{ "Event": { "published": true, "date": "2025-11-19", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2025-11-19", "timestamp": 1763596981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "d4341177-383e-44c0-ba76-339b9a8f95db", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ac3be2-c4e1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763513308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763513308, "uuid": "efe5fd8a-35e7-4dfd-ad11-b0f6e1df37a8", "comment": "Malware payload", "value": "fa0d38d9feb1ced1f9e3de1d768a2de7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763513308, "uuid": "21f594ca-f67e-421e-a623-9fb19e28fbd5", "comment": "Malware payload", "value": "003cd67d7d3dce2f5842f966815e0af1b8c63343498a5b994fac726f093e392a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763513308, "uuid": "4cef8b5f-3a50-4429-be20-6771c5ed7ee5", "comment": "Malware payload", "value": "225b0b46b92fa9413658a95271b759dc3c7f78f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763513308, "uuid": "09b5ea3c-8a74-42f0-b3ae-9281aa837818", "comment": "Malware payload", "value": "742ada362a1735d4b9ba086fe9053e182f6c52dc909ef5b2fdee765dce24ec6e5e896973527d19d292368f777128daf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763513308, "uuid": "e582b552-2e4a-4204-89ab-ce636f7f5435", "value": "T1C3E4CF26B79106F9E4A78178CD1F5503E6F6B8050732DB7F13E592A61F23660AE3EB01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763513308, "uuid": "39f811d7-b76f-4f10-b91b-1696cdfc1bfe", "value": "0eeaf9bd4e71ebdcd4a584b4332365ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763513308, "uuid": "84520160-35d4-4fb5-a1a9-666eab9a3d85", "value": "12288:pBwyTZA25V9v/B4ZrbqkqvITVxne93S56tLBIZepLKvAKaxxpKCxYVF:NZACV9nB49nsIu9C2mZepkMAHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763513308, "uuid": "3cee47bc-64e6-45c3-b575-a481036181d0", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763513308, "uuid": "47473eb4-40a0-4989-9057-4961e02c24e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763513308, "uuid": "c8e1c72d-c91f-4917-bce1-f942a99c89fa", "value": "SecuriteInfo.com.Win64.MalwareX-gen.17467518", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9d6fcd-c592-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589394, "uuid": "11bc6a59-a7c7-4adb-8574-cd6319d80c24", "comment": "Malware payload (Mirai)", "value": "ec8b3134bff0a6f4bd10e3cd0c45f57b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589394, "uuid": "47e7d679-e920-4d6c-bd46-8a2369eb303f", "comment": "Malware payload (Mirai)", "value": "00db64b200a51c191e5d769c6d1d243f05429754bcee18ea7a9c91d56d461544", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589394, "uuid": "b48a2c47-94a3-4376-b511-432b349f1539", "comment": "Malware payload (Mirai)", "value": "bbedd6ed33098652969a0e08110676438d6e260e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589394, "uuid": "2f3f0de2-b446-456d-8a94-db2527c9df79", "comment": "Malware payload (Mirai)", "value": "92627c5874e1dbf8f395487c401f4bf3dc0a1f66b93a7f81329592d549232fc7d0bf369a54907e8b22b96d862a3d99d9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589394, "uuid": "1aec2b4f-908e-4946-bb11-7b8761f7d0b0", "value": "T1B523F182109EEF48D486F0743F9FAC1AD924F62F8FC8E8877518A4BE19A37957915433", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589394, "uuid": "00b4e2ce-ed5c-493d-832d-69cc602a389b", "value": "768:kgUddZpAabSO97gVpYnwEY1npRKUU80DjzIVoGO2oBJJ16AWR3m9HdIpcfep1pnx:knzZpr2REYPHqzbdYAe8HdIpcf2nouyc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589394, "uuid": "f445a666-75c9-4687-baec-9edc2635f79e", "value": 46756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589394, "uuid": "8de0706d-b4f4-4eab-b042-159a3a80d46c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589394, "uuid": "656c1c9a-465d-4563-b0e7-4943a7816831", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "643c7555-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594882, "uuid": "500da89f-80a8-4ca5-9696-43dc6f91cc5a", "comment": "Malware payload (Mirai)", "value": "eda56cd1626a59c94a7eb680d5a599cd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594882, "uuid": "d3995353-e4c4-41d8-9371-d655a3167da9", "comment": "Malware payload (Mirai)", "value": "010a7499d5889e9cd8a9a4c29f67ab42aee290244cda2c2dd2cb54318ba464b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594882, "uuid": "ba1e25b3-c3fc-4724-8de6-939434ea820f", "comment": "Malware payload (Mirai)", "value": "0c7a1cd756e231a87e7fd16edb053b3fcc9253dc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594882, "uuid": "38f6f7fd-f512-483a-a2e2-5c9dae9c584e", "comment": "Malware payload (Mirai)", "value": "c8a99a2a01062c5d17c621e2e8d6ca66cebef5f3d4a91a39fd3b882829834f1f59106752e55cd7301be14ff2c340c787", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594882, "uuid": "161a692f-0e22-4c99-9d41-21b534f4b831", "value": "T1D7D3AEA7B74711A1C8A342F40BCB4BDD2E6332825F6B98E3BC6F653758760DB4406B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594882, "uuid": "3270b66a-e420-4c61-acd7-290525783f89", "value": "1536:E9xkaH6MYvdcqcJZHiINXPdRaIeSFSR/89TdbpYgdudxZJ+Rgbv9/LWB:E9xkc6dcr7XPdRB9+E93FduiRgbv9q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594882, "uuid": "f406a1dd-9ef6-4755-ae17-5013b7572e20", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594882, "uuid": "77daf441-b30f-439d-b858-7ac8cea6f7df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594882, "uuid": "ce2f5ca2-9843-4a1e-8353-7ca62b8cb264", "value": "S3o.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ffd415c-c576-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763577238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577238, "uuid": "db25e417-0815-44a3-8cbd-3aeda104ef98", "comment": "Malware payload (Formbook)", "value": "1baadacc390727b93090e29290ec3c28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577238, "uuid": "47e76747-6026-435f-ae6c-84826259d73c", "comment": "Malware payload (Formbook)", "value": "01b1a6fc2cf90430910dd9c5fb9a47666bea0fd2dec074592e45dfd042e62d86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577238, "uuid": "e2b01a9f-33e9-4077-8e13-9df1422aa33f", "comment": "Malware payload (Formbook)", "value": "271d14b2d5179739f9b17848e3a3252e554e1b92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577238, "uuid": "c41fa182-dc8c-48e9-ab33-48d391b421be", "comment": "Malware payload (Formbook)", "value": "a94752b477869646194955f8f03a74fb769de8f58222cdc196ea991b1d4cef9b6130cdb7f15bd059ac02d4e52bf3be15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577238, "uuid": "e317de49-ac03-4fcd-9283-a35eb55e5398", "value": "T12CF40121726EDF17E4A35FF41561D27087F52E8EB421D216CEEA6CDBB83AB100861793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577238, "uuid": "6e9e07f4-8994-4982-9f82-9f69174e3928", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577238, "uuid": "773c4f0a-1805-4102-87c7-ca28919b923f", "value": "12288:A5bbpOLhtJmvsH9IGQ3WNYQVBe/mwglrjd3XnXcntSl98tkxasCdBrAtNf/1P1s:A5vpOLS09K3EYQLe/wxXctSD8t/s4Brj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577238, "uuid": "b906aaa1-14fb-4fc5-bf13-9b07cdc690ab", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577238, "uuid": "f47e49a3-7303-4d2c-a15a-31f9f86983fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577238, "uuid": "44a28ae2-17f6-494b-a74d-6979649bb1a3", "value": "Qt644ui3L7mrypQ (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a44af3-c520-11f0-a129-42010a9c0007", "comment": "Malware payload (ArkanixStealer)", "timestamp": 1763540254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540254, "uuid": "0528f87f-b6ba-4d66-8e65-74db34cf9f5f", "comment": "Malware payload (ArkanixStealer)", "value": "d7bd878aca9c320485f290547b6377f6", "object_relation": "md5", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540254, "uuid": "cbfc04ff-ef66-43aa-a22d-c4b6bd5d2a82", "comment": "Malware payload (ArkanixStealer)", "value": "0222a80c806a1f5746c17090f1379779245dd7d86b70b1c5dc5d0e75a13e5a3f", "object_relation": "sha256", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540254, "uuid": "ec93fa25-04c0-452a-a0c2-dc924f90afac", "comment": "Malware payload (ArkanixStealer)", "value": "ca40bfff221ae30637357406840ba25ed76c6f58", "object_relation": "sha1", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540254, "uuid": "55d05b98-dc62-4947-b7bf-cf8175a3358a", "comment": "Malware payload (ArkanixStealer)", "value": "aa1d020b42f123bc587e73d3576437a680fdb634b2b9d4e84b5895a87af304f220682ff5dbf13b0a8ffe9fc795a1b5c4", "object_relation": "sha3-384", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540254, "uuid": "feb8e5fd-7c04-49ff-acb7-821ebedb0288", "value": "T1F28723AA55D5B2D4DBC30540638F43DE21D1A47D81EA5C3C3AC72C029A34EEB668DEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540254, "uuid": "95883866-54a9-45b3-825c-7edce475942c", "value": "3f89fcc81a8c8aca2e05ddab1c622a0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540254, "uuid": "00dcf2a3-0b86-4244-8bcf-f0c3ace7aaa7", "value": "393216:2Oi5lhyyN7IgV3geofoFnsIgAlqHy0KJvOb+iQftLCGpp1moc715zkKltstw3ozc:2HKgVOfo5sIaS0KJmytrbsh5zDzT3qIF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763540254, "uuid": "f4761f78-0037-4b6b-9bef-d6cbfcaad8b2", "value": 36230023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763540254, "uuid": "bb1a3da1-a37a-45ba-a5a6-d76a2ebc615d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540254, "uuid": "f17492ce-c115-47ef-8c98-ad3684b6cbe4", "value": "modmenu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8287f490-c52d-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763545970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763545970, "uuid": "538b65c2-d538-4512-8857-2bf7a861fcfb", "comment": "Malware payload (Formbook)", "value": "91c9691d4312e20b5bfc5a14f96e0dc8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763545970, "uuid": "cb9265d0-fdd3-449f-a1f8-3f8bc958c5e6", "comment": "Malware payload (Formbook)", "value": "02e7f215178539b6e5ef8cff58c0f689fcf2a39fd1b2171f134d96c3828c2450", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763545970, "uuid": "888b7a27-3079-4d52-9f53-8e8ecc3058d3", "comment": "Malware payload (Formbook)", "value": "c5058a9a9ea61c991ea12807dc63b27b22d4cf4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763545970, "uuid": "a4ab5875-4c15-4416-b236-ac172c5149b4", "comment": "Malware payload (Formbook)", "value": "f7f1b6183a390a8fa4baeff36c2eca76d8d50a5d3db26cb3f9d3845faad9581169612c003a9d731bf2d8b893a6c5a33d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763545970, "uuid": "2999c431-4fd4-4142-ae38-0ddc895f4a4d", "value": "T174F4ABEA307B442EF4D0AAFCA194641C099A8E5D5C1EA62C1942A635E0FDF4D1F4FF72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763545970, "uuid": "df9f841c-58f1-4189-8b53-a7dd6aa0e893", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763545970, "uuid": "7bf3112a-7503-4b7d-8a6a-651244f69b77", "value": "12288:kOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiSlPgR2c/Hby/LEvejp3XtGNdiPW0r:kq5TfcdHj4fmbzIRjfby/NMCmTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763545970, "uuid": "d08924c0-4e38-4176-9040-6c56a34b7fde", "value": 729600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763545970, "uuid": "ae8ae977-a3eb-4513-b7f8-d760a5fa6f89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763545970, "uuid": "ad901c4b-0f60-4887-9ca4-594286b15b21", "value": "OVERDUE ACCOUNT LETTER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956426db-c513-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763534834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534834, "uuid": "bd0c4155-8be5-4e34-a54d-184963fc48c5", "comment": "Malware payload (Mirai)", "value": "02bee1aa627f3228ceb5534ae87f8670", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534834, "uuid": "bc93098c-78e5-4920-8b64-58f5c8153db2", "comment": "Malware payload (Mirai)", "value": "0383385245df842dbcb98b1c3f9b4f628ad8f5835cac1535f3df443ad8fe9657", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534834, "uuid": "d71a59d9-e52d-4b8c-8007-dd0f6cf1d235", "comment": "Malware payload (Mirai)", "value": "fb9dccecb490b35f41b2d116362878b40c9cce54", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534834, "uuid": "fb627cd1-8a6a-4ba9-a959-9b208ef20355", "comment": "Malware payload (Mirai)", "value": "aa79c3c373d8df40fccd8dc673e542ec9fd28d26d71ad0b907414828fcc9e4f132cb0dce9631e755b60dd080755fa5a2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534834, "uuid": "e803212a-4f37-4858-a669-197f3a6fd29b", "value": "T1BF13F1CBDACC9760C41683374CFBE1AC57E0DE9D2E1504BA59D065A79CC8F281A2E5CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534834, "uuid": "c6c10da9-b363-4f34-a805-08b872fb18ed", "value": "768:Rauldgcc4F++ndSb+M91nNrjmYtYrOPlq40Jdzmw9WxF87eIOWJpSrOGnbcuyD7/:BVc4F++S9hNrjmY+rklnymHDCOWJpSl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763534834, "uuid": "e67a2e9c-a283-4bc3-b821-a2889b16ccb2", "value": 44484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763534834, "uuid": "9678923a-8a4e-4a02-9456-c0de169cccf4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534834, "uuid": "e4e0e821-0ef6-4c63-9b04-7f74fd1e3121", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc10d8b9-c576-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763577420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577420, "uuid": "28d273d0-64f1-4a38-ad42-43ab0bfe3b0d", "comment": "Malware payload (ConnectWise)", "value": "78f10812096b09f8b0c11f2d2cacf76d", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577420, "uuid": "d8abef5f-aeee-416f-8752-dcdd7e8da33c", "comment": "Malware payload (ConnectWise)", "value": "03bfaacb5c52b6e46e2b2d8b44fafa50981d84c8e9ba727fd9b22c217b8ed638", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577420, "uuid": "87054ae3-61e5-44eb-ad47-fa694f93ba39", "comment": "Malware payload (ConnectWise)", "value": "f54c809a36ee9b2e6ef8c00846988394ad910e91", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577420, "uuid": "272c6985-c772-4d35-b761-0838d25e2534", "comment": "Malware payload (ConnectWise)", "value": "d140429cab93f99ccc631f149b2da33ed7b5ac37317b776ce1e2d93363653d534dfb6a3635339a7f98256c822f10c9e4", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577420, "uuid": "8c9d707e-6631-4047-9e0d-75a5d2cec469", "value": "T157C6233066F8D226F1BB0A31FD3991B14C6ABC64E922D15F0360391F1DB5E81AA72777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577420, "uuid": "cd95afc4-d89a-488f-9fbe-af1699f30601", "value": "196608:Sgnsvfn3WsH9BkgnsvfignsvfCgnsvfWgnsvf:7wf3t9B9wTwjw3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577420, "uuid": "83d5ad3c-52fd-46d8-8ae8-032fab63dec1", "value": 12177408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577420, "uuid": "bd6d01e8-1bde-4359-987c-9a986b150d9e", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577420, "uuid": "18b584d2-f214-4a11-9951-a01893f6d567", "value": "EviteCardViewer.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1c1f692-c513-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763534855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534855, "uuid": "e4287a48-6ddd-4452-aa85-6b70731f487a", "comment": "Malware payload (Mirai)", "value": "1fef70ad5492d61156a23f8082955d7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534855, "uuid": "c9127c27-63ca-4acf-b79a-1912be191eb3", "comment": "Malware payload (Mirai)", "value": "04140ee57f89d19f9c689ea5a26318cfc293fe2acaef8f1d52bb2cf89869acd3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534855, "uuid": "dfefdf83-a2e3-4a8e-a84a-aa46693b9af7", "comment": "Malware payload (Mirai)", "value": "52f078ac2a360cafd9891d25a4e760b748ff5753", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534855, "uuid": "6b4e7103-b556-44b6-8c29-e445b3a591c8", "comment": "Malware payload (Mirai)", "value": "6eedc93648795568c818b07c0dcac7796643623145c60a2ba1974773c6905c9fb15d75d6ec6b34555677ddc7e9d2a429", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534855, "uuid": "c8cea75a-d1bd-463a-8610-a61dbea048b8", "value": "T10BB37DC9F643D0F5EC5705302276FB37AE72E9BE3228D983D3A89A327C11641D456A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534855, "uuid": "9f33d724-4d84-42d0-b219-0bc6105f524f", "value": "1536:cRJZkUKQXtAPADMY+D6DO8urAUsP+byc73nUYz2/82rh1bEzaF3SV7:ekUEooY+GDO8xULLUe202tRET7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763534855, "uuid": "11187be8-bc12-454e-b150-933d56465966", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763534855, "uuid": "3523e26f-c4ed-4ae4-a552-a19dff7591af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534855, "uuid": "e865f473-9830-415e-97fe-26b2cdc00b0c", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb1f0fa-c558-11f0-a129-42010a9c0007", "comment": "Malware payload (DarkTortilla)", "timestamp": 1763564487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564487, "uuid": "56f9cf09-6fe9-4731-bf6f-f5dc944b4702", "comment": "Malware payload (DarkTortilla)", "value": "8ebc28adb4b33390b2afbb0587ff7375", "object_relation": "md5", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564487, "uuid": "ce195a94-50cf-4e97-bc98-aa8802f0a87e", "comment": "Malware payload (DarkTortilla)", "value": "04e1f69458d2d6d073a4b61f97ba8a4d1219f8d57d4d682b48b9473bfc5dd1d4", "object_relation": "sha256", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564487, "uuid": "e9160d0e-5bbe-4c50-a7e9-0e0891c8f5f6", "comment": "Malware payload (DarkTortilla)", "value": "4610ce2aa50371b501740fc2be848664f1845bf5", "object_relation": "sha1", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564487, "uuid": "000b5c6b-9e1b-421b-9f0c-3f9cc2ade555", "comment": "Malware payload (DarkTortilla)", "value": "27ba0b20171f5e94372c94985cd15806ef8acf1d936cce620aa03039e64379924d675eace89ea2966f6f692508db2c5a", "object_relation": "sha3-384", "Tag": [ { "name": "DarkTortilla", "colour": "#7A8476", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564487, "uuid": "95457f19-2f18-48de-a364-280005086c95", "value": "T1E9D4E01513D4ABA5F47E9BB89A64044483F0B90FE733EB5F7DAC51E81932B808762363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564487, "uuid": "f3188489-db2a-4652-ac6e-042989a7217b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564487, "uuid": "f22411fe-0a48-4641-88b2-80e515575a3e", "value": "12288:F4Ub8QdAuNbW73rUYIBVjOGl94YWqj5p5ZmiLTTmW1DTrMUTKjTxiN422rmtR:WgdzN67rUBVia9FWqjf5ZmiLf1DfMU+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763564487, "uuid": "25c7aa39-53cc-47f0-a178-d04b8047a4af", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763564487, "uuid": "22e75816-cc67-447a-a25f-d9224b188538", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564487, "uuid": "2f802f94-f668-4f97-9b49-fc813f940141", "value": "QUOTATION PO - No 20251103 WTS EQPT EXP IMP.pdf 87KB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b797477d-c56f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763574406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574406, "uuid": "7e2522fc-ff2b-44fb-b0f9-75a26f48f085", "comment": "Malware payload (Mirai)", "value": "0ce92c5825f133e3649e1cffe1e5199f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574406, "uuid": "3a8e93aa-f17e-4b87-804b-2532d61d53f5", "comment": "Malware payload (Mirai)", "value": "05130dd4cf03503c7d14ead08003b6477cf49c22645b54de637ade2b9a27f75c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574406, "uuid": "12a0ba55-fb42-489f-a880-51f28972687c", "comment": "Malware payload (Mirai)", "value": "8b5ef0727fae135d35c66c9a0ea411d501f8eb72", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574406, "uuid": "debd3174-5258-4b53-a181-60bb97d8bf59", "comment": "Malware payload (Mirai)", "value": "1ffd6f951c144e13522e021a72bedd6b892166223af2af9ce90cd745a311f6869f037ad41582cdd0fbdce618dc17bb91", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574406, "uuid": "c6f8fd49-2c88-478b-a4fb-aacd760824e4", "value": "T1EF834C56FD41DA13C9C125BBFB0E4289772743A8D2EB33038D266F21638B96B0E77651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574406, "uuid": "5792c181-3142-4e9e-9f35-e145bcdcc6fa", "value": "1536:w/aaw0sBtQ1VjhGovgyu1rCr3QBC14vAwem3+:w/aHZtCxYyuFl3+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763574406, "uuid": "1d3bef64-fc17-4419-88d2-9386b17d2a81", "value": 83636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763574406, "uuid": "7d20f1ef-5a56-457a-a901-0f60be659a07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574406, "uuid": "e1216cf3-bf35-43dc-8f3d-6787bda0970e", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed5b3e39-c52f-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763547008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763547008, "uuid": "74312343-5eed-43a0-a71d-8c3e98f01b87", "comment": "Malware payload (RemcosRAT)", "value": "bfa3f6ce9401c6aca9d8d2aa7ebfbb2a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763547008, "uuid": "0a773156-d9dd-41bf-8f8a-b41a6e683e67", "comment": "Malware payload (RemcosRAT)", "value": "05362c10b1c042aaff781667afcddc73f551eaccc5880a89baf2fc16421a6132", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763547008, "uuid": "0c9ee68d-a476-4688-96b7-c55112b66435", "comment": "Malware payload (RemcosRAT)", "value": "f7a5c5c01b89b2ad968c7cd94bd1914349974cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763547008, "uuid": "5bde7bfa-489e-4cd1-861e-f98e5ec0c155", "comment": "Malware payload (RemcosRAT)", "value": "45a9815c2e418e7de950e20f592f995775504b337f0a530ea177ee1808cc9867f555ec8bd15616184d68a7ce657c6875", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763547008, "uuid": "e68ee489-ba15-402e-bb32-81019d5e93f6", "value": "T16B85CF12BE504D32F13E3530D816A3A95519BEE12A24F8467AFC3D484FFB653392AD87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763547008, "uuid": "2792e95f-b8d2-4bcd-b1e8-1f8a14931a86", "value": "65ff4bc8970f448f80a983edbcabb93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763547008, "uuid": "ac3927c6-63e9-448b-b8a6-55d29e9bc556", "value": "24576:+XHU4RXv25oNvfzQ4u6iDy4KhdRPtBn2ukZPz+HQO4nM0pJjRPSD8JosF8IEv8gt:+Xk5d5mBndIPGQOcM0pdR68oO8IU81N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763547008, "uuid": "f576bf2f-b244-4816-b6a1-1d8597b794e9", "value": 1771008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763547008, "uuid": "f2620ab8-d092-415c-ae20-987a62ff0dfd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763547008, "uuid": "9ef36520-6383-4653-bc65-116787d6c9e5", "value": "ISBankasifatura56120384005900298388583762637u.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5761e973-c556-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763563507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563507, "uuid": "eb01f9ed-bbbd-46b7-bd22-8317019be761", "comment": "Malware payload (ACRStealer)", "value": "c4b534f8f68d057031645e3b6188054e", "object_relation": "md5", "Tag": [ { "name": "157-180-84-234", "colour": "#2E0F4D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563507, "uuid": "d86bb017-941b-4589-a79d-083f9f866b28", "comment": "Malware payload (ACRStealer)", "value": "06492faf14d025acf483a54361fde248d673f1eec315610f8f43c8f059639ecd", "object_relation": "sha256", "Tag": [ { "name": "157-180-84-234", "colour": "#2E0F4D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563507, "uuid": "d65ed305-3287-4eaf-a09f-78c7bf2248b7", "comment": "Malware payload (ACRStealer)", "value": "0b5d86c5bc50fd05600973c34965f2fb20fa16f6", "object_relation": "sha1", "Tag": [ { "name": "157-180-84-234", "colour": "#2E0F4D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563507, "uuid": "11f90d76-aadf-4cfe-a679-7758f4da6dc2", "comment": "Malware payload (ACRStealer)", "value": "667867b00fbe9bd41fae2fd66d577b3586fdf352c3099f2184334ad4292648f230447a9aa4a5a6aa483ce93193772e4d", "object_relation": "sha3-384", "Tag": [ { "name": "157-180-84-234", "colour": "#2E0F4D", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763563507, "uuid": "93c9692a-d509-4305-9801-e45bb8472752", "value": "T14EE63318FE97C83BCC7BAF35314AB705A721C242B1B566939EE6525B42C3DB901092DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763563507, "uuid": "77d29e59-7b0a-4022-8191-fda598864a0a", "value": "393216:lk3KVN05OStXoPhMMJdkUquGGix6SRUWkc618R4OY:lpNGO4oPndkUqulI6Syc0OY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763563507, "uuid": "7d0f3990-9b8d-4cd5-916f-a4884e01bc25", "value": 14050052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763563507, "uuid": "1f2e371a-54f3-4ab2-b5e8-3099f2bb92b9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763563507, "uuid": "66cc84f5-3f74-4fb9-b704-51cba5b5acac", "value": "SETUP$.