be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762593558, "uuid": "87c3a060-e98e-4fa8-b47d-d891cff4721c", "value": "Smips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27125c5e-bc94-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762600494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600494, "uuid": "4e800e21-e2f9-4e17-99f5-896fdea28b6e", "comment": "Malware payload (Mirai)", "value": "5eddee1c3dd6948fde827bfd42113b32", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600494, "uuid": "e8438927-c1a9-4fd3-b595-0b9b0dc4195e", "comment": "Malware payload (Mirai)", "value": "fa1071beaf4b614e478fbf2844375faf8315b5c58c118681e3d3952aaffe5990", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600494, "uuid": "47f2080d-1ab0-4554-8159-bf9e34f7613f", "comment": "Malware payload (Mirai)", "value": "3d231d57d0230318130b8f9140625e90f729dd06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762600494, "uuid": "6a8fe3fe-bb5f-435f-8234-711ef6238b39", "comment": "Malware payload (Mirai)", "value": "1855961c39941b1abd38a3b06298864aa77769d5af77b2a74ec7132772375a66ded608ee51e4d74fb7c64f87b259578f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600494, "uuid": "5c33a599-bf0f-41f4-9787-25e7ae304d31", "value": "T18023F13FEDA0B718DE7D55F9000C5EBE98C0B4A0318A8E9CB3298CE997C5507597D867", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600494, "uuid": "669f08a2-f01f-4df2-82a2-a25acf16ebcc", "value": "768:3YiMWOwTG64+jX2GdRPkR769mZ/Vua7zguWOjCre2oE1twLdHtYYSbPeWG:3YiXTXf9WVl0/w46MYSDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762600494, "uuid": "d3a0b710-f4fa-4b45-9022-18bbfda96d83", "value": 48804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762600494, "uuid": "d5cbef76-13df-4397-a6e0-156ad250039e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762600494, "uuid": "92106194-9b59-4adc-8009-0740571a844a", "value": "executor.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "762dcfae-bc98-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762602345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602345, "uuid": "6e8a0e7f-911d-40b9-a346-d374432f7616", "comment": "Malware payload (Mirai)", "value": "b45e53c0331849c082ff7e6747c1eded", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602345, "uuid": "69aeedf3-6499-4f06-969a-7276373e8cf2", "comment": "Malware payload (Mirai)", "value": "fa34dff5181a15800d5775f37f849a6a518f5270d87842c958057b0da2192a81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602345, "uuid": "37ca9bff-57fa-461f-9d10-9b33077347a2", "comment": "Malware payload (Mirai)", "value": "38bbdbb6d27175bbdaf37bec07c756ba0c9c571a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762602345, "uuid": "bac6e108-e13c-429d-a644-82b0fed1a31f", "comment": "Malware payload (Mirai)", "value": "740350b7157c92fe8f33f352c1985f3456d841fa4f45bec366c43f2a4439707f47ba14c970027afd11cc8a5f9335062b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602345, "uuid": "d15c1464-9c08-41f3-acac-e715ce876500", "value": "T19C331951B8C2A627C2D013BAF6AE968E373073E8D2CF3227DD611B113A8551F1DA7E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602345, "uuid": "86cdbb05-f93f-4dfa-adee-4c02c5356f01", "value": "768:Mtn+Pi2RhlZoIip1jIs44nHsX7+qP06Fz20AVOstYXSF4Xgt2FgNJwJZY10Ux:MX2R3ZNiwaAFz20eOaYXSFGJa100", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762602345, "uuid": "8eeeb3af-9a73-4868-8a30-7e012b1c97d2", "value": 51716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762602345, "uuid": "d297a2a8-902a-4e41-b5ba-e7de00239b01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762602345, "uuid": "beecb9fb-87a2-4052-849f-143e531345e6", "value": "uYtea.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531dbdf1-bc77-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762588113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588113, "uuid": "4664193a-6611-4951-b0ef-8adb8f566432", "comment": "Malware payload", "value": "2386102d3567667ea7579ebc595e8324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588113, "uuid": "60ddfa61-3f97-4e95-845c-0d3dee3e933d", "comment": "Malware payload", "value": "fbbeac2bbe0c24b5806b8fb498038dfc63dec7c33835cbda040cd31f1a26c183", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588113, "uuid": "d3778632-76fe-4eb5-b1bb-564b749cfcf3", "comment": "Malware payload", "value": "6c2f401f531abae1b8b7a5aac46c39d72dd06594", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588113, "uuid": "08aaba7b-e2e7-4fe9-814f-4c2b28b19b4a", "comment": "Malware payload", "value": "ea699513c25409299476bafd6856f93511697892ec29f46570b5bb1d01cb5044bd876e4cca359ad37c23578467768876", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588113, "uuid": "20223683-885e-4da2-aa3b-c7fbd1e69537", "value": "T13A2723E0EF959423F27A3BB769DBE7D1C02E6DBAB150810BB18C76190324616BE4713D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588113, "uuid": "a3c5046d-30cc-4fff-b92f-10a3598958c0", "value": "490691c1e02a66f93031cea140117d5c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588113, "uuid": "16ea328a-719b-49d6-b1fc-92c98802a3ea", "value": "393216:63C+dO/Vg/CizjMTSqkF81kFh91Tg2dj4ZeJcI:GTdO+/VjMTSqki1W1ThjEeT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588113, "uuid": "c3150d78-f60b-4a38-ba42-f6f50d449c00", "value": 20962621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588113, "uuid": "ae910d27-7451-4c38-bc7f-345d61b2e0eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588113, "uuid": "28c5798d-2aaa-4170-9375-3982fa11b47e", "value": "2386102d3567667ea7579ebc595e8324.