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6878dd7a-c576-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1763577279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577279, "uuid": "0c69f67e-0984-4b02-bf1b-5630e9b0d7a5", "comment": "Malware payload (N-able)", "value": "8d5079d3d9a7ebd46f4f7a9d537084a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577279, "uuid": "0e14d56c-d128-46f6-b75d-b8f31abf7440", "comment": "Malware payload (N-able)", "value": "066fc3d1a62cbaa0b58102831599347a54944f650a3d7a9ae7960018f8aff0b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577279, "uuid": "979611ff-c077-41a2-a8d8-3b5a20dd7852", "comment": "Malware payload (N-able)", "value": "faf9b6ee68bf9669e166446d155d41fb6121a81a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577279, "uuid": "96d403d6-8a70-4bef-ac21-e4cf83a905b2", "comment": "Malware payload (N-able)", "value": "2f0fac38790a9717aebdb242cc4eac7796bc5b12d9db30ed9baad7993684bf4c9b02c2b54bd85ae843a99233b1fbaa4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577279, "uuid": "8eb1b1f9-f6c5-4c42-95c3-a7298e6d5183", "value": "T1E4E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577279, "uuid": "090018f0-8ec4-448a-aa0e-a854df1bc76a", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577279, "uuid": "c993cac3-5ad8-4a77-a0b8-7caeb0143b71", "value": "393216:DEF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1q:srRxvoC/7a0jUxX7h1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577279, "uuid": "90f91118-005c-4cd3-bda8-e098c089ac40", "value": 14781984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577279, "uuid": "53c34dff-f3e9-4288-a093-07f128cb5571", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577279, "uuid": "ff45ae5f-f08f-4a85-9cc1-2d4cbcdc2217", "value": "FILE7865467865786576AGENT_468033_V10_14_4_RW.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e565262b-c556-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763563745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563745, "uuid": "1b646d0c-b2c1-4ec1-a0cf-b3602dc64da0", "comment": "Malware payload (Vidar)", "value": "2e2e84453ea52e3a9139bc3144ff1d5c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563745, "uuid": "5db3ddcd-252f-471e-a45b-733806352814", "comment": "Malware payload (Vidar)", "value": "06b49b2d522767addec65abdcbd925a3a1ef91c2411fcc7bb7ede9003b695935", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563745, "uuid": "0c9c3afd-b1ca-49ff-b4cf-dbb0f1f62600", "comment": "Malware payload (Vidar)", "value": "5f77d60965b99ef7449c22103ef5f2a1cf6983f0", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563745, "uuid": "f30edf58-617e-40c4-9ba0-0cc87d1e4540", "comment": "Malware payload (Vidar)", "value": "9c86e236be95e3ba2fb8e534b7fb60829be8ee6c13e83e2749f6815c7c780c05c92baae066b16f91bdc678b220160b53", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763563745, "uuid": "3e18d020-9a65-4b9f-8997-7d38505435ac", "value": "T11DD45C7AB490D143F918C4B414F19B2DF921B07286752AFB099091A3D95BAF08FD53EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763563745, "uuid": "188f2c79-46d4-484b-82e2-a074213d659e", "value": "3d5945b60ad9445639ba92f86ca39319", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763563745, "uuid": "4420f945-8941-49ed-bc52-73216a4c7049", "value": "12288:A3bMO9+az7+lw7uEcj2s7NUbQaR4Zl5re/I/Bu48CXTq:84O9+az7+lw7uqs7NUb09q/c8GT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763563745, "uuid": "edae6707-9b05-42c1-9af2-ce8c10ba4437", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763563745, "uuid": "a61a343e-325c-43f1-b3e2-296cadcf856a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763563745, "uuid": "f0c54686-b382-4ca8-b27c-6093ea4744bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b71b1b-c549-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763557810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763557810, "uuid": "b8c33d2f-f55b-4918-b059-4787ee93c02f", "comment": "Malware payload (Mirai)", "value": "46aa1f6b6a637bebad0b67b11c7ee93a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763557810, "uuid": "b6514b34-2b44-4dd0-afff-e30dbb07b541", "comment": "Malware payload (Mirai)", "value": "06e177ea69dfc04584a4607141cd42754a145ea00c88494d1c7905481a9b14f1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763557810, "uuid": "b2501537-49c6-4a68-81a2-cbae3b673eca", "comment": "Malware payload (Mirai)", "value": "2095e8c88c99c48d717b877b8d37d7c5d04d73c5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763557810, "uuid": "42e074c4-b731-470b-b800-46bac979bb7d", "comment": "Malware payload (Mirai)", "value": "51cd81cc47f6400b470b0be969a72e5d5f622fe12d1657fbe7ffab80444c1c49155019784af8c7aa5cdcbe7864e6e42a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763557810, "uuid": "bddebc55-d383-40b0-bac9-f8dc40cb4c5a", "value": "T1A2C2E681AC8285668AD813BFF93D41CD3312B3BAD1CE7152DD465F08B6C994F0DA7A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763557810, "uuid": "1292d322-8f8b-4cfc-af04-d9c9fc2c3359", "value": "768:CMn1EjZA//+1vTRfRiOC7wYqT4JqsWA3B5d7I9g:CMn12A//SrRftY97WARbIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763557810, "uuid": "ed831022-0ad0-4e6a-befb-6671a55af126", "value": 27208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763557810, "uuid": "1f1d49f0-d3ed-4d8d-b374-872a505c38e3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763557810, "uuid": "c91b320a-c446-4857-ae87-fadb5922ccd4", "value": "bin.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b9ecd51-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589713, "uuid": "87ac4f28-104b-4acb-9a0b-5da30b65e7a6", "comment": "Malware payload (Mirai)", "value": "99f738f77e5a57b3b9eab3fe4dff006d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589713, "uuid": "1d2b0773-149d-435a-85e5-f98034cbc4bc", "comment": "Malware payload (Mirai)", "value": "0815843159c22179fac28607e3966124144f4395444540e03ead85e4d03b04cd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589713, "uuid": "f86a13b9-779f-4310-9cd4-cbf1f9a86826", "comment": "Malware payload (Mirai)", "value": "5d37129378adc6af2a1e50211f05ba2093975831", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589713, "uuid": "caff2f8c-1f96-4430-bad6-5d8d4a860b83", "comment": "Malware payload (Mirai)", "value": "7f56a50cb2828139c80ce3993464fa53ef9ae3d3271da1c9430ead1d95b2f95f07f140f0739eeb583343f724cd6071fe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589713, "uuid": "f924503b-0991-4a21-82af-2277489196e1", "value": "T139A3BF33E82A5D94C09501B8F4E69E361B33F5C042571EF72AE6C6A5504BEE8F50ABF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589713, "uuid": "7a2e055c-3c87-498b-9b3c-ad9e27d42b8e", "value": "1536:e/nx6FX2zJtM00H/LzCsdsv9kxKqrZ517wJL4lCmbKMQS8GwE:efx6REAH/vWmYq31YL4l5hD8j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589713, "uuid": "a2e6604b-eec9-4ed0-a2d5-703798f1960b", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589713, "uuid": "89041cd9-9c3e-48eb-bd71-885a92c05755", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589713, "uuid": "af4a62a4-3fa2-47af-ad03-8f0c6e67dbd3", "value": "S3o.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d5b4d1-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594879, "uuid": "abcc98ca-75ab-451c-993c-65f3931e1f06", "comment": "Malware payload (Mirai)", "value": "35244f23c3956d1d7dfd9ca12c6e57df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594879, "uuid": "570478ba-8f3b-4d98-a372-73d1d7763d4d", "comment": "Malware payload (Mirai)", "value": "0839adff8e22767ccb9b81bc513f709c57969cfbb6e13a3762e3bed795e4cdd1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594879, "uuid": "f5072a4e-ea82-4c44-927e-109cfd576bd7", "comment": "Malware payload (Mirai)", "value": "2df11b0caa26fc88afd0b5e5d6b71b786323f289", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594879, "uuid": "95148432-9286-421d-a654-68f752ebb65c", "comment": "Malware payload (Mirai)", "value": "fbba8fd89bd6dbff0f7e20d607b8972204eb20ea083dafba34fc1d6232be09a95e85b91efc7ce675008d3c070c876f6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594879, "uuid": "8d20bbb8-f6f7-4101-894a-eeae38954380", "value": "T1BD63028699729F029B348476F52455E7D66B16F5F2A2F4230F884310F05A8D2DEFF8A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594879, "uuid": "898d9b2a-2770-40da-af9d-b94677e5e2f7", "value": "1536:uUiQr365EgyNFsyP5gvkjOcHBVpQXKSaZL2eIpLzVcF9nL1yJRZKa9BC0G:udg65EHNFshcjnpQXKXLRIF5cF5L1sxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594879, "uuid": "a5bdb195-eeae-4884-90b9-5d514f896d53", "value": 73020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594879, "uuid": "7492d30a-2ff2-495a-b9c1-234c6885df89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594879, "uuid": "9d7b94b5-4a57-4008-a397-4f373c630074", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1afea2-c550-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763560882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560882, "uuid": "02962754-bffa-4234-b60e-8176c6ea039a", "comment": "Malware payload (RemcosRAT)", "value": "9ebd8b5fa7aa04b7dbab2d04667f4690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560882, "uuid": "2fae04a1-f30c-4e14-ae52-b1ecb8315d3c", "comment": "Malware payload (RemcosRAT)", "value": "084fd47a500e122be1ab53c87d6b679bbb34bd1de0d2df5ad8fc7fc75f006f26", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560882, "uuid": "2c73132e-bacd-4305-b385-fa961b8eb627", "comment": "Malware payload (RemcosRAT)", "value": "3cb2272a8bd4d10a8931e022acce57d59a32820a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560882, "uuid": "25ef40c9-25bb-4fb4-82b8-025c2023228b", "comment": "Malware payload (RemcosRAT)", "value": "e083e0f2ec41e90ddc8f031f2eef2671633d8034cadccad055ad01832225e45f68756c8cfa0629251416ad849c2c8286", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560882, "uuid": "eee12c39-8f5f-449b-b2dc-4d74929c9587", "value": "T11D251244221ADB02D4A71FF42960D2B457F9ADEAD832C30B9FDB1DAF792AB4549443C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560882, "uuid": "4b5c8793-b3cc-41cd-8130-852c0ea00024", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560882, "uuid": "79854c64-e82f-4a6f-8353-2685d2f2c31e", "value": "24576:V/VpHZYG+7DdWAcA6WE8nirHZLEuOEMH:V/VxZ2hWtCEtFFk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763560882, "uuid": "36f65b0b-ce94-4313-bab6-89efc34af750", "value": 978944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763560882, "uuid": "5dd117fb-7d99-45da-b1c7-647587a27718", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560882, "uuid": "ac8b2ed3-26a6-4bf2-923d-e65050daaec0", "value": "PURCHASE ORDER-2025-110010_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536f163d-c520-11f0-a129-42010a9c0007", "comment": "Malware payload (ArkanixStealer)", "timestamp": 1763540307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540307, "uuid": "a5c2e1d9-c6b3-49b1-8054-2eefd5242272", "comment": "Malware payload (ArkanixStealer)", "value": "b7fc784520334a653fb0f2174f8c0275", "object_relation": "md5", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540307, "uuid": "7c72b958-f846-4086-b5c4-2330ef79f939", "comment": "Malware payload (ArkanixStealer)", "value": "08c9e700f5f0b357868ab209e4533bb67d0539b20e639357b6e9854ed8d56415", "object_relation": "sha256", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540307, "uuid": "b29e655e-97a3-4e7a-aafe-2ffa2f0a6752", "comment": "Malware payload (ArkanixStealer)", "value": "1c9da11cf6b59d99f343285f7000076d3d5284eb", "object_relation": "sha1", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540307, "uuid": "352835b0-14cb-4bcf-b5c9-97747bd12800", "comment": "Malware payload (ArkanixStealer)", "value": "cb18fe997008fb99e9cc0f432185085eeb53b792600d3037612ad51730d3968b5f9a794d611c187bb3dd304509c0a0b5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540307, "uuid": "fef6c877-e874-4ce9-865c-9a757416313d", "value": "T15B8723AA55D5B2D4DBC30540638F43DE21D1A47D81EA5C3C3AC72C029A34EEB668DEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540307, "uuid": "e38c4a25-5259-4e05-b273-de13e3a54c1f", "value": "3f89fcc81a8c8aca2e05ddab1c622a0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540307, "uuid": "ae15715e-db77-4d2a-b8f2-7fb6197426d7", "value": "393216:2Oi5lhyyN7IgV3geofoFnsIgAlqHy0KJvOb+iQftLCGpp1moc715zkKltstw3ozU:2HKgVOfo5sIaS0KJmytrbsh5zDzT3qIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763540307, "uuid": "bad45fc3-6238-4c9a-8a07-28b21f1a44f2", "value": 36230023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763540307, "uuid": "9035511e-4cda-4920-86a7-0c1ededd9ddf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540307, "uuid": "7ecd6c0c-2675-4a53-92f3-3fc900e73f8f", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd925d7f-c54e-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763560296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560296, "uuid": "88fd0b15-7475-48f8-9222-41ed3b4ef176", "comment": "Malware payload (RemcosRAT)", "value": "25033205620f478e49ee1aaafeb1ca2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560296, "uuid": "742755a3-c323-4bb5-8432-d50c26b9f0f2", "comment": "Malware payload (RemcosRAT)", "value": "09628e44730e751aa5f91a92541d5510ccdb96604f266ead6e3320402d8bf1e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560296, "uuid": "c9f2f12e-61cc-4b4e-a442-e52aed891cbb", "comment": "Malware payload (RemcosRAT)", "value": "094d742124ade733c46c2e8ea91db22b7876cb2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560296, "uuid": "fc9b577e-7a65-4a03-a1de-7490af3fb25d", "comment": "Malware payload (RemcosRAT)", "value": "cebc4dfcfca0d92a33590ab1c03a7ac75114e3e8e5afebe0a216737c4de6c8885bf31c426a0f1c6b1b5cbe66c1c956ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560296, "uuid": "850d0879-4826-4810-b97b-ab4e031f2786", "value": "T11455D01363DE8361C3B25273BA65B701BE7F7C2506A5F96B2FD4093DA820122525EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560296, "uuid": "4ac9572e-5233-415f-aede-69a3c6e21b7c", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560296, "uuid": "94304a21-cfe4-474e-b897-de4029866806", "value": "24576:btb20pkaCqT5TBWgNQ7a16rw5Qwpbc66OI6A:YVg5tQ7a1OyRYn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763560296, "uuid": "e3551643-5a7f-4923-93fd-db51cfdfa7e2", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763560296, "uuid": "b8f13eb1-e823-44fe-b5d2-8dac754b7584", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560296, "uuid": "0f2dc210-ba87-46e3-b4d9-03b9f8a897a6", "value": "INQUIRY 2025-SP0006.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50b13f5b-c522-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763541162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541162, "uuid": "216a1a76-7d8d-462f-9db3-5a2f9a430192", "comment": "Malware payload (Mirai)", "value": "e5123d2ecf439f66c1abb7daae3210a3", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541162, "uuid": "332eef54-46d7-4696-a628-9032bfe7e5d8", "comment": "Malware payload (Mirai)", "value": "09a730a356ccab9e58a6a3011e0482826d8eb2f24d1b9c76611e50626d0a657f", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541162, "uuid": "942ea243-37d4-491f-99b8-2875d75d029a", "comment": "Malware payload (Mirai)", "value": "640930a63ae133645d1470f0bb23ad32143b881e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541162, "uuid": "e2c02630-260a-43b6-abdf-42c30141978c", "comment": "Malware payload (Mirai)", "value": "25a1fd57c1d089f4bf4b73ab103be50489339c46185451eea297bb58dd06f6f4e79504730b6529879040a4c8c201fc3e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541162, "uuid": "6f23a1e8-386a-4bb0-80cd-0916faf8be90", "value": "T11D01F78C81466E53260DCD56B393442D117EE7CDB5DE2BD0FEC8EAEC86C078E6019AD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541162, "uuid": "8f13d02a-11d9-4386-a115-3d46cdd77a86", "value": "12:KhI5W3CtI1/TbNZ7BwqL7Zg1npLO4C7Z62kC7ZOzliAEEZ7Znzqld7ZhoJiw7Zl1:KOQyS1bbzBbW1npLO6vLliANzql5oJt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763541162, "uuid": "660de5af-dcf6-4a91-b141-2a49b4dc60cd", "value": 677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763541162, "uuid": "277a3437-bb98-405d-b743-02239f1d3510", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541162, "uuid": "aad2dc54-5e56-4bb7-9427-3d20ab537c46", "value": "acurl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b199b0-c597-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763591416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591416, "uuid": "9634b525-8e53-4b0a-9f4c-c02fa3b5e0e2", "comment": "Malware payload", "value": "d02fa29edd6fb66d1a3ff7950fc3c3bf", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591416, "uuid": "a2199034-bb0d-487a-8ed7-bab0a6e47ee6", "comment": "Malware payload", "value": "0a63540ea6792981def79d60ecf40fad59e52c5bd8b4922041f1acb6e4fa5eaa", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591416, "uuid": "2b386ef8-2796-4e73-ab83-48b14c5e22fe", "comment": "Malware payload", "value": "aa8dfe6feb02d08f1f0f9d1e98b8fdfa2438f6f0", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591416, "uuid": "2ccba079-3a2f-43da-b53f-1bff2ba65c47", "comment": "Malware payload", "value": "bb62c0a248ac9833bf77c5bef1d2e88510dff728152f08bad529cfea0f0d40470dab579f88d1a087ccffa6c9547607fd", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "WsgiDAV", "colour": "#C5C90C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591416, "uuid": "a89db220-34af-4646-b270-7f9c24329f79", "value": "T1B9C08C54A546C2AAD3A0121262B0FA0A684FB65A08C5C09D63A3CE4B6C864E1C246EA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591416, "uuid": "d3db6108-49d3-41f7-80fc-8484f156caf2", "value": "3:HRAbABGQYm5M9eGAWJE++f1bYbHKs7V25YdimVVG/VClAWHyn:HRYFVm5MQG1E++fPs7A54vVG/4xHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763591416, "uuid": "368e1514-85ef-4b67-8e93-d427f95d8bc7", "value": 153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763591416, "uuid": "883e7675-25e4-4c00-8993-c9bb556b8842", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591416, "uuid": "6af9c402-7940-487d-8e58-ef98a033be39", "value": "DATEV-Rechnung Nr. 53511122025.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c85d0b8-c4f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763522176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522176, "uuid": "41584de5-c325-4298-b34c-1aa6abbad966", "comment": "Malware payload (Mirai)", "value": "0d88533c29bd8968c27c82174259380e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522176, "uuid": "41b09421-24bd-404b-b2ac-23aae04875e7", "comment": "Malware payload (Mirai)", "value": "0c51235089ff02d6e4fe2ecd436eee3ac64331c0535a7279ec7a686e85ebf520", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522176, "uuid": "49f621dd-3705-4f9c-814c-af2c421275b3", "comment": "Malware payload (Mirai)", "value": "95850aa701940d52683727dbe5f3ccd2617d9d55", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522176, "uuid": "53a87094-01f6-467b-a652-a9adc5f38b88", "comment": "Malware payload (Mirai)", "value": "b51014fd27f272bd619577cf68063fc9f02661d78dd359da05dd8a1889a5c75c1f3716d1af588ebce246b384c524d614", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522176, "uuid": "c34651dc-169b-4960-a4fc-8696f6bdc2ac", "value": "T1E5A2D030169A7FF8C37188BADA3A43CBA323077A50D97574206202F0959A56EB9F51DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522176, "uuid": "e1886664-94f8-484d-b00a-d5f4728fe4e7", "value": "384:qWpDrl0V2agUwPpp45gQuG+qhb+ZIjhGFDCiCY3gPXA0hymdGUop5hb:qgrl0MvPpGtu2RseJHo0s3UozR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763522176, "uuid": "255db37e-0b13-48f6-9ee8-c4cead5c8979", "value": 21552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763522176, "uuid": "30e5ed9c-e595-46b4-ad30-94d088513c5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522176, "uuid": "bdcf705f-d999-4d1d-9a1b-705533291a14", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83747a24-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589780, "uuid": "9685a43c-7b56-4be7-a828-2c1cf5983eff", "comment": "Malware payload (Mirai)", "value": "bd945b10384f1c60d0bc4c7748f401a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589780, "uuid": "af26ac94-4586-4beb-b985-f4de9cd6f5cb", "comment": "Malware payload (Mirai)", "value": "0c94cdcb29a7ce165708da23b33640cc2c55be429addb225008e5e7a6bf0c530", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589780, "uuid": "1e7ba3da-8831-44a3-97c7-6c2a240e33f2", "comment": "Malware payload (Mirai)", "value": "2d8c07d35ecc212146e713a71a04ffe5cbb7d7b2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589780, "uuid": "c42c87d5-4fe5-4416-aa85-174001dca289", "comment": "Malware payload (Mirai)", "value": "60ebf4b2e4beca33bcce6b3071a40b49825b122676ea16ee94992e38c8bafc644764152106c8a008efd64df33c0bc28d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589780, "uuid": "6d1cc02e-3c32-4e3e-bef8-0e8a1a6443d2", "value": "T163144B46EA414E13C4D7137AB6AF424A333297A4D3DB73068D286FB43BC279E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589780, "uuid": "4cac03ac-1357-441c-a56c-4dc91aae8f2f", "value": "6144:TJfPwUaRtzXevpCtBa2bRblcSQsZCZtchW3b5M/9/GKg:TJXwUaRxOMtBa2bRblcSQCkqQu/9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589780, "uuid": "df029a2a-9454-4070-a0d4-444915f98b8a", "value": 201647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589780, "uuid": "e6cdde5f-64af-4aed-a895-9c7bae7f73b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589780, "uuid": "f3163d70-bcf7-4740-a774-82d6302fd572", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c82fdf-c587-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1763584528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584528, "uuid": "d87172ba-7e64-4bf9-b29f-890ca048a291", "comment": "Malware payload (PureLogsStealer)", "value": "e51ff443f68fbfe539512068c4a6dbea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584528, "uuid": "f634ee68-8bd5-44ad-8f16-cb47b89a612b", "comment": "Malware payload (PureLogsStealer)", "value": "0c9763b282a94e6f1bf191d2673f78aaa04a90020d8510991076e95073d13851", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584528, "uuid": "01b82c60-4e92-4f7f-be5e-c66eb3207d8a", "comment": "Malware payload (PureLogsStealer)", "value": "f41a9865673cfab28cec161b5d915aaaee146318", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584528, "uuid": "562c712e-c443-48ed-b081-f8021884b06e", "comment": "Malware payload (PureLogsStealer)", "value": "cebdd063f8f2a22f40738c8d447b2e6387a0489afc37255926ea884e8fafd5143f7bd216be05fd03f4544ea59eb2be9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584528, "uuid": "06f8ef91-648c-413f-8271-75e009e4fd3e", "value": "T1DBC4230816885B66DE83683FC58FEE44C2F2C8142C3BDE6D4D5E6F0699D8F15CE429B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584528, "uuid": "95fe119c-62f9-4627-be94-ca52bdd7031f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584528, "uuid": "ddb6a781-7c66-4f6b-822a-2534c3291232", "value": "12288:H0SB02tgWhWXSyoScBbUPrFRm4FEV40f2U+1lRkwATeFt28R:UE02tgWsSyo/UPhXF8f2UoRfATqkg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763584528, "uuid": "5a127439-9886-4e15-aa85-d5dcc60c649e", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763584528, "uuid": "5b66ff59-8fbd-4598-a2d4-fb5ebf6a9792", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584528, "uuid": "8b38cbd8-2516-4de1-9aa3-8c2106494b18", "value": "E51FF443F68FBFE539512068C4A6DBEA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485acaf0-c51e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763539430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539430, "uuid": "aec5a767-bafe-4564-b280-98342dd1dae9", "comment": "Malware payload (Mirai)", "value": "21b02244d9bcf0ceb9b47521011d8a6c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539430, "uuid": "a7261529-1703-4752-b9b6-354104d49466", "comment": "Malware payload (Mirai)", "value": "0d5d5125176d5f3f86a5b2a8b9beba20cbc3489d74a0f4570a2bb3a635d371e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539430, "uuid": "6bb671a4-a62c-4438-a419-63781ea46228", "comment": "Malware payload (Mirai)", "value": "412c4a5a1b7096bc6df31bb68e40a6d91c040df9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539430, "uuid": "6410d543-7785-4170-a59d-64dac72df7d7", "comment": "Malware payload (Mirai)", "value": "dc30e42dc8d0f893e3ac6bf74a816ce562f6307642ec9576653408d484e9ec4a5852e767daebeb27a93dbc7c43748c15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539430, "uuid": "b8bea74d-9e22-4dc9-9ad6-3e3047641ac5", "value": "T1F3833A56F9819B11D9C015BEFA1E518E331307BCD3EE72169E20AF21638B66B0E7F506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539430, "uuid": "480e6073-8799-400c-9d44-c3a68c5bfef8", "value": "1536:RNnXHnmXBSlduihaywnxSUsu4nQakucW38Mri5lAsPMZ70E5XYPTem0:rHmXezhaywnj4nQakplAsPMZ4E5f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763539430, "uuid": "d943f609-c70b-498f-9cdb-efa45e7d99f5", "value": 87248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763539430, "uuid": "6e06122b-e72a-4c7c-bbf3-15d0f8aed9cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539430, "uuid": "58d16197-01b9-47f4-811d-4f115c9b1bf7", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c796ad14-c575-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763577009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577009, "uuid": "714f4c0a-b810-4247-9769-9a78cae56e54", "comment": "Malware payload", "value": "c1138cd6897a5a45d87da1e13c48a90f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577009, "uuid": "9e9e5a64-5e40-4292-afa9-a177847ea825", "comment": "Malware payload", "value": "0e4f30b737ba230c6f2068edc47e7da75f8814fd63e8674f150b1bf1ff70984e", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577009, "uuid": "0df6bd43-e967-4c83-8362-71d9092e9351", "comment": "Malware payload", "value": "0eb24614241fb47e03df6677de9e9570289c96d4", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577009, "uuid": "daab1ec8-d562-4e83-aa19-19986f9bc5b7", "comment": "Malware payload", "value": "b8bbb502b3aefe4b4db38881f2e1e5c12f12fbf3a7506450f7cd3bde5be05c029c2e5e39a0f7fa04e85c1b67f2c50c3f", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577009, "uuid": "7d7b1c2e-0ab7-439d-a9ce-21cfde4fcda9", "value": "T11A31431B220D277816BB2362E739429CF77E174A170132E976A1A47872453C09FEE6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577009, "uuid": "30fea963-2ce4-4ae3-a25a-4cb53d91708a", "value": "24:wLJgb5Cbr5x99rHFL/HiKObieuluP58xKdOBDRaRuCDXRcmQ87Tno4ipvNL4IR8/:qFFL/HiKDeuluPukdOBVaRuXVbMRgY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577009, "uuid": "3600e079-433a-41d0-966a-6305feb1fa8b", "value": 1787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577009, "uuid": "41787cad-7e56-4bd0-beeb-a0763ac5acbf", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577009, "uuid": "96f601d5-2ce3-4183-a8d8-e4af10406ec9", "value": "ZoomWorkspace.ClientSetup.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e673c1e-c582-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763582363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763582363, "uuid": "b6091582-8bca-4e9a-8332-26c72374d5cd", "comment": "Malware payload", "value": "35197d8753b88b9361d387ac861fd14a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763582363, "uuid": "74c56ee0-d345-4778-9080-8da35542a6c3", "comment": "Malware payload", "value": "0f195e794d152fbfc8f6057385975fa764060c1979751b99314251757ccea426", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763582363, "uuid": "5e80616f-2d4b-449c-9e6e-152e3d3f8ee1", "comment": "Malware payload", "value": "08b82c4b76135c5a18cee82065656561b9ec80dc", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763582363, "uuid": "62c58f53-2fdd-4829-acb1-df37f349f679", "comment": "Malware payload", "value": "c88303398f8813fa2c6d3062a7b3d83e9e8bccfdf116805d078c1243c42e43c4aeb42552da6d892c7796234ac04e4e48", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763582363, "uuid": "d585bc90-e9d7-41ae-a938-1c3f8f65e6fd", "value": "T15695234E69845CBBC094F7BEA24653AD38723E475C424E973526F7431C33A50AEE229F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763582363, "uuid": "e94099f7-6ac0-4ef8-b3b8-c88da5487592", "value": "679877ea45ff38e48e48875d525bcbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763582363, "uuid": "510bb734-717a-43a4-8fb5-b86485d1f01a", "value": "49152:1sKKc5nno0ZirMaZ7iZc5UJwkVAJu6Bs4AQvxH:SQno8irMaZaPMu6BeWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763582363, "uuid": "f08f9a98-f6bb-40c1-8859-6194e6bf8f68", "value": 2006056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763582363, "uuid": "a6700c50-67b0-418f-925d-43234258eaed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763582363, "uuid": "fb1ec2c3-8f54-421e-8ca5-58faf3b47121", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63e5046-c565-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763570135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570135, "uuid": "513dc6a7-9c93-4af9-92c8-79b349628aea", "comment": "Malware payload", "value": "32bf646deab9e353ca23f957e61e9bd3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570135, "uuid": "fa6e9cfa-3fd3-402f-a5d1-30ad2721fc06", "comment": "Malware payload", "value": "102596c6c0ac0201bb8eff29e1e210540f192026927a79e23d27b11dc25e4b33", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570135, "uuid": "1eb058c3-cbb8-4295-823f-3b2cf442886d", "comment": "Malware payload", "value": "1803905e8855aca16f4f737483d8d6dab7213b51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570135, "uuid": "33cf0557-c58d-4095-ba6e-0e2b7aa68a12", "comment": "Malware payload", "value": "6796e1bf5ac77abf1ee5e853bd97caafcd1529723f469070b23ac6aef203a0c9fc553b6c4eb5155fc15124d587caf80f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570135, "uuid": "9708329d-0481-41f6-8d2a-a22ce688318c", "value": "T19BB34D45B7190593D2E31DF03A3B27E283FB8E9111B46249784FBB8E95B2D321886DDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570135, "uuid": "bf1f3648-8668-4768-8bc4-dcb2c09ced37", "value": "1536:JnBAtxv13RXGxUq1UIhx59octT4vVuIsCfJhO4KrJoQjH8R9bKge3adFoHxJtn5C:fAtxTX+fpmJ0w7e3oQn52KE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763570135, "uuid": "4b98b9c9-d352-4a5f-8672-d644110eeb22", "value": 111724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763570135, "uuid": "b6615401-616e-4b2d-96d5-17ce66f95630", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570135, "uuid": "451af2e1-5c7f-454c-af87-fa5c4ff19eeb", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d671ac-c529-11f0-a129-42010a9c0007", "comment": "Malware payload (Hajime)", "timestamp": 1763544118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544118, "uuid": "d06756de-99af-4171-aa89-b03668515e81", "comment": "Malware payload (Hajime)", "value": "1775473f4f16bf2131de716cc76d2257", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544118, "uuid": "5b5e5454-7543-4d63-b48b-49076f17f6ee", "comment": "Malware payload (Hajime)", "value": "10d9050fd2cce094214ce2fecc244ec6c2d06479a2f64f0567a80c01b995e384", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544118, "uuid": "c88e767c-5759-4405-82af-6e7aa395b3fd", "comment": "Malware payload (Hajime)", "value": "997d880d20b046da063c3060f9fba6233034cca3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544118, "uuid": "beb17a5a-cfc9-4564-aa51-c9a8a4b958f3", "comment": "Malware payload (Hajime)", "value": "e654fa49589e676b88db11525626590a95b6bf57031d3fce38dc16324f32ad2c3f7923b0035faee6ba4977f599a88ea7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Hajime", "colour": "#A08D3D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544118, "uuid": "a78fe9a2-32a6-4b11-943b-448b3238cdfd", "value": "T19953120623AA2AB255618AF1E7FDBF88F6493D588FF66C157C107D28B97235C1CC490D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544118, "uuid": "04ce2ad5-d4f5-4c30-af88-d2554eed6962", "value": "1536:yYI0ARqw1qAEW67UIWi7M8gmfmJo0WgswnD6Efyq8PR:yYI0ARqw1qAEv7UIFM8oJorFquyje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763544118, "uuid": "a735d516-831a-44c8-af0f-e53bb30f61fe", "value": 61548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763544118, "uuid": "f3cf5dc8-4c6a-4ad6-98df-baaddb4528fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544118, "uuid": "6d29fa65-6b04-49a2-b7c8-80ca2e9b2075", "value": "i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0aa8c63-c51f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763540088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540088, "uuid": "1a5a5c80-f902-4030-aa63-c9fd056465d6", "comment": "Malware payload", "value": "20609b90a830f81af2b6c1a355170ec9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540088, "uuid": "62a10aef-0abb-42e9-a6d1-b70558661f3e", "comment": "Malware payload", "value": "11370d218430a0bdb2b584eb4181c21bd2abe9958ba639c017caf04ec019d117", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540088, "uuid": "069e1082-72e4-408b-abae-f58d7935d0f0", "comment": "Malware payload", "value": "d39d10d9e4a27d2a44c0d17ce162bc7b78f49b06", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540088, "uuid": "6894ece1-c7f5-457c-9caa-35f49c13db08", "comment": "Malware payload", "value": "ea8aedb7255e1acf15f837be125ac526e6a7760cf8933f624b9b4fbdcc13520e1e0c2c4606e6570adecca4396edb0780", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540088, "uuid": "418de4e3-79ea-4d5c-8c02-22ac4aff625b", "value": "T11206332E54F61ACD10D1F42EBB6233C5F031C85A9DB71C2CA5AEF4654DF3AA942807A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540088, "uuid": "9a21cbf8-7d3f-4e4e-953f-31196ae58296", "value": "98304:bXHbaVYJo5n8uZ0e1ErADECHBp1rWYnZOFs8eC:bXHbboz2rAICEq0Fs8/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763540088, "uuid": "e9b74d0a-8d71-4077-a1b6-6484c9118275", "value": 3811200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763540088, "uuid": "df75eae4-c6db-4e8a-9732-f90849e733fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540088, "uuid": "f8797b59-0463-4e2f-9fdc-b0f90744f1ae", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58ceb54e-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589708, "uuid": "d2168d9d-1ecc-4d42-8fef-7de811ea9351", "comment": "Malware payload (Mirai)", "value": "555908a586cbfa2ad77182d551974c9c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589708, "uuid": "e79cbfa3-898e-434c-aa83-16344c11a119", "comment": "Malware payload (Mirai)", "value": "129e34442b5de7efd65f32ebcc0d0e4b9bd07e232b397908a984768c89728663", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589708, "uuid": "e71cd805-1d13-422a-bb90-8cc521edcf74", "comment": "Malware payload (Mirai)", "value": "253a7d6e085a73694ab26539b37fb78d39bc1887", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589708, "uuid": "fcc85322-6022-4d34-a5f4-80bbeffcf9d2", "comment": "Malware payload (Mirai)", "value": "73d7bb077c75ab37643c09951d5f58b621256858d94da6b4a7d0f260849d1ab12ce0eceacbb913c071a812f839558bd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589708, "uuid": "cfe23e0d-b9e7-4f2a-9f69-9394cde0cdf5", "value": "T1E723F1A17B2032D2D3344876A60BDAC171B35AFD70B6316D2E6607D9A44F51A37B029A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589708, "uuid": "0b62a154-8e8d-4551-b2e3-261810c29e31", "value": "768:6H28g1/kwRKDydcjfAUI2oLZmscDuedFCsxd0JyLNvasMNUf5OXYsMs3UozZ:G2Nq6xXF2oVm9YsLNvmUf0X9zZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589708, "uuid": "8b767570-7954-428b-aa26-52d11121edb8", "value": 47356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589708, "uuid": "3fffa93a-0d47-45ca-82d5-8db8a10c871f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589708, "uuid": "a8496d8c-01ac-47a6-9ec5-fc0cc00ffba1", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5044968f-c520-11f0-a129-42010a9c0007", "comment": "Malware payload (ArkanixStealer)", "timestamp": 1763540302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540302, "uuid": "a298428a-63ee-42b5-ac41-3cecde990bab", "comment": "Malware payload (ArkanixStealer)", "value": "0a86e62dbd78bdc7db5cbf92f9793a88", "object_relation": "md5", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540302, "uuid": "f4b9112d-54b9-4c78-a0de-c41c52dec9e7", "comment": "Malware payload (ArkanixStealer)", "value": "12f83cdf49c6bc9bfc21abc5bfc28d2c391747256e83c525f19431d07da544f2", "object_relation": "sha256", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540302, "uuid": "e2ee091a-15e9-4d7e-98f6-cb950674d946", "comment": "Malware payload (ArkanixStealer)", "value": "69bd2b89e96e60d73bb2d4982e3b9aa029eb9283", "object_relation": "sha1", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540302, "uuid": "2eeb4fa1-1969-40dd-8a8d-9293346e7741", "comment": "Malware payload (ArkanixStealer)", "value": "2460494aaba5ea1493f8bfffe2139bcab768600eba29f1b4842cb6fb0f2185e977a4bde007ab1a7c6d6977b25a1ea32f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540302, "uuid": "ce0895df-d730-4528-8a11-fb37b01ba2d1", "value": "T19A8723AA55D5B2D4DBC30540638F43DE21D1A47D81EA5C3C3AC72C029A34EEB668DEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540302, "uuid": "1e2ade03-c9b6-4785-b65b-43091df7610b", "value": "3f89fcc81a8c8aca2e05ddab1c622a0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540302, "uuid": "4cf755bc-0fb3-4bbf-83d6-0fa586283aa3", "value": "393216:2Oi5lhyyN7IgV3geofoFnsIgAlqHy0KJvOb+iQftLCGpp1moc715zkKltstw3ozu:2HKgVOfo5sIaS0KJmytrbsh5zDzT3qI1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763540302, "uuid": "2b514096-f440-44f7-ae88-11670bbc0380", "value": 36230024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763540302, "uuid": "cff25c60-1cb4-48dc-8a2a-997552885ac4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540302, "uuid": "2d387501-46a3-4f6d-8ec6-9128604e578c", "value": "0a86e62dbd78bdc7db5cbf92f9793a88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa86bec3-c530-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763547325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763547325, "uuid": "4bde0149-1c6d-4dbc-a374-96626c500124", "comment": "Malware payload (Mirai)", "value": "b4a32b150f9bdecf97c1cc7de712dc67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763547325, "uuid": "55d67bad-9ff5-43e6-978e-b1cbe883581b", "comment": "Malware payload (Mirai)", "value": "135d40b8ca494f32c5a82bd93beab730d06634e1bec60b2ef499df5a71b74ef2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763547325, "uuid": "e0f7ef6f-9549-4d27-ae2a-1c1dc14ddcb9", "comment": "Malware payload (Mirai)", "value": "2f00edb799b29d0a756c8d9e91061c03d26c2826", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763547325, "uuid": "c701ce2d-6fa2-49f1-a2bd-7b12151a1257", "comment": "Malware payload (Mirai)", "value": "be683038d3a165c50a858ee3ab8bee53792865a7a5caa8bf87d3cab408cd7ed1bdbb75ef89c1c28139022a9a28a5f822", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763547325, "uuid": "7fce39ba-3c06-455b-9370-10d31f021b11", "value": "T1D7A3E60AEFA54EFBE86FCC3706E9070521CC655712A87B7A7A74C82CF14A14B0AD3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763547325, "uuid": "0fdaf369-abe7-4a1b-b2e8-f456bed94b85", "value": "1536:NBUoCOM5nn1ZLcRyzH9TIKhibrBGPH2RFDTnJh3eKMKZdW18AQdhGgmTemb:NBUoon1ZocyZPdPJI0rTGgM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763547325, "uuid": "3bb5edd9-49c1-485d-97e9-6a700ae1de8e", "value": 102180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763547325, "uuid": "a53cc7f6-3a43-4b95-9181-4809154d1e39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763547325, "uuid": "4fdc1028-519c-4d9d-b004-3334f77d7871", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87879560-c517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763536529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536529, "uuid": "cd28bfbb-1bf6-46b7-ae39-601da9dfe481", "comment": "Malware payload", "value": "c2accc9f07d1de618c078d7b7624190b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536529, "uuid": "a6f9ea40-0643-44e7-a1c8-fd9e9f1152fe", "comment": "Malware payload", "value": "136a755ff109d31348973f5adf1c9534328f78809d0f665af4df9638233af5bf", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536529, "uuid": "cf619362-4336-4bbc-b807-6d857b6a55be", "comment": "Malware payload", "value": "c35ce12c45654e244fc902bcf31de89424a767fb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536529, "uuid": "0f136e96-512f-47cc-aa27-cb824dfd6f95", "comment": "Malware payload", "value": "4a5317e0368786a4943bb46a35660f708727070e06e21f8fdc816ffe3b1afd4eab4e8df0a42cf1e0cf65df9f406bcb30", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536529, "uuid": "42845a62-9f84-41f0-b05d-6a1d1753c96e", "value": "T126D7DF06F34A88AAECC6A4F9C50B16B19A24BC44436290DF6F05F3D169773E56FBD381", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536529, "uuid": "c38d90ce-0da9-47b7-a721-7b21a440ddec", "value": "786432:aftV4Uh63PPUNU8NWaZ9qDCicYRSncvWuXSM+i4Jo2t06H:stS86KAsqDCiRRSncvWJM+iOs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763536529, "uuid": "cb637dbe-e960-41f0-81eb-8a42e9534703", "value": 60315167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763536529, "uuid": "8310f9d8-1b0a-4ebd-ba1f-d8dc9a78e4df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536529, "uuid": "3bda0841-1843-40f0-b1b7-3b73a2b40145", "value": "app-i0000.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c30d98-c55c-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763565948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565948, "uuid": "1e96fd82-6178-42e1-9ee1-dd79d50f385c", "comment": "Malware payload (Vidar)", "value": "a17fc47dbce322bce030b1da31525187", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565948, "uuid": "f27fd774-b359-48f2-b284-5df57ffc896c", "comment": "Malware payload (Vidar)", "value": "14775a6d6bd2aa2418c024a7726f8e3e1b308703b1425b6cd8e2df18e13ec89c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565948, "uuid": "12d54e8e-e541-4675-922b-14d7bf29547c", "comment": "Malware payload (Vidar)", "value": "abeffd596f638b6940a3697a779253e4e3d57c32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565948, "uuid": "3d6615af-4e03-462f-8a1e-0d40aca411df", "comment": "Malware payload (Vidar)", "value": "02ac86770a50a4ebf2ed395e626718fab9b2d0cfd5c47140e82e704484918c3f88613cf10055cb3fa7bc1d6914943377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565948, "uuid": "dcbaf98e-b901-47b7-ae37-a03c0e8f88db", "value": "T12CD47D3AA490D543FA18C4B805E6972EE831743586726AFF05609263D95BAF08FC53FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565948, "uuid": "3ea8f406-f0c6-4444-81bb-791531e965df", "value": "79ddefae792645665e0f0b9eb9ec1da8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565948, "uuid": "8c1dc632-e954-4f38-9a2b-ebe7f809d00d", "value": "12288:XqDVdQPocqbvTzBVj69RvNxwDRsEzdG1uSQuOZea:gfQZmv5x6vlxwDrtSGZea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763565948, "uuid": "753f0bb7-7df0-42da-9e7c-64ebbeaa1403", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763565948, "uuid": "70418e3f-87a5-489d-accb-76403cba4a4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565948, "uuid": "6625995e-7c85-4eff-9f59-6557392143ca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7853db9c-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589761, "uuid": "61d112c3-9d51-4368-b7be-a6e6303628b8", "comment": "Malware payload (Mirai)", "value": "5c033a89875bff31b9f1a29cfafd1c92", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589761, "uuid": "91b07375-076c-473e-962a-0799b6063c67", "comment": "Malware payload (Mirai)", "value": "1612098d39f2a625a219844808b3d39ae6c91ea09d29e55ee5e9df46eb3c67f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589761, "uuid": "5ba40766-3cbe-4d1a-97c5-f521b3767567", "comment": "Malware payload (Mirai)", "value": "be46e55a6735e8c3c7f5bc0bd2e54d51e102e8ee", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589761, "uuid": "b14eb475-e8ce-4bdf-8ed5-6ea2ecc2d9ad", "comment": "Malware payload (Mirai)", "value": "89ae9efe268491e28c5c7cbdf7afe182f083270b9d2b915ec2fce137937ae33a636b68334037e2131cac17f8fd3be3a0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589761, "uuid": "26194724-5aec-4525-b9be-d4ab25dc68d0", "value": "T17EB34A4273180F57C1970AB02E3F17F687BFE5E021E4BA89650E9B5A8675E37144AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589761, "uuid": "95307625-e673-47d0-a2fd-4ff806368838", "value": "1536:GXXfJWeuWomtxzUZN/fyWpu+8pgKlwNUwBVKDR9f+JuU1Wg6HtQYc:GXXfJ1uGHwzppJFa9Kus5Yc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589761, "uuid": "1936e258-6605-4c4b-aab0-bffea4023fa7", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589761, "uuid": "8c7271f6-db34-4db7-a7bc-9d995637d48b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589761, "uuid": "4babb576-af64-4658-950b-4dd6a0fa2c96", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c67bf981-c500-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763526756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763526756, "uuid": "63e6eec1-fbab-40ed-bae5-c81f3afbe68b", "comment": "Malware payload (Mirai)", "value": "cbd1808f42c0048b7775f6c1c3a12414", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763526756, "uuid": "cb85353b-346f-470a-96fc-79d4808cddfa", "comment": "Malware payload (Mirai)", "value": "1a909997d810ae9685922f59d207c16dd31d1783f1601f5388486b1506091c23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763526756, "uuid": "9d84a8a9-1d6a-4fb9-ac13-3093a95e48cd", "comment": "Malware payload (Mirai)", "value": "528f622bac4a21329f69ab92c4de2a44ca2ddae3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763526756, "uuid": "9258404d-45b8-42d5-a545-ee60c6aaa9c6", "comment": "Malware payload (Mirai)", "value": "b080e44a7534eae682954c7ade623f921882c5448c22aa1b886000c30dc9696ba3794a64268c0cfc778d733d44795f7f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763526756, "uuid": "3544f8de-5fb0-4e89-b4d7-b914d201279b", "value": "T118A3D70E7E229FADF66C873447B78F21A759338627E1D585E2ACD2141E7024D182FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763526756, "uuid": "220a93b3-4911-45f6-89ed-d66a06f053cc", "value": "1536:LMQkQibTXyh9I+EW8c8PqjffZyG2huZe4fHq4jTemDviK:gZ3QII8c8Pq7ZyG2hn4fqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763526756, "uuid": "80079fcf-e474-4969-83e2-b082c23cc178", "value": 99908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763526756, "uuid": "52b56810-8a94-4fe1-88f2-e7efc9334298", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763526756, "uuid": "0c81e3e5-8645-44e2-80ab-bd6de895521d", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2d7b5d-c534-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763548890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763548890, "uuid": "1af9e009-8b58-4d60-b38f-9f16122d4704", "comment": "Malware payload (Mirai)", "value": "2ab211b7b8e385f5e44d57aedd22e51e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763548890, "uuid": "f7071e44-c1d5-41aa-9965-ae501e36ce44", "comment": "Malware payload (Mirai)", "value": "1b3942e81677a8a1c8997c08936eb5f6eb6589e109cdd352a8532a37bfd1354e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763548890, "uuid": "6275b986-2839-43e8-bd72-64db34936fc5", "comment": "Malware payload (Mirai)", "value": "6ebf335a94d2fab0250689530333e753bf0e0a40", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763548890, "uuid": "3ee6579e-1f81-48e3-a904-5644e0b10aae", "comment": "Malware payload (Mirai)", "value": "4c7a3a18fb0de4c5134cebebb46106e0adc51dc03f1f041569d7fde0705da48a0bbe0322cca181a80c52603f80e4f75f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763548890, "uuid": "42969cd6-d337-4635-b93c-20e3bc6a863e", "value": "T1503184F9256B07792FA29D63B2FD044471B256A79CD0EE68A4DC78F8518ED183093E83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763548890, "uuid": "de3c3d78-1d37-4adc-9b35-be3b52951ae4", "value": "24:v9ZQFsZBRtEuJPv/+RwAYLfUhAdksxAkDJxgIh4DC2D9KS:v9TRr/oYLcKdJakb5011", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763548890, "uuid": "cb140189-dda8-4c23-ae9a-3e738cb87fc9", "value": 1618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763548890, "uuid": "4caafa64-2b98-46f8-be4d-d3ce306e1373", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763548890, "uuid": "c905ad67-0739-4417-b888-2c9b6fbe90c0", "value": "8UsA.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a403e7eb-c588-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763585110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763585110, "uuid": "c14cfeab-d568-4646-90d6-24b91b8c4756", "comment": "Malware payload (RedLineStealer)", "value": "73a61ce072f48e65702d881769757816", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763585110, "uuid": "7eac569a-8332-48f6-aaa5-6f93646290ae", "comment": "Malware payload (RedLineStealer)", "value": "1bb317965246a34594936d0b0aa670bd5843256237a4af39f269dcdae29728ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763585110, "uuid": "d85fc8d4-5a0d-4d95-8ae0-472fb71c2e56", "comment": "Malware payload (RedLineStealer)", "value": "467e3379acee968daa39e97fd58188df4a055c4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763585110, "uuid": "745c27ea-4c8b-4912-aec9-516b994c3be6", "comment": "Malware payload (RedLineStealer)", "value": "226173e25b9ebf89c60884945087f20e7b65a297609288c6403692708df1a12c4a1bc252dab7b1a7ccb0f811b5e07367", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763585110, "uuid": "2bcb59e1-64a1-4de0-b9bb-518946419e59", "value": "T18994E02236D1C032E47329309DF89672EE79BD316A75950E7F903E2D3EB1692C226753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763585110, "uuid": "efd9982b-d0a3-4bb5-aa84-3f0d536c5647", "value": "4cfda23baf1e2e983ddfeca47a5c755a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763585110, "uuid": "646a88a3-a57c-47c1-99d5-f33dda690d52", "value": "6144:6sxanyfX5k7JlJDlABKUtfU/WQcb5WuMEwlCgLwWPZTVfexMoReshtY:70nyfXuIBDtfubEwYk5TQcsjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763585110, "uuid": "5b702a4a-2305-4456-94e4-2faafd182897", "value": 435929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763585110, "uuid": "d90555d6-f9e5-4fed-b88e-62b45ec916d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763585110, "uuid": "5f756fdf-82de-4373-80f2-217671b165bf", "value": "73A61CE072F48E65702D881769757816.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e5f2c1-c55e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763566908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566908, "uuid": "8fa0959b-5019-4f8d-90bd-fc6ca5516967", "comment": "Malware payload (Mirai)", "value": "b6eac1043d68bc70e4363cf7e1c9f93c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566908, "uuid": "c3196ca8-5751-437c-b995-572dde14c8a7", "comment": "Malware payload (Mirai)", "value": "1c6c75608900d4e7f43b28e7f38ac8c605c4b6913cbd146eac29225874abdade", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566908, "uuid": "e5e1bbd7-0eb8-420f-9dbd-dc3e1dc0cefc", "comment": "Malware payload (Mirai)", "value": "0c41b1d84b78c324ca5b1d08d985d3f54cc4837e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566908, "uuid": "1699f8d6-4d1b-45fa-a4ff-a1fd43acfbf3", "comment": "Malware payload (Mirai)", "value": "48be9a1a021b30d13d0dab88dac9ec40a0afcf55a64d11a3bd9dd1b711f512a1e6767701948930d06863860fd071a950", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566908, "uuid": "02457808-29bc-479d-a310-5b33872375ac", "value": "T1BB634BC5E943D8F5EC0506726073FB335732F43A1026DB87E7A9E936EC42A11A64A39C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566908, "uuid": "2febc3db-05c3-4f44-a424-cfeb4e6696f3", "value": "1536:gVCyuBAeWHOAoQQdy/jyFg42p6yjCj3cidg3V6lw3uHu9R/S5bRD:gVteAeWHl4ELL42p6SCT3dg3QlO8YSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763566908, "uuid": "adae200f-2170-48fa-acc3-ee2651448aeb", "value": 70588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763566908, "uuid": "0b85d4ce-7267-4dcf-bc5e-8c56fc988fb3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566908, "uuid": "0acde278-aa8c-40a2-9438-845d975aa9ca", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b48b020-c584-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763583324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583324, "uuid": "822553ff-caa4-4f80-b698-807787616c84", "comment": "Malware payload", "value": "c37aa1f15440984474370c9672432449", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583324, "uuid": "4b987cc6-12e6-458d-be5d-4fd016a9c877", "comment": "Malware payload", "value": "1c7af2a207fb45a7c54613e5f7d185ea20afe2d36fcff25f09e2163025eba216", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583324, "uuid": "72998047-1e95-4ded-aba8-5bd16948806a", "comment": "Malware payload", "value": "996b031230653a8c30a599294887104e7560c09a", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583324, "uuid": "86d34561-8ddf-4c8e-8b97-c25cf0249528", "comment": "Malware payload", "value": "69723910ed2d1856979076a504ea17c0a586800b3d676308fdb0300cecd6d9a36ae6888457454dfcb74ecfb00c2a56df", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763583324, "uuid": "e89bbb2a-7648-4dc4-9158-1a0fb784e696", "value": "T17941542FF901E3399E42C27391E65C3D9F91161A4400C0B4B6ED846CE728A35EBBA5D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763583324, "uuid": "1d283f71-bf6d-4260-98bf-5da3665293c5", "value": "48:e6NETob0vknIPOCEjHyOz+BDzZOQgqWWAjUFP:DiobzIPgJNq1ES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763583324, "uuid": "433b3a06-fe3b-4554-a288-72b599dd8d12", "value": 1950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763583324, "uuid": "dc7e1a09-51b3-4efe-80f4-5b34e3060750", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763583324, "uuid": "9df71dc3-3ab1-4a30-84c8-dafb75e92034", "value": "Zoom.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4f3a782-c513-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763534861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534861, "uuid": "9405b17c-fe11-4513-9886-97c5fa851570", "comment": "Malware payload (Mirai)", "value": "dad10f02abda07e3d4bb7a5f70e432b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534861, "uuid": "b2b9d28c-6933-48a9-bd85-3412966a0790", "comment": "Malware payload (Mirai)", "value": "1d5ad0a24c498b09d5299ccbc9a1e23859c303c59078c5e773e81bf3b2d50d78", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534861, "uuid": "7d41d3f7-1217-4425-9187-20dfc4239902", "comment": "Malware payload (Mirai)", "value": "7203e7c9d0ce27d710a6ce21eb3b958cd00aa5c1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534861, "uuid": "977602b3-cb4a-4655-8e3c-a8875ba8a177", "comment": "Malware payload (Mirai)", "value": "6c0a61a987ed25cde0d8f5a497fa24914f299afa3da01509d3ddf8c807c244d3a17a3055e5dbad92e75dfafdf880ffcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534861, "uuid": "7af9a992-dff7-4762-9a1b-460b061d002d", "value": "T103B34A42B9816613C6D2227BFA6E428D372623F8D3DF7107CD205F21378692B0E7BA55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534861, "uuid": "58b286c8-62b8-4d84-9de1-c805739f80e1", "value": "1536:TGuGBfreoSjLRvHBn5+WxfhQtY4nTSKnVsOnyq/2DcHV11vlNF:UreoSjlPT4RTSOh+Y9lX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763534861, "uuid": "08cc77dc-1a2b-46b7-995f-36c2bc63e1fb", "value": 108988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763534861, "uuid": "c25640f9-dea1-4169-b348-ae3e20846df6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534861, "uuid": "0edf2eb7-918f-40e4-b0ba-1721abae2468", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8355117f-c586-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763584196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584196, "uuid": "0d47bb6f-890c-42c6-84e2-b08bc30f2333", "comment": "Malware payload", "value": "da0b1d593e92f14b733f65325c1691bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584196, "uuid": "8476542b-1231-4308-81ba-940d3ec77cfb", "comment": "Malware payload", "value": "1e380e8cc9bd2b4392cb7d324c93b1a0f283ea386882552fc9ea308f6262579a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584196, "uuid": "8312e02e-460f-48dd-9371-b5dea30988bb", "comment": "Malware payload", "value": "3a794c75d5cc8c21abc4108f32ff5d1528ca2f3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584196, "uuid": "69af0e5a-5a15-42bb-b45a-d2ff6bf4381e", "comment": "Malware payload", "value": "ccffda30bbb5f6e9df1bff8b95deaeefa778997caea4a46ec5044d7b8902e0b61128ebc04cdb548430a030c222f38caf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584196, "uuid": "0207ef54-057c-40e3-99d9-1da673c442fb", "value": "T1F754233B8360F5AAC5718CF446E1E6BA0BBD36A71808CFF9D56115B35F811FA52732A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584196, "uuid": "ed670765-c174-43b4-a640-0c74684860f6", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584196, "uuid": "fd2f90e8-753e-421c-b715-a7551eec41bf", "value": "6144:WMpqJSuFLsbqKT3FFNFJhkxAhXFLuYzuQ/B4:WMpqoumFJSs/xJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763584196, "uuid": "11c8f732-8b91-49fa-8966-40048352c75a", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763584196, "uuid": "bbf37bd8-281d-4017-b087-21bbc88d050b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584196, "uuid": "77b0fbbd-c204-4763-a50f-d44daf1cf01f", "value": "SecuriteInfo.com.Win64.MalwareX-gen.84349145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b34bd764-c521-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1763540898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540898, "uuid": "397e33d5-ec28-4161-b6d2-22d06a3b5440", "comment": "Malware payload (Joker)", "value": "7f9044b5e30be8b2e7b7b835484d86e0", "object_relation": "md5", "Tag": [ { "name": "Bill fruad", "colour": "#F95B7A", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540898, "uuid": "4a3255e4-8f92-4bd6-a08a-fd46d213dc9e", "comment": "Malware payload (Joker)", "value": "1eb7e5a3d9b1ee78a78996e2b52e1d804d04b37a0c1273e9e0151e40b958bbff", "object_relation": "sha256", "Tag": [ { "name": "Bill fruad", "colour": "#F95B7A", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540898, "uuid": "94df8910-528e-4181-8e26-192878536618", "comment": "Malware payload (Joker)", "value": "e23cd58935a6a76ba6d43139fcda7a5ff758fcc5", "object_relation": "sha1", "Tag": [ { "name": "Bill fruad", "colour": "#F95B7A", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540898, "uuid": "32f4f901-50a5-4449-8b36-29498146e919", "comment": "Malware payload (Joker)", "value": "eb804abafc40aab1e1cd3291100a3d65a371d583e1fb560e7a9f603ac4f9377eab8f1156d1187b090f98d9833b547f02", "object_relation": "sha3-384", "Tag": [ { "name": "Bill fruad", "colour": "#F95B7A", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540898, "uuid": "4308c95c-e2d8-48d5-9cfa-9acbb37853ba", "value": "T180972316F70C253FDCB3F0BA8E5A226135166C96B901679BA811F34C6AF36D48F06BD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540898, "uuid": "2c430314-4f1b-4885-8d84-bbc63ed69c5d", "value": "786432:5LarXPMgSWv1BeUCUK7sjb1b7kNfNn06q4o3jFnDoM09Tp8:laIsrmLwlb7QaZHhnDv09Tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763540898, "uuid": "d04dd7ed-559b-4676-9551-bb5626df3887", "value": 42795344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763540898, "uuid": "aaefbfda-9167-434a-8b5c-29eee4906e3f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540898, "uuid": "9edf0c2b-db2d-4e82-9746-78ab2c72aee6", "value": "Smart+CleanJunk_3.7.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff180e42-c543-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763555628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555628, "uuid": "a50fec8c-82c8-4d6d-978a-69b24918896b", "comment": "Malware payload (Formbook)", "value": "fb57e23fec741e6bdbbf8f7c6a78689f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555628, "uuid": "194451bb-68cb-4cfc-896c-2f1eeed3ffeb", "comment": "Malware payload (Formbook)", "value": "1f3bdb38686a66cf238a07a79181c908179f654e886ee1b4531bfa8c18f52f6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555628, "uuid": "494e1f4c-6e3f-440e-9321-1a320623e78c", "comment": "Malware payload (Formbook)", "value": "f41bc1e8e2de3e6d44afe90925f3db6282ad140d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555628, "uuid": "7652704c-6341-4990-bd3d-f0a7ea567c1b", "comment": "Malware payload (Formbook)", "value": "930413d99daf22164cf5ff576983d9768eccd4697fea1ce3bbb9d473c1180dd8557115723534fe644a36008942286106", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555628, "uuid": "6297ee6f-c545-4c26-9688-ea84f39fc818", "value": "T172E422606C80CCA2F66473748076CFD91A7A7A32DE862F9D57A4E10DB87270358D6B7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555628, "uuid": "701a21de-a3e6-4569-babb-78744fa419ae", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555628, "uuid": "179ffc66-2910-4828-90e5-503318e08b00", "value": "12288:TOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiLo+X/dGoZfqY6DZYQROGU3/95:Tq5TfcdHj4fmbm/dnZft6VYQgj315", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763555628, "uuid": "4042eb01-7ac1-4d67-8d51-81fce6bf0e37", "value": 678912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763555628, "uuid": "09b0b586-62f2-4b9c-940e-22a5fe550145", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555628, "uuid": "a67fdcb3-1a73-4a30-9014-3b573d8fe51d", "value": "SOA2345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "210fb5f9-c4f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763522184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522184, "uuid": "1f0ba660-e6b7-46c2-84d6-bbab76db9152", "comment": "Malware payload (Mirai)", "value": "41a715cf41e5a4b01607135c7431bb7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522184, "uuid": "70326877-94ea-4120-b252-bcedacc84c05", "comment": "Malware payload (Mirai)", "value": "20440f49a05017347742591043ab7ba395a2745b4645db8e380899fcb64f90ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522184, "uuid": "6a8a5c44-664a-4066-bea4-1952a425cd79", "comment": "Malware payload (Mirai)", "value": "d2112c7d59bf95771cd4c405d96595621d4a8096", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522184, "uuid": "c733bf5e-7728-49bd-8c3b-ee3ca78f2a89", "comment": "Malware payload (Mirai)", "value": "67e3912193570c6400e780647def9338000bf8fd82b3e461d8e8af1932cc58d6468158265d8af7a0d00b3f95dec5e678", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522184, "uuid": "273e494e-c794-4402-af8f-4d5865668864", "value": "T10982C0B527E35A70D6709571D13484C9964B4E7DC2BE30B7EB008EB461CAA1DA7F88C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522184, "uuid": "434f04cf-a07e-4cb9-80b1-dcb505bb65af", "value": "384:D2e3uWb8CcYs/DlwldVUuiCWVR+JxTr63KzPKjk7nuPfPhymdGUop5hja9:9+FeUGTvTr63K+Wufs3Uoz1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763522184, "uuid": "b223dc39-b551-4ace-8275-913c1c96576e", "value": 17836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763522184, "uuid": "5b3967db-68a8-4e50-adb8-039501570b90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522184, "uuid": "cc423fee-3555-4cd6-bec1-cbbcc4a3d708", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "422e36b3-c54f-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763560465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560465, "uuid": "63486bfb-1f6e-42d9-9a74-9d2c4dc90179", "comment": "Malware payload (Formbook)", "value": "024bb0c2070749f6fb28f0bcb29a8fa0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560465, "uuid": "737ceecc-a17e-4753-857a-5eaec820d374", "comment": "Malware payload (Formbook)", "value": "2060796eec0b95c46fe699a5298c00f5700b763d4cb14bd7a074ef5f154a7586", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560465, "uuid": "0f78ed31-0962-42bf-bef5-86514820fd2c", "comment": "Malware payload (Formbook)", "value": "bb037ecaea22ea2f74db410e121dc4a88aacc60c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560465, "uuid": "5d8cf0ec-b0ba-417f-9809-aee5785ff8c4", "comment": "Malware payload (Formbook)", "value": "3733ec0c54c3693a36c88aec7ecf7742328495915fe5694b1fb94080671c75b16f1b283a401b2a94feb40a910a3e8586", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560465, "uuid": "8e9cf55a-30c5-4a50-8950-2704a3ecdb4c", "value": "T1D6E423F954C73963D29B972445FAF4B33E37AE37E26A8102A1601C24D491D3A3D88FE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560465, "uuid": "87015bee-0fc4-4bc8-bb3d-b654f290a8ca", "value": "12288:qY8Nx+3Y6yTxiTQk0N9UkN4FEis4fpcPyT9zC3TipwTXBvKqjrb:qhNkIHL74FEoGPi9G3TipwTXIurb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763560465, "uuid": "b3ca5043-8930-4a86-b71c-18a4e409dc1a", "value": 714976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763560465, "uuid": "f312f5ae-c6e4-461e-87f5-484eee574606", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560465, "uuid": "b01bde4a-e75c-4647-90da-cdd4c9502137", "value": "PO-0839380292.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4758ff53-c51e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763539428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539428, "uuid": "00ac0317-c2f4-40da-b87d-ea8f4fe23997", "comment": "Malware payload (Mirai)", "value": "abf39346963cbeb0413dd55a2aa43603", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539428, "uuid": "bbf3e982-e3cb-4b9d-a1f7-1280ba58a0bc", "comment": "Malware payload (Mirai)", "value": "20b7ea37225768937eb73ff9799dae45b1f6faf616295d5e51bdc68898286a3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539428, "uuid": "f03ac67f-ad33-45b3-8ea5-fef3812464ed", "comment": "Malware payload (Mirai)", "value": "69627e22038a96fcdc3c4e3315a369087ffc40da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539428, "uuid": "326e568b-14fd-4c79-a8ee-4df5ee4e5891", "comment": "Malware payload (Mirai)", "value": "911a5f71e71ce23402cd6fca2757ebe050fa8c4aba1c900a15cf0e47cea2e7c588844f3d6f4f09862f76ea14ed1c7554", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539428, "uuid": "027c16a0-afff-4cb4-9523-cb11d7f48c01", "value": "T1F4734D56BD41D612C6C125B7FB0E428D772743ACD3EA33039E226F6163CA95B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539428, "uuid": "41d3bb0f-4cf1-4d98-af95-38b27cd0620c", "value": "1536:Iu9/nUhu2PEKqjmk9edhOf5YOukWHhsOrex1em5N:Iu9fU428p6dhOfZXWBs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763539428, "uuid": "3feb69fc-a189-4d98-891b-640a9e70af6c", "value": 75780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763539428, "uuid": "52c59674-bb13-4e8b-adce-13f34bd63755", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539428, "uuid": "9b43c99b-505f-471d-ba22-cc2689f80fb8", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3996a240-c55f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763567322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763567322, "uuid": "3da2f820-c3d0-4aa1-8bb7-96b577eab5b5", "comment": "Malware payload", "value": "699aa3470220f76612a1b98424430e7e", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763567322, "uuid": "64adfaed-2112-44d0-8141-c6602fcd414e", "comment": "Malware payload", "value": "2171deb9293361fd801691948264ad8dc7864935140834449307d040a6d67787", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763567322, "uuid": "61ba120d-7b88-448f-b08c-ce3b15188351", "comment": "Malware payload", "value": "f34ec572b922b1e0e7385528c36ce291a76e5ca0", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763567322, "uuid": "377d5ba2-06e5-4d2f-b711-95c398926d75", "comment": "Malware payload", "value": "c9ea9c5e99b590e994fb22072f69f950d1d6a2b5fab2a2a25a3ddcf97d488371aa0bf3c482fc60fd77fdae41c8350f77", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763567322, "uuid": "c2904613-4609-4f52-8808-887ce604ac04", "value": "T147235C62F98376B03F5142799F91A4667F5BDC3B4E682B41F0866D1CA1346BCB0B24D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763567322, "uuid": "d344350c-a64b-4b39-bbd3-ceb4b32a2258", "value": "768:i991dHuydzUKO8EorVMuMN0NBF7SsA6cYtNGTiPax+dFVcglW:4jHuYUKV9x7aahW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763567322, "uuid": "c1ba7bf5-0a4e-43b0-8c3c-b21b00010900", "value": 48472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763567322, "uuid": "d7956e5d-fd08-44c2-ac5d-c04880a32cee", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763567322, "uuid": "4f85be9f-a866-423a-a0d6-a0935a04e08a", "value": "y", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d3e61d-c596-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763590943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590943, "uuid": "5f28fd76-16e5-4ad6-a615-b50513a54126", "comment": "Malware payload (Mirai)", "value": "c3456d16b24362bd65a529882972fab6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590943, "uuid": "13efc682-2d44-4a66-bdcb-b3068f0e4f08", "comment": "Malware payload (Mirai)", "value": "21c1acbb65861e123eb6a1bb6ca422794abfaa6ed9689cad5a8305fb2e262580", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590943, "uuid": "b85ae109-86af-41b4-99f3-20b5c164b1dd", "comment": "Malware payload (Mirai)", "value": "caab337b92981c34dea05ccd3b6acfe579e789ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590943, "uuid": "93026cdf-6930-4a4f-8015-6b193e4f1a2b", "comment": "Malware payload (Mirai)", "value": "f551c919912e07ae77adb09dab76aa5955fbc1b6facc79bd2fb693bdd5d71429012f4e81e7de19c61341c2ac4b8cbe0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590943, "uuid": "35daac9f-4653-4b6f-9915-02119d84810a", "value": "T106E32A01731C0947D1A36EF4363F27E093EFDA9120F4BA44255FAB8A9271E325586EDE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590943, "uuid": "7bc28dbb-1af5-4a7c-8c12-c0ed5402cd08", "value": "1536:0FhsIjfHCRXpISU7wYQ7szaxVkJXo98mF+nhstznUJsggTQvATAFeLmTSK7BMMqM:0FiwfHC5JU7Yszax+RKtoJuVTL1p2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763590943, "uuid": "b95e7fe2-c456-4f26-b704-bf3e58f8d31b", "value": 150432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763590943, "uuid": "d0c97808-20ef-4521-bb16-19c28eb809e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590943, "uuid": "8a3b8104-7dcd-4d78-ae2c-9fb941aa10ab", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b450663-c542-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763554896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763554896, "uuid": "77cdffd5-65a9-4511-ba51-734369cdbf24", "comment": "Malware payload", "value": "3d03e62388a294824182308f41484117", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763554896, "uuid": "b5039d24-fe06-41f7-9b7b-033a3e72aed6", "comment": "Malware payload", "value": "226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763554896, "uuid": "6d62e062-43b9-4b4e-b39e-da831015bad9", "comment": "Malware payload", "value": "4744723ae8bc850d49665e58fd985acf04007ce8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763554896, "uuid": "5f79f8d3-10e2-401c-a2fd-581fbe4a73ce", "comment": "Malware payload", "value": "5f3d73c4947c26b40056e0841d7adb0449265d1bd562a1970edecdefb56acde77904f5567550d334384ea07c1e50281c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763554896, "uuid": "d330cffb-7600-4212-a07e-a93701429358", "value": "T134A2560466F7844931F7BB24791EA084F2B9446330A9ED8ABE8C67A45F45438DEF4EF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763554896, "uuid": "0860c276-aacd-4e02-b22f-531ba6057c2f", "value": "384:6KHGAKHZx+gZzI1GyVHRjN8OkJqxwcWa1dp46kCu3i:5AZx+gZzeG6RjCJqxwcWanp46kCR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763554896, "uuid": "ff94e429-b931-4cf2-bb2f-e1d7e987c80f", "value": 23196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763554896, "uuid": "f3b30ab3-4c61-40c7-b729-f284e58d234e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763554896, "uuid": "4832e1e4-aedc-445a-92af-b2493fe2587a", "value": "226cbbf43d9bcedcc5ab69e51e5cce2f4ca841aa7ab39fdf974766203e2c9b66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77455810-c4f9-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763523617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763523617, "uuid": "a3760ec9-5e69-41b6-9049-d775848ed757", "comment": "Malware payload (Mirai)", "value": "07c00e2c340cda34eec2a036a92a1486", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763523617, "uuid": "27e43954-5a1b-4e90-b095-98326167d427", "comment": "Malware payload (Mirai)", "value": "22b688bd6fd917561fc369a5fcd26a2f4b66858d4404a2dda87691beecca2cfa", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763523617, "uuid": "d95be0d1-414b-4793-a679-4cfdfb2bcef7", "comment": "Malware payload (Mirai)", "value": "5ff43a5aafaf05eaaabb91d5d6a203a2183bbe16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763523617, "uuid": "a2a85100-81a7-4e49-a2d6-70dbb3ce0ca0", "comment": "Malware payload (Mirai)", "value": "06ad0ea76f2dc20651f55f28cef01abe8aa3e25ec300db67a17363c4d41e8e8ece937a5bbb245d0d1730c9261c10560c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763523617, "uuid": "b6138ab5-8add-40b4-9d48-12bb8ababb9f", "value": "T10DA3D606EF554EFBE86FCC3706E9070521CC661712A87B7A7A74D82CF64A14B0AD3D68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763523617, "uuid": "43b25289-9aa7-4053-8385-f1c3e3ed3870", "value": "1536:mUgUCOA5nb1k3cNSzHPmMIiixfhiHaYELbenWVjFDo5mB3z+7q1LW8cgx9hGgnMD:mUgUcb1ksQuvNxfE69pZgmJvceGgn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763523617, "uuid": "ad125a5a-82cd-4987-8cf7-db5e23072a14", "value": 102180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763523617, "uuid": "4337a0fb-5dd0-4772-837c-6d45446a20a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763523617, "uuid": "58a11ae0-9445-48ce-9c6c-0adabff0573a", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b05c80f-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589793, "uuid": "8e263254-4b2a-4ab3-806f-d36ae8188f76", "comment": "Malware payload (Mirai)", "value": "679f71b91e2e1b1097d87b6d7fdfc484", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589793, "uuid": "895734df-24a3-4043-99c3-51febee66bc1", "comment": "Malware payload (Mirai)", "value": "23403b7b5b0e8da7f32f78e91d700bbf0d58e3253c88bbc67b1af3e19c65aa55", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589793, "uuid": "8823e196-d173-4bdb-a514-c0387ff0c784", "comment": "Malware payload (Mirai)", "value": "24c57fe843a5b4e5ca2bdf39e905361297f77d75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589793, "uuid": "7e3502ba-9ab2-4f3b-8f85-cf849efd8915", "comment": "Malware payload (Mirai)", "value": "cdca27c4a387eee896a6d1375c495c0bba732c300efc9998943bca287e6803b1978de8411ae66e7b3463d31e9c0d21ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589793, "uuid": "a835f5cd-a4b5-4471-8a3f-fcb902f10c13", "value": "T1C4E3E71E7E215F3DFBA9C23447B78E26965933C637E1C585D1ACEA001E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589793, "uuid": "9885626c-86c0-4211-ac33-964f38ba4db0", "value": "3072:NkF+6uk9hckUGXZy9q/uleW0AJsPQDAFwLH6EDq0Rp6+P+po5C5DB15J3OdPU/ff:iF+6uk9hckUGXZy9q/uleW0AJsPQDJHk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589793, "uuid": "fc20cdfc-b8e4-462f-9dd5-d0f16b56d21d", "value": 144696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589793, "uuid": "6f378d55-ee80-4121-a651-d9a20967f240", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589793, "uuid": "70394b41-5db6-41b1-954c-8fbba2cc1613", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b5a287-c575-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763577067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577067, "uuid": "b252b7ca-14e2-46ad-be5b-2e4832e90d91", "comment": "Malware payload", "value": "27979fcd32b165f88b12ae6db672c75e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577067, "uuid": "70de1092-0b47-4667-ad7f-5ee10b5e67f1", "comment": "Malware payload", "value": "23a7f5d6ad2682874702220d5c0dda32d3a1ce8ad91b00bc53b99481e8403701", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577067, "uuid": "1091bff6-6bc9-4fb9-8c1a-1cc90d3f030c", "comment": "Malware payload", "value": "97145a4c77c7025486612f0b7e8eebbf6b5c41d1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577067, "uuid": "e47fc9a8-5686-4072-b68a-5ba3b3ad4bff", "comment": "Malware payload", "value": "bf6f92866eb326daaef415f2e0eaf789e5d87039a49ffbedfb18c4f9c87a48b8bcf1dd7fe29fd3e8cd8038ce7f81eeed", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577067, "uuid": "8d007f80-ddc7-481b-a0e1-916a22ffc0f6", "value": "T1AC660225B7CFC127D71D02B2E52DEA4E553EBE63076142D7B3E8789A58708C26739A03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577067, "uuid": "e7e44523-fe08-4886-a142-95684db3498e", "value": "196608:cmfjxGMeXdc26v40sECHdeu6BDNPte1Xn6f5p:cmNGNZq4jtdeu8e13G5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577067, "uuid": "45674d74-88be-45bf-8f06-8b907f648531", "value": 6959104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577067, "uuid": "c194d86a-eea8-40e0-8eb1-8992e3c9bb0c", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577067, "uuid": "0e036e06-311b-4823-9fe0-9d5a4539c364", "value": "regularizar__163736296.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51ee24a-c550-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763561168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763561168, "uuid": "2eb978e9-4268-4242-ad71-2d803775d376", "comment": "Malware payload", "value": "841b35a9d899dc240c73d139c9f7571d", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763561168, "uuid": "5fd4081f-0474-48cf-8f34-e67f3d23f37f", "comment": "Malware payload", "value": "23b249c408fd2cceba3d47965a8c71ca404457ae8c8651b433816d1c1f387818", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763561168, "uuid": "a541d26a-b75e-4e2e-ac4f-7379e0627810", "comment": "Malware payload", "value": "434d2ed1f3fff0a42e93ba088007b31065e03cde", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763561168, "uuid": "e074d49f-f66e-4b2e-a24f-e07cc4b41bcd", "comment": "Malware payload", "value": "65f59f4631542f0969a15b114a1fe0211affbe7f3a08b6642210790e9a83e3d711eeb8985f580e9ee9b9b6682738c63d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763561168, "uuid": "b800d10c-fded-4d27-8871-802b972aba5c", "value": "T15E06E0DBB788592BC8B3057284A963B156578C138F879F936C44361C2CBB6D82F4DBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763561168, "uuid": "c7a4cc0f-8d4b-4bf8-ac0d-69701fdf2a25", "value": "98304:LW2yIlnGaG7lBTkvk0rcwwgLCr+2JYbEAgNt1H5/rsa2ATPdil:LVyknGdHTkvUxWtKNL26C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763561168, "uuid": "e0701494-ac72-4f62-ad2f-3e1c5225c478", "value": 3665402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763561168, "uuid": "48a7633d-a7e4-4554-8014-54341d424929", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763561168, "uuid": "68f6f161-d53f-4f42-af52-4e55827b5a20", "value": "decrypted.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e0138d-c52b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763544893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544893, "uuid": "f781bc6a-cc8d-43d3-9c18-792d4632e49c", "comment": "Malware payload (Mirai)", "value": "529dac029da355e6e4df82f8c4386380", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544893, "uuid": "886f1be0-109e-4901-af46-41b8aeb828ef", "comment": "Malware payload (Mirai)", "value": "2692a4ecd625b6f2b96a1cda0252acd69b0100b567f94369a1eec32c0a910394", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544893, "uuid": "061ea39f-64dc-46db-b6a8-2841434b3f2c", "comment": "Malware payload (Mirai)", "value": "9407882c7d25bd00a978b0001d47f88f9968bbed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544893, "uuid": "fc02dcf8-3430-469f-89c8-a746664b1ff2", "comment": "Malware payload (Mirai)", "value": "1de17496d32ad452ea98e655f91ec953e6c7c6aca69e52007f3ff7943ff02ccaeb0df991a82c0909982b3c0149e35e70", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544893, "uuid": "d5eea59a-17b7-4af7-833e-828643d993cf", "value": "T118732A56BD41D613C6C16177FB1E428C7B2713ACE3EA32039E225F6567CA52B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544893, "uuid": "4159b528-7284-424d-b57a-44d47e1caaf1", "value": "768:96CKjwPP1S0F75ZfjXb2D4FCVcJBfSmwrS4+Jln+mhnkO2JLI3MwVnhbfqFikr5o:ACvXb6kR5QzbwNNC5cnYI+Mev+Eem5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763544893, "uuid": "33ab7de1-17d7-4442-beb7-984e152f509d", "value": 79084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763544893, "uuid": "465dee15-9a5a-4c48-9c29-ef1ca0d77f57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544893, "uuid": "10e7a41e-c090-49dd-a914-385d52cce7f1", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877cadb2-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594941, "uuid": "ca3a2ea0-1d73-46d0-a583-faa3b86288df", "comment": "Malware payload (Mirai)", "value": "f4df3073fe4a07b391b62fc0664726d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594941, "uuid": "38d9ebe9-0ff4-4c71-ba28-5d76bdbb4cd8", "comment": "Malware payload (Mirai)", "value": "26ef54b6267318f00be5195603d58a8004499070a3650c1caa20b4333c931d5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594941, "uuid": "d296b5c9-0e9f-4e97-997a-1d8ac1565c2e", "comment": "Malware payload (Mirai)", "value": "616e57813f771c7136494745b77323d12688459b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594941, "uuid": "468ff87f-8521-4dff-9788-c1946a0cf14f", "comment": "Malware payload (Mirai)", "value": "296ee6b37297821b472b18eb85cf0f86e033e038fdd49eea630e8cb90c7b4eb93b2dd5c8da0455fe3811a6c11195e83d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594941, "uuid": "8aefafbd-e40c-48d2-a18f-d4f54808691f", "value": "T15EB3494273180F57C1970AB02E3F27F687BFE5D121E4BA89650E9B5A8275E37144AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594941, "uuid": "0cebfc8f-c86b-40d9-9317-c602a95ef095", "value": "1536:i/N9BctA++5YPMJpDXepfyFnUttbKBIdYo55KDF9D+JuM9+4631Mck:i/N9BcurqfpuQbJW9WuEdck", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594941, "uuid": "b39281de-dac6-4381-a3ca-b0365ccba10e", "value": 112204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594941, "uuid": "db50a2dd-9ce8-4ff9-971f-85c9e317e436", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594941, "uuid": "cdcb3c23-0db6-4760-9721-58387f794b42", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62880248-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589725, "uuid": "fcbce1f5-c2ee-4b83-8a28-f2f00bda86ad", "comment": "Malware payload (Mirai)", "value": "630333942b760e90641f8c7c9ed52909", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589725, "uuid": "da2461df-1101-4208-b5da-6335a4a62cf4", "comment": "Malware payload (Mirai)", "value": "27c926168497fc949b918637fab95fbae3a28b88c0d73a253e7269ccef083966", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589725, "uuid": "4adf406b-d83c-4dc2-b88e-5dff8cc6443d", "comment": "Malware payload (Mirai)", "value": "957ec70d5146b8f8c4616c19aafec8975d82d395", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589725, "uuid": "12cfff91-4db6-4a29-9790-6dd47776d73a", "comment": "Malware payload (Mirai)", "value": "2b9d63ff39062b38566c35fcef0096e879749e1e3abc62dbb408f8217a5039bc10598fc4e3d4eea14c786056e0e96fd7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589725, "uuid": "9d3ecb50-bf78-44ba-92fb-ff13dae681a4", "value": "T17523F157764FBE2CD81F64BAA55DE6D66A6DB83AC04B16BF84C0903CC433C618515EB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589725, "uuid": "f8885edc-3385-46aa-81e6-38f88fd69c4f", "value": "768:LX8NaZWjWApQhQaiz2FsyzYm8CDGhpsxTQPlyxXQK2E9VFNFUYffHlx05O:T2jxpMQa5SWX8CDGoxEPltK2AVbFv1AO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589725, "uuid": "5af4444e-280b-459a-879f-94e093cfefde", "value": 47596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589725, "uuid": "84b82f8c-0530-4a32-bd26-be88ce0820b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589725, "uuid": "7759a68a-f003-4cb4-8bf8-a456a4659f87", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dfc971-c558-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1763564598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564598, "uuid": "93310414-536e-425b-93c6-e4213e3432f9", "comment": "Malware payload (OffLoader)", "value": "5f076e8739fa7ec1f1a02b2c142fdda1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564598, "uuid": "ad28b0ca-46b0-483e-b614-ce54035604b4", "comment": "Malware payload (OffLoader)", "value": "2924adfa3404f67021c941a6a04bd293779010d5ac55ac60660d8ce5bdf888fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564598, "uuid": "052324d5-8c1d-4287-a43e-d366173689e9", "comment": "Malware payload (OffLoader)", "value": "b96abd70ced095f9ca06432c60512a22560f1dd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564598, "uuid": "b4d653b4-37cf-4c48-8f50-0a988ba4a35c", "comment": "Malware payload (OffLoader)", "value": "22e9f3c1d00a1e305b22a44ca776f03913a2b369b61fd35d0c3c278a7eba3f53c0e65aab1f6b012d395ce333144c78bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564598, "uuid": "25459adc-47d6-4783-a740-f60b81d51582", "value": "T12A95CF33F28AA33EE06A5A3759F292505D3B7A21641E8C5296EC3C4CCF791601E7F647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564598, "uuid": "efc9a351-df2c-4075-9a54-b0003b9e7efc", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564598, "uuid": "37606303-ace9-4745-a1ad-73047496baa0", "value": "24576:cX6N6JCGN33/T15ZWi7Knszb6f+UqWU/Wr0VUw9jzy3+nILajv12fJO6xxvZSABQ:/N61T1mptqWUWr0VZ9vFnIL4kOSxhpVI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763564598, "uuid": "f64ac9ef-d103-4a63-bdaa-06e3bc2c9394", "value": 2048936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763564598, "uuid": "085c4215-ca7a-4db0-be10-ff0ff1ebdbbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564598, "uuid": "3e46fe8c-4ba6-418d-b8a5-350f9f0eb84e", "value": "Wondershare Filmora 14 5 18 12900 rar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a32c0d-c4da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763510491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763510491, "uuid": "2525421e-972b-4e10-af15-1197f4efb8fe", "comment": "Malware payload (Mirai)", "value": "36fbb3971f26ed8c3a9811b5291cff33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763510491, "uuid": "2570f531-5cae-4c47-b0c8-02664a0b0abb", "comment": "Malware payload (Mirai)", "value": "29c01bbf6374b21fb88ea11d0f74f8685e52a62340ee7281eb9cabebaffe605f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763510491, "uuid": "ece53e2e-39ad-4dcd-a544-743391734d1e", "comment": "Malware payload (Mirai)", "value": "3f608129b6131084bea02f1740f84c8a325589ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763510491, "uuid": "e8379ae0-2cd7-4937-9f7b-7db55b7aba28", "comment": "Malware payload (Mirai)", "value": "e94441643ff2f34642948cd868f3a9a6c2f2cfe947648566754b7646173cd62a665dec927b03c2771ecc3afe6c9dde98", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763510491, "uuid": "6f64582e-0400-4419-b457-e3ea44efa91b", "value": "T11153015CDC40ADE4F71F3C746D36D2E237A01B469B029B40279AAB05AA1163B6486FFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763510491, "uuid": "76127335-7958-43f2-bc3c-505c20ff3610", "value": "1536:TZQTxkIgncXkp5akbT2FTAWl48tw//tFbaVtQk4u+qgw09k:VMxkIycUTakWFsWTtw3vbctQk4u+qgwB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763510491, "uuid": "21121909-792b-4b3e-868b-d3f4f2de4256", "value": 65656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763510491, "uuid": "234b8c01-7304-404a-963e-ef04aa511481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763510491, "uuid": "9f6516b1-4b5a-40d2-b84c-6093b5b5f2e2", "value": "Polar.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "140015b3-c51e-11f0-a129-42010a9c0007", "comment": "Malware payload (a310Logger)", "timestamp": 1763539342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539342, "uuid": "55e07ea6-a7d3-42a1-bcf5-8599192774ea", "comment": "Malware payload (a310Logger)", "value": "ac2467c6bfe7f802740b22e6cf1347ec", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539342, "uuid": "24cb3c6f-c76c-44e6-af0a-1bfaec138ebe", "comment": "Malware payload (a310Logger)", "value": "29c3739f9146d3946bf66be3b7d5afcbd906b2dc87d26df11014d47acecf35c8", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539342, "uuid": "28df66c4-b233-484a-b5b0-ae86c84233fc", "comment": "Malware payload (a310Logger)", "value": "ace662ef9d3d78d41aa804a533cfbb124263ff50", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539342, "uuid": "28c8027a-f1ad-43f8-8c68-a7f0dbc351c0", "comment": "Malware payload (a310Logger)", "value": "350db687e578421af3498a83e2057c6a47bbacd2cf7b65bf8571c3d412760e04b994279abc96e8422f763082235c0d32", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539342, "uuid": "5a637353-e52d-4941-9e29-de9ac6740f06", "value": "T1B345D01363DD8361C7B25273BA26B741AEBF7C2506A1F86B2FD4093DE960122521E773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539342, "uuid": "b065744b-96ba-4bc5-89c3-96293ef02ef3", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539342, "uuid": "1ece879a-eff6-4bef-b6a9-fbb4ab82ee32", "value": "24576:Ztb20pkaCqT5TBWgNQ7asE5CPq2YbzLiXs/9qTP4sB6A:qVg5tQ7asTa1/s4M5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763539342, "uuid": "7aea0d21-9e18-4658-80ae-84749d995d92", "value": 1258496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763539342, "uuid": "81e85973-9b43-4d73-8f1e-77701343688c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539342, "uuid": "4d49ecbb-b64c-4d40-afe6-1b45d5667880", "value": "gggg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e99bf703-c4e0-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763513071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763513071, "uuid": "38a0031a-af61-4751-ba9d-236cdd53bdf7", "comment": "Malware payload", "value": "4eba2e142789da90910a31f58753746d", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763513071, "uuid": "e752c308-4446-45f3-a578-6fdec0b61d49", "comment": "Malware payload", "value": "29edd1249136cb194f3947b5129c79d1725d2c4b670eb49bee8755ea37e6c813", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763513071, "uuid": "dd973b62-7681-4383-9455-952049ae60a0", "comment": "Malware payload", "value": "7bac66043744abe189d8beb64f1e5f7030312594", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763513071, "uuid": "e8b72ebf-06b0-4200-8f6d-14dd145c3d37", "comment": "Malware payload", "value": "d021bd9004c636fd792ec9ed892a29bbdf68e196bd6c3231d2c1b0c433a9b6449dbb86435d1b34fa959a02ee9ad179f2", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763513071, "uuid": "cab8c6bb-593a-4522-9298-1b9fd1bd7d88", "value": "T1A4816242A7EC8A2AF17747396EB347112776FD135EB6536D2698021A7E21A100CA3FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763513071, "uuid": "135ed6d4-f3e0-4a4f-a5f0-c936cbb32e53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763513071, "uuid": "6deaee22-b03d-4db0-957f-88942cc64aeb", "value": "48:64Yol4wHFlqKAJ78KPIk+DRFoOul5hSbqnvpfbNtm:J4wHnREbwCBzNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763513071, "uuid": "9bb761a3-a2cf-4ac5-b8c3-7fc3997f7a27", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763513071, "uuid": "b252bf31-f79c-4ff7-bdbc-0f7854e427d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763513071, "uuid": "b9a2ce49-45f8-4bf9-a1e2-525ee339293a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067176bc-c562-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763568525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568525, "uuid": "067db1b0-c3b0-4fa2-8c16-46be43fe95fa", "comment": "Malware payload (Vidar)", "value": "308a0d04da7a149c1ffa45c295decdb7", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568525, "uuid": "d562c1cb-5ce3-4518-8461-29f778e4cc8a", "comment": "Malware payload (Vidar)", "value": "2b0ad428d233a5a100dfa9464088ab08b090cbbee4a99ffeb27fde2ae80d2657", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568525, "uuid": "fcc1c41a-34bd-4fd2-a2df-0327c7139301", "comment": "Malware payload (Vidar)", "value": "3db4b2cac6205a265dc8ca82a63c39474f5f9301", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568525, "uuid": "9c609d49-20fc-470f-9070-881256c7230b", "comment": "Malware payload (Vidar)", "value": "f82573937007ffbaa372ae3907acd9e5d8610ad06ae866142d7761ec074102bce125932296c968e7378e33dd2e943847", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568525, "uuid": "3f13878c-9e41-49c5-a242-16e1913894bb", "value": "T1B1051257B3B120F5D1678235D8A62613EB7278221B615EEF03E04777AE236D09D3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568525, "uuid": "68943970-3b0a-4499-929b-46e86e55b546", "value": "f1a6a29381d34d1d69615d960835021d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568525, "uuid": "dc3bb494-a064-410c-bc74-d706a2c430cb", "value": "12288:rD2AAFjN7uWRz7SKcod4rm0SXSmTz2GnC7/V2ngDhveuz4DMjqSbHIXArz91E8dL:r63K7ov3P/RnOwn2xFz4gjqoIXArJP37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763568525, "uuid": "95878a8f-7bb7-4e3f-ad6a-7f27f6ffe3ec", "value": 840292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763568525, "uuid": "3a25c527-7157-4f20-bcac-6c1081d69e72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568525, "uuid": "5d2ac580-e2bd-432c-8869-93e84ec54c27", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7435f6a-c565-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763570110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570110, "uuid": "f556c970-d695-4cab-a9f4-12497087c205", "comment": "Malware payload (ValleyRAT)", "value": "7d43f9fb43381fc2e4cdea159cb5ed91", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570110, "uuid": "a0c144a4-5e9c-4573-9f46-d4dbc227e8b5", "comment": "Malware payload (ValleyRAT)", "value": "2bf34084c3f30c08e816e8e28033f3d59d62dfdbc586673f177396d379dce8d2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570110, "uuid": "71ad8fbc-f52b-4c69-9f20-00beb0f90c65", "comment": "Malware payload (ValleyRAT)", "value": "c541200b59689138cf553b37ea1cc9eaec4ea6d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570110, "uuid": "5187e93c-1480-4c72-9155-c98d5559ff35", "comment": "Malware payload (ValleyRAT)", "value": "baa35347c14229c97d363515fa74515c7a70983786380f0a63d1a27bb2681414a102d3d700a9ce628fb07ffaf3369603", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570110, "uuid": "e3ff43e6-2a9c-4b5a-a233-23d48d96a2a7", "value": "T1F8B38B10B5C1C071D4BE193E4534EA661B6E7970DE619E9F63A803BA1FB81C0EE39D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570110, "uuid": "9ecfe20e-43bc-4b36-9579-e19f0ac6485d", "value": "3737cfbfd92e8dd910c1a7d9839c8e78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570110, "uuid": "237e7e20-2110-45cf-bd3a-3153437ef76c", "value": "1536:QHNGvNmssQz2PwfCmAAMd40qquesuYCnqdEswhljdFysWIlcd7yWhfhxYrfL:ZPy4fC7K0qquesuY8hlhw+wfhxYrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763570110, "uuid": "9c59ef37-11ed-4597-8c55-3aa374aa47bf", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763570110, "uuid": "78835ee2-6473-4579-9add-b04e2fcbeaa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570110, "uuid": "67022415-bc80-498b-a88c-b30a6aa07d83", "value": "2bf34084c3f30c08e816e8e28033f3d59d62dfdbc5866.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683ac2db-c590-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763588446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588446, "uuid": "adaa2e92-a044-4ad3-853f-96f3e53db50c", "comment": "Malware payload (Mirai)", "value": "c0e52e7262346c17fb3e64ab60102786", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588446, "uuid": "b01ebd93-b025-4d07-b19a-50f266a0dcaf", "comment": "Malware payload (Mirai)", "value": "2ca97ed41883824ac4fd24cff8e4d17f491292f8ba08d72d8db6b8bb1b54129c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588446, "uuid": "6c245aa9-bddf-49a5-a1f4-05ce29394f0f", "comment": "Malware payload (Mirai)", "value": "08626b048dc92003e04f97fe1af54addf17e6bcc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588446, "uuid": "b37002af-21d6-49f9-9b67-c41a711d6e90", "comment": "Malware payload (Mirai)", "value": "fa4a1b335e05b9b02f87bc104e9bdd2579ccca430d7d0582298f3b4e535ba23596b9bfe42752485b67b0312ccf8c2cda", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588446, "uuid": "cddb6aec-bc8e-467a-a2cb-aab0c79729b3", "value": "T1A033F1B8F2F2999AC8B50931B97A079B766F763BC9BC743287499A30204204757FD4C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588446, "uuid": "781b1b5a-0498-4d2e-b574-7aeca4daf6e2", "value": "1536:c7UxbU1fUmKaTuKV4GelFLhLMP3avFqMI8Aab:cIxU8OXV4DlFhL03aIMyab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763588446, "uuid": "512f3891-f4f5-438c-886a-777f3bd07ac9", "value": 50280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763588446, "uuid": "3ba5e474-4111-4c3c-8034-ff19d8a265c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588446, "uuid": "d7ee4aa8-35fe-48de-b6c1-186b14296149", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42233ca2-c55e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763566907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566907, "uuid": "3250d63f-6d75-4c43-b88c-d91bbc6abc32", "comment": "Malware payload (Mirai)", "value": "67f4953eef6241014d5c233d199c3bd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566907, "uuid": "1449c40c-93b7-43eb-a85e-b168a250732f", "comment": "Malware payload (Mirai)", "value": "2d14906d901e963f16b626db7da91df4bb3a7b42004e092d488b402c5639b0bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566907, "uuid": "45f39a3d-1676-4efe-a433-ae38e3202c73", "comment": "Malware payload (Mirai)", "value": "8bbdaefd41425cf530dcec42c2e6a64b8b9faa6e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566907, "uuid": "7e896b30-885c-4c05-b0a5-0fb40ce9734e", "comment": "Malware payload (Mirai)", "value": "713311042bc31a1ecebca02c5f8f421bf289b03edbc1eb14bd8681dab58ff82fe1c831056f73c88ca2ad599219c77bc0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566907, "uuid": "56784493-6ac5-41cf-bbd4-64420451624a", "value": "T16EA3D60ABF610FF7D86FDC3B06A91B0524CC960722A83B757974D918F65B24F1AE3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566907, "uuid": "46dc2023-fb63-4d30-a273-9c2517d9977d", "value": "1536:UMQACf3UdVrI1Dgy5RtgnMU5BY65nvk3142X7/MJLl4sord3eowJbVBug7Rgd:UM183UdVsgy8MMVPJLqtrx0pBugu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763566907, "uuid": "435fe11c-3b4e-4e11-840f-c613ab07e63a", "value": 105252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763566907, "uuid": "e382c7bb-7034-4464-9fe0-d06ea4de4a7f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566907, "uuid": "4886cce8-dcca-4c55-95b9-3a27e7d7a679", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46f8f03-c590-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763588547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588547, "uuid": "136f9f37-794e-4082-9e79-09b7114da2a9", "comment": "Malware payload", "value": "b00c65442e501656fc175c100d7add7d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588547, "uuid": "740d9854-e4f1-4764-bc89-40974fc6527f", "comment": "Malware payload", "value": "2d87241730f4bf1a6c4b6746ce2dcad3448e89e85d2eb54d5e86cb263d609a45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588547, "uuid": "b51542a4-fe20-46af-a72f-d2ad53b050a0", "comment": "Malware payload", "value": "e684eef40f0f1a65b411e960956daee033513d21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588547, "uuid": "025106fb-bc49-486f-9b51-f07864366446", "comment": "Malware payload", "value": "eb3d278838ccc7b9935980af25562d99f6e963ec1b93bb084a897ddbf10165f99a440e3812852c4b768eab0b3bbf9a0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588547, "uuid": "117e7129-b468-4068-ae36-b5d4eb1273c2", "value": "T1F2D47D3AA490D547FA18C4B805E2972EE831743586726AFF05609263D95BAF08FC53FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588547, "uuid": "967548e5-698d-4510-a5de-76091865bff4", "value": "79ddefae792645665e0f0b9eb9ec1da8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588547, "uuid": "2395d45d-a8ed-4f72-b3ac-509de6f68ed3", "value": "12288:tqDVdQPocqbvTzBVj69RvNxwDRsEzdG1uSQuOZea:mfQZmv5x6vlxwDrtSGZea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763588547, "uuid": "6f235ce3-e571-4a5a-9367-e0d009a672a3", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763588547, "uuid": "b8c97ccb-d276-45dc-b3a4-cc53ff71e2fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588547, "uuid": "8e9c48c0-62bc-4732-bf7e-0972f2386c51", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4276fe02-c514-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763535125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535125, "uuid": "22f6e35e-a9f4-4f2e-b1de-30fda29e08ac", "comment": "Malware payload (Mirai)", "value": "7273ddd688e1ca7648367cf2c5a96181", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535125, "uuid": "d6118ced-a3d3-4435-9c12-fbecf83c2cda", "comment": "Malware payload (Mirai)", "value": "2df9be6fc4435c9556b84ce6004f2b1feae85ac25c1bdcfd5705b9cbcb471204", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535125, "uuid": "cf65eaf6-8e2e-4527-8a33-dd1e748fa074", "comment": "Malware payload (Mirai)", "value": "f3c71d7deab5d7ccdc51492c08c2d2206f18cd57", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535125, "uuid": "b64edd35-2daa-4b5f-bb9f-31d389ce0fb2", "comment": "Malware payload (Mirai)", "value": "09094af556be82c7e396992599f9770b65fa19e2cd93b14b9b98f4c4d130ccf74130454de9c036b3092eb8b4321c9758", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535125, "uuid": "00ba59a7-aafa-4f04-bf69-256551a411db", "value": "T1EBB35BB3CC26AF98C655D074B0B18FB92F53A59482471FBE19B6C2B44443D8DFA05BB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535125, "uuid": "c8a1a2e9-c33c-4a68-a35e-992133c6d532", "value": "1536:OTW/VCxsHZusQ2Li62C87mKjR5fvPVWARouW8j3W+gJH7E:OytCxsQx62NVjzVWxuWM3byo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535125, "uuid": "8a9f352c-1da0-46e2-a90e-cb992ca8a636", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535125, "uuid": "f7aed32f-f1d1-40b1-8a54-e9d9e7c50dae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535125, "uuid": "c9ec176a-c716-438f-9228-42b0101cf101", "value": "main_sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a56bd96-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589765, "uuid": "bbc0c5ae-ef80-4c06-9356-227130ca5989", "comment": "Malware payload (Mirai)", "value": "966618cc928446e0b56ec0b145c4814e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589765, "uuid": "bfe4cba4-1171-4aa2-8546-2ad7bb61f0ab", "comment": "Malware payload (Mirai)", "value": "2dfdc6ae4394af10fa081bb8128c3f3e0c5c5a010c6227d9225fffdbeb2dc5bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589765, "uuid": "8bc3742a-3698-40de-8bf6-73a0fc1ba3a8", "comment": "Malware payload (Mirai)", "value": "04a54b30b757489f8bd114975d997d0bace62164", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589765, "uuid": "2700ef22-9ac8-40f0-9192-8b38571f0b9d", "comment": "Malware payload (Mirai)", "value": "a06c0bce185790656808c7871fdfe318d72790b424985e9dcca7d1cd0f47e7cd08d575ea57138a80fd688d64e4712be8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589765, "uuid": "7869d69d-6b91-4956-84db-3ab54b53e11a", "value": "T141C33A81F8C28A62D6D723BAFA6E128E332263E4D3DE7103DE256F11378651F0D67951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589765, "uuid": "584b288a-4b5c-42f9-a4ff-061e56e64f9f", "value": "1536:SwWsAH3EkMW29wxhAH1BflYHfrew/tAtj6KsPyk6klpqb0JX6s0+N98vo1:/W/3ED9/q/tnyglp/J6jo1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589765, "uuid": "ddee0076-fb1a-4565-9270-bfde3d8cd48a", "value": 120300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589765, "uuid": "db4fe6f3-696f-4947-8006-cc9aeacd4c69", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589765, "uuid": "6dcad293-a854-40fa-8ebf-e19d5804e02d", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf8b55bf-c4ed-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763518584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763518584, "uuid": "443c56b7-0be9-4fe3-95b9-756df57db60a", "comment": "Malware payload", "value": "c1f1716695896ff4f8ca1c77e7d0611a", "object_relation": "md5", "Tag": [ { "name": "base32-encoded", "colour": "#482626", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "telegram-c2", "colour": "#4D7F84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763518584, "uuid": "d2637777-2407-453a-b6db-68c5c795de69", "comment": "Malware payload", "value": "2e07ea7ae3cc12bb8f02eaba7f382b94e00869d6be6740c73d578a45eed52600", "object_relation": "sha256", "Tag": [ { "name": "base32-encoded", "colour": "#482626", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "telegram-c2", "colour": "#4D7F84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763518584, "uuid": "3ca8486a-4276-4423-9a8a-a35636d993ad", "comment": "Malware payload", "value": "883cc7861996177e5da41484ca8ca86bcf9b18b5", "object_relation": "sha1", "Tag": [ { "name": "base32-encoded", "colour": "#482626", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "telegram-c2", "colour": "#4D7F84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763518584, "uuid": "6f2f4bec-c3d2-4f44-bc46-be3afdfd80e3", "comment": "Malware payload", "value": "7ae96255ae892a504aeff7cce24759885964241c0596f0f5751b24675d4fda7f512ffd4603a752f0a07f1842e0e57cad", "object_relation": "sha3-384", "Tag": [ { "name": "base32-encoded", "colour": "#482626", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "telegram-c2", "colour": "#4D7F84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763518584, "uuid": "2d5d30a0-85f5-4d8e-ab1f-629b2e8ed812", "value": "T168176C93C481E3BDB39A56DF3D6BCD4D03A46594ACC3A8C9D3F05C7A17BEA803219562", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763518584, "uuid": "52cddc14-d637-44f2-b8a1-bcf0b96fe6a0", "value": "49152:yR1QbBtqsRHMqpJWtfGIgyc0d/ByVh9KaSAVM1JSExbKJGbO+n32SsoDTQYwkDUJ:l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763518584, "uuid": "25e86e25-b60c-44dd-a2e1-1ea60d0dca34", "value": 19578340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763518584, "uuid": "dacf0ec3-1f34-4a91-aad3-25d85d94349e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763518584, "uuid": "94833052-a142-4f23-9770-b64fb7a290f0", "value": "stage2_obfuscated.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccf4ec4-c514-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763535115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535115, "uuid": "a59c0d5e-3b1e-4063-973f-88443ec07f38", "comment": "Malware payload (Mirai)", "value": "180a806c5b793c930c4916eaff8fb6b9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535115, "uuid": "72397d8f-f7c9-4eb9-b052-343aade8a3f4", "comment": "Malware payload (Mirai)", "value": "2ef173f92cc9cfda0788d1086e368c924847512f4327d849744aa73ef51d81e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535115, "uuid": "09b7556f-9496-46f5-97b4-92bcea94998a", "comment": "Malware payload (Mirai)", "value": "4fe6f1b1ddb25227bb48fa1f7c35e8f56226c5fa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535115, "uuid": "0ee6631f-55a4-4ba4-a2a9-b216664f611c", "comment": "Malware payload (Mirai)", "value": "77e10990197135764b26e620418b840519d100d08869be3fb3b7617c5fc8a66d4db73d0f6b21fcec248ad4f1bda6f17e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535115, "uuid": "3cb73068-396b-4cf6-a162-30d673c1e482", "value": "T1CF23F1B4064588C9DC0191B957EE13B03F758BC190838EEB9D7671CACEA19BCB4CB8C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535115, "uuid": "eb877baa-11a2-4983-b6c8-3e0106babf57", "value": "768:J58sJK5Ks8w0LyPxWk6HS1YKTe994YLPU3GVIcbau+q+Xx2NWezTDnMv37dQSSVR:bdJi892P4H+YKTE94GPbqcGu+q+Xx2Qi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535115, "uuid": "9a99f79e-f314-44e5-89ac-515176902bd6", "value": 48024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535115, "uuid": "b7416db3-497a-48fc-a808-1cb5d4f4666e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535115, "uuid": "880bfafb-20d3-4794-a744-710a4574e2cd", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d547a587-c590-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763588629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588629, "uuid": "b2044941-53a8-4660-bfaa-6ded87b9b984", "comment": "Malware payload (Mirai)", "value": "891c91081a70bb12fe804ce75d6120ab", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588629, "uuid": "b0f0406f-f900-4932-adb0-29f431b820cd", "comment": "Malware payload (Mirai)", "value": "2f19a4a0cad80eb8ca051f5e3957d346573171e950b87a45f9de9ecde180053c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588629, "uuid": "deacc055-f262-417d-8d4a-c012d611cdc9", "comment": "Malware payload (Mirai)", "value": "b773d484473f5da0bc74bd561b4073cf9c7d8f21", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588629, "uuid": "fad0eeba-97dd-40a3-8be7-522af08ce33b", "comment": "Malware payload (Mirai)", "value": "71a9f785e5dc96a22ed5b36fc59f237ef7837e473b3228a8337483530e1d6d59ccc552c70fd929d2a3c74082ee54703a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588629, "uuid": "9689ba0c-03f2-4da8-bb2c-5107e1e1e28c", "value": "T18DF34BD7FD01DEBEF40ED73B84530909B230B7A254525B3762537A2BAD3A1990873E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588629, "uuid": "c63003ed-3bc9-4a0a-ba18-ac981e7884a9", "value": "3072:IBISNAi/imkVf7oOB4846Hay4tIKOXnAudrusTaq7V9jbiILHkkhS:J2imkVf7oU6y4mKcnAngaqrLHZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763588629, "uuid": "1eb06ad3-d7f2-4fcc-9394-31852fa9e09c", "value": 172428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763588629, "uuid": "b923e386-f0f8-4965-86c4-3b80f1070af8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588629, "uuid": "6a214538-9284-4ebc-a37c-5bb8668e6e83", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "472f19bb-c5a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763595262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763595262, "uuid": "09ed2990-fdd4-4729-8ce6-638091686169", "comment": "Malware payload (Mirai)", "value": "4ff29c5dcba547be42e264374b9cd228", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763595262, "uuid": "a30784c6-f167-48cb-bab0-df2e3a3da59d", "comment": "Malware payload (Mirai)", "value": "2f70f64e5905229b145c7868260995a83d686ca7877789d578b4c3ccacdaf5ed", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763595262, "uuid": "6532cf42-5ff3-460c-84c5-f0154c680e98", "comment": "Malware payload (Mirai)", "value": "c64243fc08d7398d80e6b9d2e2fb5c6f54c781ed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763595262, "uuid": "ed5c7bf9-8915-465c-9d79-25dcebaa750c", "comment": "Malware payload (Mirai)", "value": "f5fbef3e11db78b128616ba600ac6f616e4023b66bff5e1834bc16e723215383e834c448d19e21d38ffdbd859fc9ae24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763595262, "uuid": "fde7662b-9c22-43b0-b441-edc79a3a09f7", "value": "T1DB5302B7C436DE87563EA0F3D47AC849E4FD32A04365598E012559ACB789083A7E6F83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763595262, "uuid": "c7fd4f54-7b7e-4eb4-94d9-a10ef42c3aa6", "value": "1536:tNmFkS3VgfgYw3gNpKmRDJdBJVSDGzxpNq+AhrkrHWwpWSK:nq3mvrEipqD8WaWSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763595262, "uuid": "97fba8f1-1ea3-4cae-b07f-a943cb21afdd", "value": 60980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763595262, "uuid": "805995a9-8b97-4813-8b16-5d5c177ca72f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763595262, "uuid": "245b0976-9b21-4fcf-bacc-cbf75b3bac72", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77990016-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594914, "uuid": "cf057260-8ed8-4b5a-bad6-75e33e973f1c", "comment": "Malware payload (Mirai)", "value": "ab8e323fad7dd589169c2298071d6faf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594914, "uuid": "35734d76-27b4-43aa-8079-3144ca85b251", "comment": "Malware payload (Mirai)", "value": "2f83965401ad24da0f1652adeeb67d7a282f02c6a1005cb69b0786697dbd95b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594914, "uuid": "2cc71f5f-f1ff-4585-9efe-256377dbd753", "comment": "Malware payload (Mirai)", "value": "f7c5ca400c1287404b78317bd6e70bf34128466d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594914, "uuid": "522f1413-42ea-4409-acce-6dcc64b4a7fb", "comment": "Malware payload (Mirai)", "value": "bbbf57b14ea7461d6546fd57f17b7618834ebb07fc4ddb85c939024d072a28ed8d6bdcff57c7a68b76254c69a719188d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594914, "uuid": "125c1dbc-b6f5-4c96-b1f8-c80ee3cc7ab1", "value": "T163C31946F9828A22C5D713BEF92E118E331357B8E3DE72129E105F2573C662B0DBB945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594914, "uuid": "590f0b44-cf77-42d3-b0ee-13e9af055a81", "value": "3072:vggcXParsxoSpsp7TCamqZT1cRySRlrF9sRE:vggcXirsxpCp7GamSMySRf9sRE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594914, "uuid": "c12cf794-068b-43b1-97e5-fe3fb1a7c55b", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594914, "uuid": "a65af3dd-ecc0-46da-8792-0bcc28770e68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594914, "uuid": "92c7796d-6bf5-47d9-85dc-5000d6c9939e", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7409400e-c598-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763591902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591902, "uuid": "23b0d8bb-3356-454c-8288-8e018e591a19", "comment": "Malware payload (Mirai)", "value": "be43c8d993fb0558723ae0d3a2e8e7f7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591902, "uuid": "f295b552-342f-4f8d-afaa-fa39becde668", "comment": "Malware payload (Mirai)", "value": "2ff396138f8ca91a99089e4fe36ed5ef28f1f9d5ee2a5cb7e76a87a5e8b0bb5e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591902, "uuid": "a24eeb34-c991-4f84-9c18-c570db55f867", "comment": "Malware payload (Mirai)", "value": "e69280b8ded7c9557f11e066aceeaedb31514b51", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591902, "uuid": "9f30b7c6-abbd-4210-8855-50000588c45d", "comment": "Malware payload (Mirai)", "value": "9268358290a1680f72bf7dd0cb748eb7463bb351aa0886a9c60afcbf30c396787057fa8e42c56f81977baf3770cbed1e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591902, "uuid": "6684ee59-2095-4cb6-ace8-30a6ba5a4c35", "value": "T191833B92FD81CA12C6D06177FB1E824D772753A8D3EF33039E266F61678A86A0E77141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591902, "uuid": "ea6dbb09-be39-4024-a912-937a92b705e5", "value": "1536:gI9ola6v2v8lU3oBDnS8XZ50tszpWsHrGEema:gI9olaw2voDS8X5pBSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763591902, "uuid": "b3b325b6-ab10-45ef-9832-23d4d21a735e", "value": 83156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763591902, "uuid": "dd3df426-b187-495b-9e39-adeb06757d84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591902, "uuid": "65378a9a-ff36-4532-9262-62d0664adf7d", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ff1573-c4f7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763522560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522560, "uuid": "b66488a2-aeee-44c8-b28b-192345a1be55", "comment": "Malware payload (Mirai)", "value": "9a99be839d2c0c1b8021ffce0243ef1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522560, "uuid": "e8411fcb-d3cb-4bac-b18b-839aa01fd27f", "comment": "Malware payload (Mirai)", "value": "30630201081f50079c8ee45c86e118071e787a402d72dcec019f09364d9482ec", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522560, "uuid": "78148cce-fccc-4250-b48e-79416de889fc", "comment": "Malware payload (Mirai)", "value": "6c22d9afc0b05aa384ee30fa6809585517a2d8a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522560, "uuid": "a1c4e6bc-cb3a-4961-875a-201f249df520", "comment": "Malware payload (Mirai)", "value": "65e5999130cf1d7da90ce54cfa62fc0db0bc6681bf58fd2e60cc32d3e436250c4e8ffde383e73bb1888d464cbc7772d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522560, "uuid": "f7da6fa7-8930-44a9-9390-2e5ae6d0ae0b", "value": "T184733A56BD41D613C6C16577FB1E428C7B2713ACE3EA32039E265F2563CA52B0E7B242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522560, "uuid": "2de90892-5f1a-4a36-8954-576e52a8832e", "value": "1536:aMu6bsfkQbhAyY1WDkYVMRw5+ev+Eem5:aM3YcXyY1WJX7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763522560, "uuid": "eda787a8-410c-49fa-b1e1-e659a3124ff6", "value": 79084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763522560, "uuid": "fa4e347d-60c6-494d-a9b1-8218b8d7ac2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522560, "uuid": "a8dc5a45-b117-4ca0-bc03-65ffab6984e3", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "453035fe-c595-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763590535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590535, "uuid": "e80a702e-5deb-4836-90fb-4370053c3edc", "comment": "Malware payload (Mirai)", "value": "fc33e6bd9d22b0ef67e4af12caeea308", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590535, "uuid": "41c70a76-ecd9-4940-bd2a-6a797af24482", "comment": "Malware payload (Mirai)", "value": "30d3c0666f1c13016a20afddcbf1ca8ecb8566bd6120abd4da4b8aa610efa9e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590535, "uuid": "ef77c7de-47ce-492a-b829-5c3f04249667", "comment": "Malware payload (Mirai)", "value": "352f17abb80b5e126ce1674551ea2fdb2fc66e77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590535, "uuid": "1dabca71-f8b0-4078-be24-cfa1eac655dd", "comment": "Malware payload (Mirai)", "value": "65266f4c15e2854bf7e2895fafa8a73c13e7e3304cc51a279930ce3d11d0e98b5b7fd529f16eee5a85fa65dd57f74a0d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590535, "uuid": "b15f3c37-e265-47e1-93cc-3f3002d3417b", "value": "T13BE31841BD419F23C6D522BBFB5E428D372A13A8D2EE72079D216F2437C695B0E77242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590535, "uuid": "8a09e43f-29ea-4ccc-89e3-2c390ae6791c", "value": "3072:TbgGLlqTsoiAuun0lvca+MW/QdD4KPtvJNvJyjuVlixBsW:TbNnhuncXOIdD4KFxNvJLVQxBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763590535, "uuid": "7f50ea11-3dec-4387-bc3f-8b47da0a5512", "value": 150188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763590535, "uuid": "52816690-b008-4e7d-8f02-2c8d4f0a703b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590535, "uuid": "df4cf7c6-32d9-40f0-957b-62fb6ccecaa7", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ebe56fa-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589799, "uuid": "6bc7ed2a-9186-49c3-88ab-ca1759b0e1c2", "comment": "Malware payload (Mirai)", "value": "c6336e1cca56eecd0b3dfcf8576d45f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589799, "uuid": "d514b84a-5659-48aa-9cbd-aa97c10770cc", "comment": "Malware payload (Mirai)", "value": "3249e4610f993e3cdb975a346786d73d50162229514a6f2379d1cdf934db9737", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589799, "uuid": "742609ea-0f3a-4d64-9ddd-8e3db9c76abf", "comment": "Malware payload (Mirai)", "value": "b88ea8874847c086e21369cfdaab7acb545a33f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589799, "uuid": "7d8a3d5a-d604-41f9-a29e-294a153e0c59", "comment": "Malware payload (Mirai)", "value": "5ea15aafbd60a5e60d9d69d6548b92705c633a396a84aa7fc3a9958b33a563a2cf64c9bec8d3a2a71573de413f4be3ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589799, "uuid": "0d17f69a-d2e0-446c-a166-0deae05a8a00", "value": "T135B34AC0F98B81F6C40B8C306166F63FCE71D5A94271CAADFF969F36DA776019502289", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589799, "uuid": "7976ce32-a7d2-4882-bdce-edcaefca1128", "value": "3072:bqyLpO5iL2SNPNmIrAzRzB5935rzKqgptWsRCPN:f9OgL2mPNPA1BTpDPPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589799, "uuid": "fc892397-2f61-490c-85c3-5adcae84f24d", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589799, "uuid": "65379d7f-fbd2-463d-9e63-86b704d0cf6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589799, "uuid": "ce25fa61-1e3a-4bf6-85f6-f3734583235c", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ccb5cf-c58d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763586996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586996, "uuid": "d1d89835-c17b-4537-88cc-0aa84bd881a9", "comment": "Malware payload (Mirai)", "value": "4b4ce085f25effea6c3090df387f41a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586996, "uuid": "684900a6-05dc-4f8f-a27c-f5d4719aa004", "comment": "Malware payload (Mirai)", "value": "355ab997f62ea53614a2f1c865f0bc6688474ed09ba6e5bd975e414500827818", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586996, "uuid": "38d5deff-aab8-42ab-bab8-c99accbf8418", "comment": "Malware payload (Mirai)", "value": "e8c2afefba05b045b20781eee067a1fc761c0b58", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586996, "uuid": "52d7dbe1-1eb4-4715-9e61-53d62f961750", "comment": "Malware payload (Mirai)", "value": "592bac0bdd74fd97419622bd260ac9c6a98f8cf685e69668ad165ea27bfdd8b1d06be0a370727cd5bebfc3840aaa662b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763586996, "uuid": "a2092b71-5041-4450-bda9-f94a34f1458f", "value": "T19FC37C72D8256FA8D259D174B4B08F782F53AA9481871FBA59B2C3B14043DCDF609BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763586996, "uuid": "afa5c724-cc4e-4367-b268-16955b38ef40", "value": "1536:zKaqL+hGPgInHcA+y2NNpNwEs1yLC4ecpXjTWvxwcgKj97sGdYW5a10J:zKf+umbjNFs1wEcpzTW5wcnjpIA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763586996, "uuid": "0e35df52-0fbf-418d-b0c2-6684e1441c31", "value": 127152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763586996, "uuid": "0aa7603f-570b-4a77-a27a-928bbbcef8a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763586996, "uuid": "147625d1-241f-40e9-8119-08aa75d86897", "value": "boatnet.