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c902530d-bc87-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762595182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595182, "uuid": "37586248-298f-4101-a8e7-b2a95da0b73b", "comment": "Malware payload (Mirai)", "value": "722f3a63a52d6a0dca5236f3a282cac0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595182, "uuid": "2a337055-55bf-46ed-ac1e-961546e734b3", "comment": "Malware payload (Mirai)", "value": "fbc61338abd443bfe1dbd02b6cdd06fa6d654f667d06abb25b0eeacf8d3281bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595182, "uuid": "89d609bf-27f1-4ac0-8ef0-a7887fe354f0", "comment": "Malware payload (Mirai)", "value": "f0e876ef1200f7a9fdc7b947ba7de6e49f63be29", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762595182, "uuid": "73e8046a-9751-4450-9a6a-a4c8eb09fbad", "comment": "Malware payload (Mirai)", "value": "9d93ecb0e3187dbbb9815a302cd5c9767916103a57f205be1f03dbd08b5845781cba31af80bf255a7b629b9298971b5d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595182, "uuid": "027b86f5-3d44-4a74-a7ca-fe58be3076ea", "value": "T111836B21BC7A2E17C0E4A17E42B78325B2E6274E24B8C71DBD720F4EFF196902457976", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595182, "uuid": "79cb17f9-1e78-4ca9-9919-c2437bdffe5e", "value": "1536:t89ZMpScaiLxrs0MiJpJvwKD8ZslmNodE8qok7wbb:syQqWmYK5lI6Rkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762595182, "uuid": "d7cb3d94-1bf0-4901-92de-bed78e979d3a", "value": 85776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762595182, "uuid": "4482d5e9-902a-4e4d-b0a0-9fbd0f37b954", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762595182, "uuid": "87cf4f09-47a8-4947-bd6b-f91989efb502", "value": "db0fa4b8db0333367e9bda3ab68b8042.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28a27129-bcca-11f0-91c6-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1762623689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623689, "uuid": "0a63a3e6-f4ba-4b74-b8a9-287778bd64cb", "comment": "Malware payload (Mirai)", "value": "176ea09becd8510fbafadd026a46f9d8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623689, "uuid": "c9336dc8-af6e-428c-bdc0-196a2b52db2c", "comment": "Malware payload (Mirai)", "value": "fd45cc632f190bb0608dabc9fc77aa3dcd30e02685a48f066615e3b70b38959d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623689, "uuid": "70528fb3-90a5-4a67-a952-2c3478321d55", "comment": "Malware payload (Mirai)", "value": "defbe7dc48f5b7a907b8435131ba172e1fa0bcf0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762623689, "uuid": "6de20a6e-6e98-4e2a-9d70-a1c6c230dbb6", "comment": "Malware payload (Mirai)", "value": "99be2e92888f14ba766b27a2793de7afc99d182608004aeef459f94907fa2d5a3b3e0c2838b6d5cdfd04057605fd559e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623689, "uuid": "862faae8-355c-4eb7-bf31-de0049dadc6b", "value": "T167C36CD5FA43D4F6DD5305B12037BB378F32D07A1125EA83E3B959229CB1A01D61ABAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623689, "uuid": "f0d1f0ac-bfbf-477a-be55-f643c077c37f", "value": "3072:7W2WA4KfsQDNSHjiz2FBOee59tQMceGM5UQ30hAB1E0:Zr4KEKcHmz2F4eXeOQ3G0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762623689, "uuid": "64b13cb6-8d73-4ec7-a601-c14512f8f327", "value": 123208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762623689, "uuid": "33ea95b0-89eb-42c3-a9f8-6be6c0ab4dba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762623689, "uuid": "38110b14-0269-4b70-99d4-f83bc69f56a0", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b41ee63-bcfa-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1762644256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644256, "uuid": "77be01ef-acf9-4fa1-b31b-0b2d2c93309e", "comment": "Malware payload (Mirai)", "value": "9294e791ff9bb1a06f443f37aa37be07", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644256, "uuid": "36106f8f-a098-4e8b-9c8b-169ce4b5ce94", "comment": "Malware payload (Mirai)", "value": "fd6c44ebfd9ae04f9bb4879100120b0cbad215b8c921b433b83e3f84bf00f4ca", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644256, "uuid": "2630b6d5-7fe9-4f10-9653-62c5de7c3d14", "comment": "Malware