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9308907a-c513-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763534831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534831, "uuid": "ad583ddf-e3bc-4ce7-8e72-5da601d92c6b", "comment": "Malware payload (Mirai)", "value": "1442415b18e75faf9395ae9b587f509c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534831, "uuid": "067d3cb1-305b-406b-9b2f-3ecd214d1357", "comment": "Malware payload (Mirai)", "value": "36f1fe513539c19a5ff0b8a0917e84797c41a5b600c9cf1eec37d8097df786d6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534831, "uuid": "07ae76e5-1a94-452a-a9ab-a8944c967947", "comment": "Malware payload (Mirai)", "value": "6f14833610a18014aefcd39463482cd64a913579", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534831, "uuid": "f1c3c221-a70f-4e29-9ce8-5af35fbc4116", "comment": "Malware payload (Mirai)", "value": "1c9d7ec20f4eb88c33eef3ddaf6be6fc6c6b271a79e3673972330c95972a7875d7f810d7be52c12fab8f199a584e32b8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534831, "uuid": "27abfab3-6ed4-4b7a-8d50-aae6a704d379", "value": "T1292302366403F713E5BB0A7BA31F8785A0CA11B400B5FB1667A05AF694D3C5827776CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534831, "uuid": "c35eda9b-9cd2-473e-8ddf-1911b52500fc", "value": "1536:e9Iou0BwIO07j8prtM500TKxTmw6Jyd8LO:xoXSIOiwWNTNhJO8LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763534831, "uuid": "101a9de0-97bd-4771-b4e1-046f916cbf98", "value": 49260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763534831, "uuid": "30468157-0fb0-4b9c-a64d-d745b60d9878", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534831, "uuid": "d6d49148-9efa-4abf-8869-e4f9cda1fa3a", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655439b7-c592-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589300, "uuid": "96f26476-1cf8-4e9a-ae15-dcfd17a24963", "comment": "Malware payload (Mirai)", "value": "8a0b4e6f2e8d9633f802240104b719ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589300, "uuid": "2a399638-0467-47be-bf4b-b432bc43456b", "comment": "Malware payload (Mirai)", "value": "37be4efb495085ef6955b10ae5576970708b82217486c1cb2517f7ec63e3d7f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589300, "uuid": "fce77787-4920-4d02-a7b4-d09d2d8f34fd", "comment": "Malware payload (Mirai)", "value": "4d7099f79f9e614a2933022c201c6382fa71f7df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589300, "uuid": "55fea259-40fc-4e17-856f-5ee5e16d31f0", "comment": "Malware payload (Mirai)", "value": "0e21c85f6092cb754af926660666f3e511991fca706fc06861c9b9cde88ab912ebc995380fdf3a884cc0383a2f87930c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589300, "uuid": "e6fafda7-b5ee-4089-a5ff-a45c862aeb4d", "value": "T162932956FD819B11D5C016BAFA1E518E331307BCE3EF72129E206F3167CA96B0E7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589300, "uuid": "bef7af4d-be18-4eb1-8b63-e321d82bd2f2", "value": "1536:mUnW04uEMjEVVe7eeL4mx+NDnH515COapPV4hvd9iN4FD4Kf+U79kY2cCemxW:4jmv9L4mKHj5COapx4R4Kf+U5kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589300, "uuid": "6c860ea4-33e4-4285-b2b3-fc238a7c4468", "value": 91516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589300, "uuid": "385e69c5-b028-4409-9239-cc50b4970872", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589300, "uuid": "c974002c-1142-4d5e-9396-220e441350f2", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d63451-c520-11f0-a129-42010a9c0007", "comment": "Malware payload (ArkanixStealer)", "timestamp": 1763540278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540278, "uuid": "693a5101-fe89-4b01-89de-a3d424bcc7b2", "comment": "Malware payload (ArkanixStealer)", "value": "0a2eed56079b90d3abc653b846e0b20e", "object_relation": "md5", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540278, "uuid": "ddc0c41e-265f-47be-bf13-6754e2cb8c6f", "comment": "Malware payload (ArkanixStealer)", "value": "38169b3e010b40184746ade1946dcb355c6d4f57bc1149a63fa21df3b8b308a6", "object_relation": "sha256", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540278, "uuid": "f4285229-5ec6-419b-b3a5-f831831be9c5", "comment": "Malware payload (ArkanixStealer)", "value": "330998a64b78a3bc9c970a37363364701de5f2c8", "object_relation": "sha1", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540278, "uuid": "d45d6bed-e830-4e34-8896-8e36bdd0f994", "comment": "Malware payload (ArkanixStealer)", "value": "ee9d987e128f0f37fe89651667eb62e163ee274de9c2ae0f4c4b1f009298054299d1adfdb8927b3c3141f5ff09bc45ec", "object_relation": "sha3-384", "Tag": [ { "name": "ArkanixStealer", "colour": "#C7FD34", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540278, "uuid": "a16d445d-5643-4e54-ad9d-41019d5fad58", "value": "T16F8723AA55D5B2D4DBC30540638F43DE21D1A47D81EA5C3C3AC72C029A34EEB668DEB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540278, "uuid": "94e79ea2-a284-4447-ac51-f91048c946a2", "value": "3f89fcc81a8c8aca2e05ddab1c622a0c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540278, "uuid": "b0670570-f914-4d4d-9242-304e4152c074", "value": "393216:2Oi5lhyyN7IgV3geofoFnsIgAlqHy0KJvOb+iQftLCGpp1moc715zkKltstw3ozJ:2HKgVOfo5sIaS0KJmytrbsh5zDzT3qIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763540278, "uuid": "e50f9fd1-06d9-4e68-a769-4cd9d3829482", "value": 36230024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763540278, "uuid": "9b282bab-e24b-481b-97de-f790309492c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540278, "uuid": "fffe0054-c4a8-4963-b7cf-76a580167547", "value": "MskRaider.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3e9b352-c576-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763577379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577379, "uuid": "122c4f44-40e2-47f1-9664-ddf9c0c5704e", "comment": "Malware payload", "value": "fc93776d9855a980b88e4a1b7af05494", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577379, "uuid": "d3fec188-ef69-4d46-8c9e-5c967d9e57fa", "comment": "Malware payload", "value": "38a45f67ba1c14862104131583827ce31b4a3ddc89c89962c9e48fab257a29a9", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577379, "uuid": "9403b10b-7c8e-452c-bfe3-5fe4ee6979bf", "comment": "Malware payload", "value": "1815b3fa6e842427a902ab4f8289c39074c08c1a", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577379, "uuid": "0cee7c50-2083-4f8b-9310-1b0f455e1350", "comment": "Malware payload", "value": "f0187796327f3a2d39ed5472151fe865ad1bd5af45a9ef1e18d3fbb508704fb94a2b11e1ac02bfb0c25faafb985a0ba4", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577379, "uuid": "59448aee-8ff5-4f58-b8c2-b4215db85ff8", "value": "T175B20B606F37AF54A722069B52DCF8CA381FFF5B352219BD926F1155DA8868070FC988", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577379, "uuid": "343ba6fc-39ce-4bae-a933-48ab64829dc1", "value": "384:nvxzGYLEdBKcY5554Jf1a3ouwUxvaVm8P8xMflk8BzqReI:n5qYLEde/ytqMf08ESq4I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577379, "uuid": "81f8f0f6-2d9e-40b7-8e2c-6011bbb82d7d", "value": 23444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577379, "uuid": "df446a75-2655-4b36-b3db-b8dad2444d7d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577379, "uuid": "bf41bd4f-0a37-4b57-b101-94e2dd25a80f", "value": "3D-DRAWING SAMPLERS PRODUCT.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33cbef6b-c529-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763544120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544120, "uuid": "deaf2892-8393-4e25-b061-f37938a77165", "comment": "Malware payload (Mirai)", "value": "139ca4448995e69717e0b5673b785bc4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544120, "uuid": "19d6cc75-2ec6-4618-9184-e5accdc48798", "comment": "Malware payload (Mirai)", "value": "38df0d5e3907f6b8f645ee975d6630a6e98ad46fbf73d71246ed3e63b4943268", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544120, "uuid": "b12fb6ee-abc0-4aff-af40-904aaf06ccb5", "comment": "Malware payload (Mirai)", "value": "20a7e932f0e5fb504d9856f872ed56dd15b3bbeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544120, "uuid": "d6b568d1-1f5d-4bad-916f-e732454fee68", "comment": "Malware payload (Mirai)", "value": "8f9cc370e7d39aac638448f6047f44fc9d21ef83cc850303007ab26b14f16c34043ad66ab20990fc15cc5d55b3b26250", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544120, "uuid": "0ec1e537-d031-4bfa-a084-2d8d14179aa7", "value": "T192734B41B30C0E43D163AEB03E3F27D5D3AAA9D111F4E285251FB78992B2E325597E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544120, "uuid": "d442d3bb-e5f1-42d2-aace-d1e9046ca15d", "value": "1536:vLO+XSWEycL3LmPRmoUj025kHVPohHAqatX4Kpemh9:tSWEyOKRm/QVghsR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763544120, "uuid": "2f5ffb60-17ea-4166-9d20-4c165d777dd3", "value": 79156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763544120, "uuid": "f5ec8dd0-c406-4402-a5d2-997939589e1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544120, "uuid": "a4007285-2601-46b6-8b45-a3a91f930e3e", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d78343-c58f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763588175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588175, "uuid": "412047ff-823b-4287-b8f2-ddb509511ba2", "comment": "Malware payload", "value": "219642635c7a0d731fa66b7e55c82931", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588175, "uuid": "64c356d1-7bf8-498d-95a5-7e149fdeb676", "comment": "Malware payload", "value": "39393bc3a10ce926d345647f86a15803f448fb303a4038807b57196825d92a8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588175, "uuid": "5064e4f6-2375-455c-81f8-56644fa7dc09", "comment": "Malware payload", "value": "bbcdc481c96064e4e1bd0c2bdeff38ddcf9d6146", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588175, "uuid": "532fb604-3cf4-4256-90ba-998b33578724", "comment": "Malware payload", "value": "b5ca710caf4f5d0acc2223892f343bd0dd1b3e5756e39cf596c0d0a031c89bf75daa6d0608c1c604ff5e956a43932c10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588175, "uuid": "d7c5ed20-d657-4213-947f-139663e84835", "value": "T160F5AE15E3D801B8E42BDA78CA599333D67178529731D58F0B98E64A2F33EA08B3F715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588175, "uuid": "0dd4edd6-4a09-4107-af1a-eb9a9edc8e0f", "value": "cd4743ac79f26b784df68322687e021e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588175, "uuid": "7f3c4cfe-b26e-4632-8561-e73d1526d4e2", "value": "49152:OKzzOMFCqLGLjrCCQjhdVyF3pZCixW35MSX3X4vjYbkVfynW319lrdD:OKdFpUrYzq3e47Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763588175, "uuid": "54dae03f-90b9-476b-b0d8-661af76a802c", "value": 3412480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763588175, "uuid": "9a74c8b8-7bff-4b95-bdbe-7a72159514b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588175, "uuid": "c185db48-c654-4579-b06f-f176acfea9e6", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e893d8c4-c4da-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763510493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763510493, "uuid": "93b28237-5bd4-4de6-8582-4d75f72377f7", "comment": "Malware payload (Mirai)", "value": "1941a4f3ec03199f633a193d88759d03", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763510493, "uuid": "e623b71f-8df6-40fe-a86c-fdd0c72a41f3", "comment": "Malware payload (Mirai)", "value": "3aa7e908d724bad956f2b1a9fc6fed9f32d358485aa9991154339a10bcf77a57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763510493, "uuid": "ebe129e1-06c6-4008-a679-319ee2139a3f", "comment": "Malware payload (Mirai)", "value": "86c9b5b1b75372b5705184028cae6e1f8fedd151", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763510493, "uuid": "8d9099cc-ccfc-4d8c-ad9e-b885fb7a1a44", "comment": "Malware payload (Mirai)", "value": "21d01797e792835e764f30c74ed3e531ef6dc19dce2c0b60ba28a2d0bdcc9c3aea52ff74d5f26fe4cc4d31f8ddaf0cc5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763510493, "uuid": "57ca3593-15c2-4539-8bd3-a9a1036e03ec", "value": "T1594319C8EA43D8F5DC1509751077EB728B77F4392128EA87D799EE33B846E02E50629C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763510493, "uuid": "160c5656-74a3-4c3d-bc76-23d0e1d52a6a", "value": "1536:U6DGaq/wZmdin8JNAWk8uWfJxGc86V8ruqUiShnY7LRPLFbj:U6aV/wZmdOM68uWhxGcZ6rmiEY7FLFbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763510493, "uuid": "46d407b7-26a7-4649-9818-91aaf3a9e268", "value": 57980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763510493, "uuid": "ced0d0b6-76f3-46fd-b5d8-4b2e74b0d586", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763510493, "uuid": "0e29dd6b-ba99-4a25-affd-de5bff2c28bb", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92d1d23f-c529-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763544279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544279, "uuid": "baeadd78-ad3c-4d4c-9b43-f6d5e39711f2", "comment": "Malware payload (RedLineStealer)", "value": "9ddcf14df404839f6d5f1b33b8364b32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544279, "uuid": "bf1e6ea8-1498-4687-87e6-fc46cac0b4e1", "comment": "Malware payload (RedLineStealer)", "value": "3b75c424fd848c6139be88eab7d2cee4b9da7b8d9a6be4bfe5dc91881e93ad59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544279, "uuid": "c5c86044-e083-49cf-ba95-78e201fe082d", "comment": "Malware payload (RedLineStealer)", "value": "1b647e88343fe9d022bf130d41dc2bdd5d8c53e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544279, "uuid": "3444e1bc-8fef-43b5-bf68-7326677eeb0d", "comment": "Malware payload (RedLineStealer)", "value": "df0fbf3053dd0e73366ba7f56e4f2d608cc8a7e76a2f7d4a34ad7c15caef6a005885e5c0c035038c4b496d7fd1e66e7f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544279, "uuid": "056f6f7b-9e78-466a-8b72-0b8968401ec3", "value": "T17245BE12A3DD8360CF72537379267B11AE7B7C2519B4F45F1F98287CA973162022EA63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544279, "uuid": "01477767-f0c3-4b65-b7b8-b3fdd7191f46", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544279, "uuid": "58a503eb-bcf0-4d6a-9e38-64778493cb85", "value": "24576:gtb20pkaCqT5TBWgNQ7a/kIV26M2GUtUa/+16A:pVg5tQ7a/kIREUSt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763544279, "uuid": "97fe7e90-7a43-429c-84bb-1e262b80b6be", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763544279, "uuid": "f7e4ad7a-2931-4759-9c6c-b351b4dac0df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544279, "uuid": "2f8ce9c1-5952-476b-9d50-e4852e5f7280", "value": "18 QUOTATION NOVEMBER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8465c7f9-c535-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763549409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763549409, "uuid": "746050c7-e47e-43ab-b4fd-7eb42d6d0e1b", "comment": "Malware payload (RemcosRAT)", "value": "0baf5e82711b7b02d084bbd80e07e594", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763549409, "uuid": "c31f3df2-d58e-4d58-8fd0-0417b1850581", "comment": "Malware payload (RemcosRAT)", "value": "3b83666797ab5e6ce9a2e58ea84b259a2d4c7cb08db82674c52c82e62314ff04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763549409, "uuid": "e071b04d-ff22-4d45-8ccf-07359c6b6cd5", "comment": "Malware payload (RemcosRAT)", "value": "90f90e81678f32805ce757aaf68e14e980135fab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763549409, "uuid": "df08b175-5313-4a08-9993-4914ea52a682", "comment": "Malware payload (RemcosRAT)", "value": "0038d47d127f76d98b0e766255d827fade78c02ecede37ecc79de1e927453c59e2b7cb7004bd375a738513994ab13897", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763549409, "uuid": "05a9d9a7-b85e-44e5-b258-3b63bb9395c7", "value": "T12385CF52BE504D32F13E3534D816A3A81525BEE12A24F8467AFC3D488FFB6533929D87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763549409, "uuid": "c0252554-3f17-45ca-b94f-ef65e2c630ca", "value": "65ff4bc8970f448f80a983edbcabb93e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763549409, "uuid": "33e0d761-2f3e-4815-a39d-c69fae75c998", "value": "24576:+XHU4RXv25oNvfzQ4u6iDy4KhdRPtYfxk7/ICtBzXPqIEPBZRoElofFoqPhLMjCM:+Xk5d5mYfS7VBzXPCZ46q5LM24pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763549409, "uuid": "545d5219-2d05-4801-aabe-90c303d5d2cf", "value": 1771008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763549409, "uuid": "7ee38e7f-e1f5-4513-8ab5-85a8d99f17df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763549409, "uuid": "fc7afc30-44cf-494f-bc02-21648d9842a1", "value": "BBVA-Fatura-sepa-003049450494839928437848948..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "903f3870-c575-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763576917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576917, "uuid": "43e3c0cb-4daf-4111-bb83-2629fa28f777", "comment": "Malware payload (Formbook)", "value": "68ba2c20f21d36e36d3393cede056af7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576917, "uuid": "171d976a-56ed-4190-8088-e0a1d7cec4ef", "comment": "Malware payload (Formbook)", "value": "3ba4c215dd4560b63680ee1c1ccf4c8966283def8d59d10361a510eca266bd62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576917, "uuid": "bb17bca6-249b-4e4a-92ff-9af8312687f9", "comment": "Malware payload (Formbook)", "value": "50dc262bb1fff598c6e5a315ac62699b6feeb6a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576917, "uuid": "3bfabf90-4129-4d82-8c31-88a687ca71d8", "comment": "Malware payload (Formbook)", "value": "2b75de0805f7ef653ec5a1baa6b399b5045112db29c5ddf13a80dee3a2f534999efac3972d8d99ed5dfb0f71ae8686f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576917, "uuid": "8c61fc51-4c40-46fe-8002-8e37c8f981c2", "value": "T17F2501813AA998A3C83542F50632E1791BF92E9D7212F2C94EC22DDFF8E5F045E48347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576917, "uuid": "46e5a2cb-c200-408a-b734-f85185760c7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576917, "uuid": "053b1cb3-8a3b-4ba8-8e0e-0ce889eed023", "value": "24576:E3YyBrUwYMYmmME+UG7xCzlYbuhDJwP2gLL2:E3YoYmmbQE8QwP2wL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763576917, "uuid": "895012c4-2ba2-4ec6-bcdd-3abf985e37ab", "value": 974336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763576917, "uuid": "6860b447-067e-44a8-b209-5e2ff2238ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576917, "uuid": "3d986214-ebac-44e0-b6df-4d5e7486a15d", "value": "usltd (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2dfd8ab-c568-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763571418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763571418, "uuid": "a91383a2-ffb4-4fae-81f5-044107f62008", "comment": "Malware payload (Mirai)", "value": "cf5f2179aca6f57445e12dc876d96878", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763571418, "uuid": "bac6084a-6bc1-4a3f-921b-6e4672e6c020", "comment": "Malware payload (Mirai)", "value": "3d048dbe448cd395b09a225f5998f43487656691006a8c184087a37dab19dc4c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763571418, "uuid": "49ecf2ce-dd41-4c15-9e66-71b6bfa11aac", "comment": "Malware payload (Mirai)", "value": "9d1ee3073078bfc938dd75a441fb704aa1e835a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763571418, "uuid": "7496eeac-1a3b-4294-b024-1e9ba9148e29", "comment": "Malware payload (Mirai)", "value": "a245860a877efdf6f0001e70c7865b3e2a598513351d8f0ee4461725141282e2d4d4d11759734cea30dae33b530a28f8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763571418, "uuid": "45f4359c-25bd-4c4a-9265-0a76f0b8795c", "value": "T14B734C42730C0A53D1A75AB1293F17E093BFA99021F4B689680FEB598271F73518AFCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763571418, "uuid": "3a79cd4d-54cc-4210-917b-0dc24e1f3a73", "value": "1536:Oby3lPaTI74VDrnMapRTFCEV1vuPFKbTFZaug7RoL:Oil4Vf/pfzuPqTKug2L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763571418, "uuid": "373741e4-cc3b-4552-aad7-f41221f5db85", "value": 79108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763571418, "uuid": "37dedebe-ac7f-407e-a142-24ce316ee7df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763571418, "uuid": "4c14fca4-c21c-4ea6-99d8-b37fb9d8b13f", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7996b4c4-c521-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763540801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540801, "uuid": "2ad19417-f661-4119-9ccb-2ae15cd4e806", "comment": "Malware payload", "value": "fffc4f8dfe7d1db02544f72f147c289b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540801, "uuid": "704db1b9-0e76-4572-bf06-c9846bae8bb9", "comment": "Malware payload", "value": "3d7a2213500cc16e9b8ae1ac0077688ad736c7b99308b4d9727b98429e12453a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540801, "uuid": "2a09437b-44b7-489c-9df6-fe7f7846b0a8", "comment": "Malware payload", "value": "5169cdd434ce8559ec937e1b0a5d510733e3829b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540801, "uuid": "24f94b86-4112-4772-909a-a022cae8cbdc", "comment": "Malware payload", "value": "5eb3947894d579107f46a86e22b4a06e2c32449ac06a5257bd724f63cda7e0a1c12d3022088d9849db0da066c913dcaf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540801, "uuid": "2014dd2d-e330-4065-905e-d29b33ce7b92", "value": "T1EB53024E507A6DB3DE5B6BF30E4A53446B72307A510632A709B5FB9F4EF8810DA32310", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540801, "uuid": "7eebe105-761e-412c-81a9-103c616ca97e", "value": "1536:As6YShhOL7ooEvVFr+1+N0nUDSxzjx7h6D8CbkKbOHNPUBfw3:/6YUOAo0VFlKUQzjz6QCbkKqHxUm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763540801, "uuid": "a3126ad0-b80d-442e-82cc-63ff8f4ca59a", "value": 66072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763540801, "uuid": "b16bfac3-0f64-4ce3-9ea4-abfe25e2bfbe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540801, "uuid": "c2e530c2-7f31-406c-b247-dcb4e184ccbf", "value": "executor.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3d578a2-c542-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763555099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555099, "uuid": "39a32350-fc54-46fb-bfcf-a9d3efda38fd", "comment": "Malware payload", "value": "d98b169424f36682f9842bd0ba53c429", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555099, "uuid": "53b49127-978e-4295-82a7-9ee287c2f125", "comment": "Malware payload", "value": "3d82200083a86df09c3b16c9095b844738a76863b1b01092b6c4dbef3b974b12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555099, "uuid": "2bd6c188-e6cb-493e-a1da-b20ebcfbc11c", "comment": "Malware payload", "value": "72d1e63eb022bd8f37701750fb114a8071133932", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555099, "uuid": "21e54035-f570-47cb-a3ec-d3b0fd569ce2", "comment": "Malware payload", "value": "bfc916721bf0ce5587061957c97194e5dbf2ca1e2440c7f6fde2742824fca7a3932ee8073cd4a937b55699f43110c4ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555099, "uuid": "5814aae7-c765-47c1-bcf9-04cf51bf7e7e", "value": "T17DF65B47AC9148E4C8AD8634C96297627B317C584F3127C72B60FA7C2FB7BD06AB9354", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555099, "uuid": "5a141e01-6c5a-46f4-abd5-ce122c410156", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555099, "uuid": "a4e15565-1ea2-4c3b-93ac-42b7971d6166", "value": "98304:x1i0HGPPG5xIyf+R3OSTnEE6mFUQ7Zk3YhswsKb067yM7nOEBB7M98wSMbmcd/mz:PeG5xIg+R3Oz/yv723YKKbQihO2MbmbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763555099, "uuid": "3f883960-b5d7-4c24-b929-fc30bbd60319", "value": 16538416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763555099, "uuid": "f192a341-1dae-4fcf-81a1-36b62e12e4e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555099, "uuid": "2a32f59f-2ade-4028-895e-71e179c9f740", "value": "convertyfile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b50cd22e-c575-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763576978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576978, "uuid": "72dd1361-37f4-45c8-972f-1f33b521a64d", "comment": "Malware payload (Formbook)", "value": "d0cc03d0f3e93fa7a00ca2938666b1d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576978, "uuid": "d082ccc7-6080-4b50-8644-5f52dbed73e6", "comment": "Malware payload (Formbook)", "value": "3e80180b33b518fef3b04fcdf5fd87cb1b553f50a6649ff380403a0410fb7d09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576978, "uuid": "d321dbe0-c1f0-4c85-bae4-95ae9352f426", "comment": "Malware payload (Formbook)", "value": "895174c685f9aec1b9d34da264d5b42cb227d945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576978, "uuid": "5a0447aa-9a3d-4da1-819e-72ab469e8c8c", "comment": "Malware payload (Formbook)", "value": "deedeb278a66972c5c3febb782ecff048263c4aa8b47daf04d97a896082de7861635ed776606b2acb139160688254c0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576978, "uuid": "7516e1c3-5232-4ea0-b93d-aa4c81a690ab", "value": "T16B35CE0433F89F15F2BA5BF55A30C23013FA7E99682AE20A8DD66CDB3A75B410D16717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576978, "uuid": "219ea69e-1570-4dd7-8169-4b9fca0e33ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576978, "uuid": "75ec1a81-6c77-4498-9f91-5b591b2e9208", "value": "24576:Bhnu6iLvahalA4BlC23FooEAPCFDnlBbaYO6:u68vahallX7DEAPCFDn3baF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763576978, "uuid": "acdc57ac-b024-4214-9394-2c8107c7d888", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763576978, "uuid": "9cc74fbc-cb04-4c07-bed1-44d8d52d1df6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576978, "uuid": "4914fd51-fa18-4012-99b6-33e0859bc236", "value": "Payment Remittance on 2025_11_17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637ff0d4-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594880, "uuid": "03445bbd-65cb-49d3-b28f-cea687e7f71d", "comment": "Malware payload (Mirai)", "value": "7ceaffb57e2ea6e5f216bb402bd8c545", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594880, "uuid": "d45a1d5a-7cfc-4ca7-98b7-0c906c7f0339", "comment": "Malware payload (Mirai)", "value": "3ee5441f3ad6eab5271318dc209cc801a0d4f64d6cdbfe519a7f547939d1eeb7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594880, "uuid": "da15baf1-f88e-46c9-9422-4558982179fb", "comment": "Malware payload (Mirai)", "value": "19be42c189505045fef5839372c9be3d8b8a5754", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594880, "uuid": "3f7134b1-f653-4ed4-aeae-694c154c877d", "comment": "Malware payload (Mirai)", "value": "1ceee6263522a98d4c63bebd8ba9d562f1f9570533c67fc5a73902fd25ebae02e15d4f335e0ca3b660cd53e0d13332f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594880, "uuid": "92ba365e-1b88-475d-983e-9a5c4dc48afb", "value": "T1FEC34CDAB801DE3DF90FD5B644670D0EB935A3A156831F26225BFD93AD331A4BC02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594880, "uuid": "ba8f06f1-9f72-49d0-a26b-66fec78e460c", "value": "3072:Kt3/OvE28W6A1MFFgGXpb3ZNaNwTNDHyM:yOvE28W6FF5bpNdNDHyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594880, "uuid": "342e9b39-ae1e-49f1-ba89-fba047377cb3", "value": 118732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594880, "uuid": "bfcb3c1e-cf09-4991-90c5-7dad45f361f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594880, "uuid": "293eb8c7-c9ad-413a-a839-12ff123765f5", "value": "S3o.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca6d8f6e-c56e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763574008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574008, "uuid": "ee1e3f85-8713-49d2-8415-9a76f9ac057c", "comment": "Malware payload (Mirai)", "value": "185e3e41e19630f6e387c45de99da04a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574008, "uuid": "32ec5a8e-c9b3-4be1-8f79-f84089b01197", "comment": "Malware payload (Mirai)", "value": "3ee5b01289888546241b7b3a1ef7f34e75532b8cac12f367cab0189babf40ac7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574008, "uuid": "59db4546-fc8a-461a-9651-2dd5b467f82d", "comment": "Malware payload (Mirai)", "value": "b88cbb7d139360eaa301a1370b25b89c7cc5a224", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574008, "uuid": "29eeb43b-b95e-4910-8193-9c91678b8da4", "comment": "Malware payload (Mirai)", "value": "9f805c94c523380e5bc8eb2c2a116ecb15573e8b94dfb3b3e3787a154d9b418bdf0e28876bd49b1c039c8808d4093b7b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574008, "uuid": "4099bdf5-8e58-406c-ac19-53a2cd91812a", "value": "T119A3D91E7E629FADF3AC823447B74B31A75823862BE1D685E2ACD5052F7024D241FF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574008, "uuid": "1a0e23fc-57c9-4a47-b77e-e38092e9ac43", "value": "1536:0t2kds/XVBG9digjieUoszWuoGsUZ/TORtDoe4602MFDem7mve:vB98dYeUoszWAsUTOvtMdmve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763574008, "uuid": "ea6249fe-4b04-4141-b9e7-b80ce0265c8d", "value": 106396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763574008, "uuid": "6b91454c-3699-443e-b6e6-0ef2375dfefe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574008, "uuid": "6dbce0fc-4d6c-43d4-b889-6ee307364928", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fb8451d-c513-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763534852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534852, "uuid": "5b34a471-b9e9-49c8-bef8-db724863c2f3", "comment": "Malware payload (Mirai)", "value": "9b990d9b8cd75494fa337a9a193deee3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534852, "uuid": "1aa9039a-aade-437e-8323-ba2647c1506d", "comment": "Malware payload (Mirai)", "value": "3f4e1c8ef980910f8bbfc434da199b6d463c0b8adc5236b85b3e566bbb5b4d1e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534852, "uuid": "f46c00bb-e777-48ba-af23-8a214e4f87cb", "comment": "Malware payload (Mirai)", "value": "910e80b9264eb1419fc216e2c2be614ce82e8324", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534852, "uuid": "77a8c8ad-32bb-433c-8bbb-8266b5308d04", "comment": "Malware payload (Mirai)", "value": "e2d89b3f48e598f8666ce7197ccec29da04befadcf364cfbdc274bba8e1c3aab4c339256f47848728c78f20a68e2d69f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534852, "uuid": "0dc89ac5-eacc-4cf8-a3fd-1d55e810e600", "value": "T1E2144D56EA418A13C0D7277AF6AF414633339BA4D3D7730699246FB43F8679E0E23A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534852, "uuid": "e7f85e03-017d-4d67-a374-27e90a0536f2", "value": "3072:4blGdgiLhzlHhx5FuaXHggeUkOvSSmXebgZTx3bK9m4H1M/9fmJhE+:84uwdlfzuaXHggeUkkSCbGTNbK9m4VMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763534852, "uuid": "d4ef060d-f81e-4fdc-b0d4-36d7154ff4cf", "value": 193679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763534852, "uuid": "c2c37b6b-b211-4ebd-afd6-13889346cdab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534852, "uuid": "5b356ec0-d54f-468b-bf6f-b4d955a7510a", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f39781-c4f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763522185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522185, "uuid": "5eb0d61e-2a3c-4970-85fd-f836e081cdb4", "comment": "Malware payload (Mirai)", "value": "59efbc92ea89694bbaabd90d87124cd2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522185, "uuid": "bb6cbddb-47c6-46a1-8231-1c5fb2d5ede2", "comment": "Malware payload (Mirai)", "value": "3fafc25f28b20dcd9d24db29902c568df72fe22c74a3c95ef2f477ff26ee786c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522185, "uuid": "a50837f8-7a9d-4b75-a50d-9b423b9cd63e", "comment": "Malware payload (Mirai)", "value": "08f65ca8bf4fc859298d01f7c2cc80637bb51ed6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522185, "uuid": "bfb8fd83-6fd1-45fd-85ea-7c2c2b2a76b4", "comment": "Malware payload (Mirai)", "value": "5591e20a8da516fe64316ff039cc0b78353c0011e02c8c0aa005c1a591c9128a3752d57b66b5712812ee05bf2f43ab03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522185, "uuid": "9a5966fb-bdda-4f18-b762-a5eea0e49063", "value": "T12C432991B8819A23C5D4137BF5AE55CD372423E8E2CB321BDE215F613AC682F0C6BE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522185, "uuid": "8f0d451d-9f59-475a-9339-59233c32c124", "value": "768:Uuc3A4vyRSP6GQTUYAGZvK8yEYmZQEuVN+bbP1DSkMtckFvB1mA2EDEy0eYjW9TU:y3AQ6gGZDyEYub2N+nucTR6rCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763522185, "uuid": "549f81f1-d094-4bfd-b968-17ae46e6683a", "value": 55164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763522185, "uuid": "27e1b914-1393-4213-b798-1ccca71a3888", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522185, "uuid": "b2a3755f-510d-4474-86cc-632cc25cfd7f", "value": "boatnet.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a61a7d1e-c513-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763534863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534863, "uuid": "3d341c42-b042-44ef-94d8-55ab58794213", "comment": "Malware payload (Mirai)", "value": "0a1866fb4bb2a461cfeaf60b66f47c89", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534863, "uuid": "1f80e7b0-5961-415b-88ba-b9cd3da9c3ee", "comment": "Malware payload (Mirai)", "value": "411d9b8f21f48523f8b26d2c56a34daf5243845a922a662743aa59c79e24f93d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534863, "uuid": "7e9a2807-bdcd-47c5-8214-7100cdc5bca9", "comment": "Malware payload (Mirai)", "value": "4f304671a3ac53b97afe2253e561dc3becccdf1d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534863, "uuid": "6e4fc430-ba46-442b-8669-975dae90417e", "comment": "Malware payload (Mirai)", "value": "1253499c1ddb0eebaaa6e132faf0845e97dae8a080f2b9434f08ebeaf42fb7235c1d892ac3d709b92785150c176d72a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534863, "uuid": "3a69b9f5-0e04-4406-a6fe-5615ca88b78f", "value": "T117D30806BF210FF7D86FCD3706AD0B06298C655622F97B367674D818BA4B64B19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534863, "uuid": "aa203c05-0c03-483e-91aa-d9e7d0d59aa1", "value": "1536:jyWGErvfQaS/ruAuh/yYJuvDV9HQl8QYVtstxZe6YDT9AAtn5pLS5amxrPAZd7/:jvHrvf4uhtu4hDx0rOamxjAZdT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763534863, "uuid": "de0fbae1-dd99-4d54-84cd-4f3e106a9eda", "value": 135248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763534863, "uuid": "65728c5a-088c-4bfd-b50f-90fdb755e997", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534863, "uuid": "ef961e69-99db-42aa-9be5-b5a6fa49dc0b", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758516e4-c587-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763584603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584603, "uuid": "d6067c87-fd8e-4eb0-ba3f-ce31f20d37f7", "comment": "Malware payload (Mirai)", "value": "bc0980783721d3d5dffbb3da7ec368aa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584603, "uuid": "2c26c1b3-a430-453d-b670-bf05b784928c", "comment": "Malware payload (Mirai)", "value": "41a9fb1058fb469c0c8be148d700d38f8d168ca3e9d14566235a48913c09fe5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584603, "uuid": "1c79bdcc-1eef-44b2-8682-e0b2adfcaff5", "comment": "Malware payload (Mirai)", "value": "3a6d70181b322d74d0a8097ae42d1b21b0463bd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584603, "uuid": "1d348caf-4ce6-4c32-ae04-e6295b5ef71d", "comment": "Malware payload (Mirai)", "value": "7459ab039a3bf702bf7059ec32e89045e0a5db14292794a3e020099cf1f098d1a29b71a2f35267471976ba4903447b5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584603, "uuid": "3fe4bcfb-7b38-4bae-bf11-ab32c0590160", "value": "T199737DC6E743D4F9FE6206B96133AB7746B2E5390025DF46CB74B936EC12A01A31A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584603, "uuid": "ee306be2-5bbd-4a4b-8ed6-15213b2f778c", "value": "1536:aSEyWsOnpyjVcz2Xwo3c/3YbwOtbn/cuCXTfI5+WEfSyOmOLj:oPnpOyo3c/3YMOtbUuCXrIQXfQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763584603, "uuid": "2e2ae6af-aa73-45d2-acfc-0bb42024c481", "value": 74740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763584603, "uuid": "6ed331c8-a44b-4273-9dc4-ddae0d374f04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584603, "uuid": "e5b82cc8-2f84-4b07-8232-89cada9bf862", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d1533d9-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594923, "uuid": "45fa64bc-4cc2-41af-8b16-29689240c3c7", "comment": "Malware payload (Mirai)", "value": "e95515cfcfc432064075a0cf84258a52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594923, "uuid": "a194f09d-4e9f-41b9-8dd8-0eddb5c78c0a", "comment": "Malware payload (Mirai)", "value": "41e70e83d59f3b7b201044ae7e6071aaf8086924c6381ae9e2f01f8725eabb27", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594923, "uuid": "e1506ad2-3877-401d-91b2-80c599516586", "comment": "Malware payload (Mirai)", "value": "054ddee93ecea8498a2858719a8df8e345af555d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594923, "uuid": "9bbb1696-1d2c-42f2-95f0-e067697e7b52", "comment": "Malware payload (Mirai)", "value": "686aadc9600be92f55508b8be65df475299e6a1080ca59edbaff8d870f39009c55c1a4b4eec25c6262c175fa158d76f1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594923, "uuid": "9c208872-56d2-4b51-b2ee-68190ee2dbc8", "value": "T148E3F809BF610FF7E89FCC3705E91B0528CD556732A93B36B634D918B64B24B26E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594923, "uuid": "7338ac83-3a6f-42da-9df6-c57e5ccaa4aa", "value": "3072:q/V6WWosd4Bi3u7KGzJtcMaeeGeVlJSnc7oyJi6ts1uYa0:q/IWWosd4Bi3u7KGzJtcMae10lJic7bO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594923, "uuid": "2e6fec18-3347-4589-a6ff-9e391e7b29fa", "value": 148792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594923, "uuid": "92aca686-6b4f-4c0d-a045-eab0d698ee2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594923, "uuid": "0a55dd0b-a118-413e-962e-0f8ec63bfbe5", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88477c38-c562-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763568743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568743, "uuid": "61f05ad1-0681-4806-b12f-9afb8b921a1e", "comment": "Malware payload (Mirai)", "value": "a96e9a5e5198aaa358db2625ef96ff2b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568743, "uuid": "8f321d36-3b9b-4e1c-ba09-57a72fae3fd0", "comment": "Malware payload (Mirai)", "value": "4249ed9f26503b47e0dee24c4ac02c2383366fabf1403f76b1485a387cd78a9d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568743, "uuid": "ca588d02-18ab-47e0-9e3c-6723af75c2f8", "comment": "Malware payload (Mirai)", "value": "4802365be3044df1f552b2cf8a2d9f46dc0a198f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568743, "uuid": "3cc3fc23-3b47-4bc6-b21e-9b384ff534c5", "comment": "Malware payload (Mirai)", "value": "2c36c79a3dbe90dc900ee078d7f372d2816eaae3083b043c6b99a82a65e74562d2d7a95d4d2ac1c9ac5a1b0117b1e3ea", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568743, "uuid": "0c330083-03e6-46c6-8670-938c8d13ce09", "value": "T131A3C70A6E12DF6DFB68833547B78E21979873D62BE0C585E16CEA005E7034D741FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568743, "uuid": "508d98ec-4939-4153-b341-0335690d6cb2", "value": "3072:w5T5nHew1SWVQ84aJHA+U2QhYIZ7ugy0S:2FHew1SWVQyHAJ1fg0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763568743, "uuid": "0a690ed7-6c2d-4eb0-8e08-a184f5a70d77", "value": 105252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763568743, "uuid": "b665c61c-b982-489b-83d1-04382bea8b54", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568743, "uuid": "7421ed05-d0bc-456b-944d-bf4b2aef5832", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c49e80f-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589714, "uuid": "b525e24a-3762-47dc-855c-bebb9d06cbfc", "comment": "Malware payload (Mirai)", "value": "8d976785f028c98d7088745473a8c466", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589714, "uuid": "229214bf-8c19-4884-b7db-7f9dd1903a18", "comment": "Malware payload (Mirai)", "value": "4310bacb49063dc1442c64eb146ca9c91d42938c3361144718e87b761fdaba57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589714, "uuid": "1d2bf5c2-7d5d-4fd1-9c87-81b7ecc5bd8d", "comment": "Malware payload (Mirai)", "value": "324414806fe7d93c610d2b0abedc877f541dfec3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589714, "uuid": "a83f574d-7da3-4f78-a327-abd9724a6787", "comment": "Malware payload (Mirai)", "value": "41b642cf430bbe0680527c93bdf80d30e5fbdf3304ccd55871c913f509d886e790504ddc9c74e9664db5a84019e8a3b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589714, "uuid": "12ea659e-c4a4-4a52-a7a3-b2ddefd5f8c9", "value": "T1AB33F2F8DD81B0D9DAFD9DFB07CCAFF5C661D581250B9348B3128882F62681E34751A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589714, "uuid": "e1967094-37ec-4be4-93b7-b5f065d7bb31", "value": "768:ew8LFMYgb+vM/eE9vZ9k85WTjxwYk2SpvLlYJV3eHosBpASvNZ8yLllq6JfYzpDC:rCIbWE9b5u8YPaDvNZ8QNgzpDkv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589714, "uuid": "f273ebdb-3a3d-4fc7-9096-c12cf17ab16f", "value": 50452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589714, "uuid": "e6f90a16-f453-4c9e-8269-93152638a237", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589714, "uuid": "0d489e6b-8129-4c2d-9f2d-1ac054a15228", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec8fa05-c553-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763562177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763562177, "uuid": "391b4746-679a-4d6e-ac26-cea34a5cdb8d", "comment": "Malware payload (RemcosRAT)", "value": "dea547a25f835ca99dee29f7956af4c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763562177, "uuid": "083751b9-e508-44dd-a0b5-a00196b4992c", "comment": "Malware payload (RemcosRAT)", "value": "4426926529e5a8542f58cf5593881c4bd3fdc2f89200832a74db095fabf6d91f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763562177, "uuid": "a243597f-47d2-46ea-ad3f-219eb7620cfb", "comment": "Malware payload (RemcosRAT)", "value": "bd7e70347c27f4ec6df0bb970f732e786823cebc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763562177, "uuid": "0be58c28-0de7-4773-b4f2-2ce48de6647a", "comment": "Malware payload (RemcosRAT)", "value": "c6b69852701f0290a7f18bc82607be0ab323f4c1fe4b34713a86c8e785a7d00544c5097274f5be271dd94f45f135ad34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763562177, "uuid": "1a499439-9a07-477c-b9a8-14fcecca7ac7", "value": "T1B625120412E5DE02D4B31FB128A0E2B16BB6AD899D36C31BDFE95DEF79A97040941393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763562177, "uuid": "bba5db4a-a14b-41ab-addb-458599fe879d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763562177, "uuid": "3a8608db-9ef0-47ee-a195-a753bf69ce57", "value": "24576:V/VlBcIX+zUtfi2dbaT4uEXrWjFigFh+b1QLOZN:V/VXTmUtfia9uE6sohm1QLOZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763562177, "uuid": "43dfdd54-adf1-42c5-aa6e-5db8c44a43ef", "value": 993288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763562177, "uuid": "c276464e-f2e6-4e25-8411-c203bc283c83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763562177, "uuid": "91dc4081-7d1f-4b52-a31a-9657923d40f6", "value": "edu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3538176b-c55f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763567315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763567315, "uuid": "25e5dd85-5ec1-4d71-ab8b-0866ecc32aa8", "comment": "Malware payload", "value": "f337757e4dced3d702c5bf6f4f972723", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763567315, "uuid": "57fc3236-1e99-47e7-8cbb-50108cd616be", "comment": "Malware payload", "value": "4442e1b545f0a571af113b0cc7455ecba1a603c81bbf84a52b9e61d332f97233", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763567315, "uuid": "58fbc286-5dec-451c-8ff9-500269d27306", "comment": "Malware payload", "value": "ddf1c4b68907726b23e07cf8c7388075a9f914f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763567315, "uuid": "0d21a145-c0b5-4297-993b-de59c265af05", "comment": "Malware payload", "value": "16217115826ab66836b2e2331ecd06c36aa6a1900cda2b0c053d84ab18cf1d1cfa232a51ed89fe4ae5f8872e271b94e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763567315, "uuid": "ad039bba-33dc-4454-8bd7-85c5963f14d2", "value": "T1FE83AD40E660C467ECB2873224361E7669A7BD2A98F0568F176C75243FB73C2A51FB13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763567315, "uuid": "f2d42448-4ca8-4bee-a303-b25e636e32b1", "value": "f4639a0b3116c2cfc71144b88a929cfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763567315, "uuid": "d5b961f4-a34d-43e1-8454-9ecce2c058b2", "value": "1536:XfHLrLkSRoybCQUZsrs0DC1cu66pMdFMkXz8u0GBsoxMLfm:Xfr3k+o5buDC1cu66pMdD4ujLx4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763567315, "uuid": "d8a98f0f-523e-4684-8ec3-32cb4437ebd5", "value": 84464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763567315, "uuid": "8577e664-7940-486e-a3b4-96e2cc8864c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763567315, "uuid": "74c76ed5-6871-48a3-8400-dc1fec53475c", "value": "INTIMACAO_2025_006647.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad30756b-c526-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763543035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763543035, "uuid": "2dba8755-4e9a-4b28-8e9a-cebdb8a8aa4b", "comment": "Malware payload (ValleyRAT)", "value": "cde5aff821ba0fdec4032b58bf582492", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763543035, "uuid": "8d3d1be3-2dd2-4de8-bafb-fc2c75792b72", "comment": "Malware payload (ValleyRAT)", "value": "44712bce3f57afef3731390e3d6704cddc692a3130ccf94727fbfe23beca1f53", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763543035, "uuid": "61b8a335-8d2b-4390-b9a4-e38d705d6732", "comment": "Malware payload (ValleyRAT)", "value": "6264b7366a7cc044192becb418cdca1db0429fdf", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763543035, "uuid": "3c9ba958-6023-4b8f-849f-6f8d427d5ec8", "comment": "Malware payload (ValleyRAT)", "value": "1f0263b157182ba2caa701f174724ab7fe3d6fae26b1cd2c912ce01e06e0202977baf1a5eba9863d324fd4b5cce4f9c0", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763543035, "uuid": "c53a9668-38fd-49b9-ad1d-92f989cc8eb4", "value": "T1355512153181D472C85726308AFD93BA5A79E4325BF842DFA3D429BE4FB03D05AB6387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763543035, "uuid": "6731344b-4c20-4dea-82ce-319d8aa0053f", "value": "b8bf08fa843a9ec1ce10d80fbf550c26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763543035, "uuid": "1f041122-7ece-4b5e-ad75-6e638d534ef7", "value": "12288:ypXAKdMst2/w9wk3Mh5YssJjFnTTNbnGkShsveitCArsutlhawUs1:yiPw9N3MA1JjFnFbGth4XtXh3haxs1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763543035, "uuid": "587a60c3-1cb8-46d4-babb-409522bc86a5", "value": 1377280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763543035, "uuid": "c6cb8a69-98b8-48e3-aaf3-ca022cbe88a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763543035, "uuid": "9a66c765-cc07-4926-a60c-b914c6452bbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44efd051-c514-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763535129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535129, "uuid": "d613854d-7936-4131-ade0-19ebe66533ca", "comment": "Malware payload (Mirai)", "value": "ddffac469fc0753017dd5c5831891165", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535129, "uuid": "23240b0d-1047-4658-bcb7-0803f59f3809", "comment": "Malware payload (Mirai)", "value": "45d1e5d619ab57daaa37e011d9a3d11aab349f9111d9bb22cc27c70e3e05a470", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535129, "uuid": "ad595d7a-8b3e-44b5-ba67-f6598c60f956", "comment": "Malware payload (Mirai)", "value": "a8e9217751ceb6f3d3c7a45fe57add838802deb2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535129, "uuid": "8f0abecb-4e33-4951-8144-8e3a8fd7d906", "comment": "Malware payload (Mirai)", "value": "740a86b4a36e7465ab0af