payload (Mirai)", "value": "a3680bf322a83be06a0d2ba080e5269cc15db1e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762644256, "uuid": "156ef3e2-899a-48c5-9e44-e22d891e6702", "comment": "Malware payload (Mirai)", "value": "47d05c4169e3cddbb9d536b67e8cbbe5c6276a815622490c17bea0d01c5d19d66292502bafcf391c362e75b5cbc6a1eb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644256, "uuid": "47d0b5fc-88a9-4539-bdeb-9347bfad9120", "value": "T1B3C32946F9819F11D5D721FAFB5E408933136BA8E3FA3102CD24AF6163C699B0EB7512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644256, "uuid": "21326a1f-6297-4f6c-97c3-32452d23a832", "value": "3072:D2YTt0av4uI6F+5aPFwfFRIDjzoeyCo7jUvmO:D2OAu05aPFwfFR+jz8CkjUmO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762644256, "uuid": "36328a7a-8517-4e2f-9a7f-8669e33dd59e", "value": 119712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762644256, "uuid": "d12c2aa5-203c-4e6e-ac5a-1aada1f907d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762644256, "uuid": "8efb2151-3b3a-4292-be79-4e2bf895ef7a", "value": "morte.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a121870-bc79-11f0-91c6-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1762588903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588903, "uuid": "364ba801-bb5f-436a-a23a-862bb0c7686e", "comment": "Malware payload (XWorm)", "value": "67c064987904a700fca2683ddcd050ee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588903, "uuid": "d9469193-4208-439a-aeaf-c58cfee60c35", "comment": "Malware payload (XWorm)", "value": "fdfd232a49f2369b7ac84c4da6b3903fdf64147cd36c16fd019652a5d221d3c6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588903, "uuid": "f9a03466-c3d2-4e8b-9c3b-c565dc0e849b", "comment": "Malware payload (XWorm)", "value": "921832b4a307140e7c75e1d49bcf2cd7da82620f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762588903, "uuid": "08ebe5c0-7837-4800-bba6-9e3c343c02c9", "comment": "Malware payload (XWorm)", "value": "871bef231e3e0119ab8386d1fe2c69175c2abc194322415bbbbdd0f24ce410ff921bcbee5f2c1a6ffd1982d6aafa320f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588903, "uuid": "73ad29a8-0aff-4409-bdb1-59a220c4087d", "value": "T1C9343179FCB3FA4A22AADA41FD410F7EAB592C217A153BB941B0C75478ECAC6474C443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588903, "uuid": "330fab44-e357-48cc-8e0b-cd2b1a339669", "value": "3072:YirT2U9Mp8tgljxP67GSGocHpBWccgh/YDT:Yi/2UCpOgljxP67GSGocHGTT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762588903, "uuid": "b14502c0-a86d-47c9-9ee5-a199aae86db0", "value": 246499, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762588903, "uuid": "e326ff65-7898-4455-98b9-7453148084cd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762588903, "uuid": "c4d38299-e078-4ebd-aaf7-e12c57362719", "value": "\u0111\u01a1n \u0111\u1eb7t h\u00e0ng.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d40d30-bcde-11f0-91c6-42010a9c0006", "comment": "Malware payload", "timestamp": 1762632385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1762632385, "uuid": "a3d58edc-02ae-4619-8cb8-8ce720cdd045", "comment": "Malware payload", "value": "16ad43dbe6e7cad2d658b72ad1eb6fde", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1762632385, "uuid": "d3325df5-f6ca-49a6-a822-7e85e6ff51e0", "comment": "Malware payload", "value": "fec7c49137a5bc09195c3fc3a4dd79a9d6d97a401df8c32f34b335b3fe89a18b", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1762632385, "uuid": "44eef5b5-99a2-4f5a-aee2-7f018468c43f", "comment": "Malware payload", "value": "2cc71e8c0daa155e72c2e650a2c1b2890e67d152", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1762632385, "uuid": "acdedccc-889b-45ad-ad6c-450c0ac45dfe", "comment": "Malware payload", "value": "3bb47052d774c79a6e6159e5d8815cb2760e518ed6ee16f930c25b70f37d86a71a4d5fc4ea485ca6c9962f1b13eabfdf", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1762632385, "uuid": "7fb3ce53-1960-42f3-b489-bbaca932658c", "value": "T15BB5E15AA3A401FDD0EBD275CD465907DBB2B84603B0979F13E84AAA2F137715E3E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1762632385, "uuid": "50b9fa24-1035-4171-8f7a-8146042d3e41", "value": "c703242dd186633edf6cd30dbea4385f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1762632385, "uuid": "7a019484-a411-4da7-bd2d-a501c8eabf99", "value": "49152:/ZwMeGl+VAoVNdoFmLPkJcssvfSVPko1007hrjkhl1Ymu11:/ZfZlJCNd2mCsCVPSs/dmu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1762632385, "uuid": "210e492b-7acc-4206-863c-10a6d07c90c5", "value": 2458624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1762632385, "uuid": "e15d9e3e-9d57-4bf0-bca6-457cde6c4fdc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1762632385, "uuid": "7305e96e-691c-4336-a99c-1a07178044dc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }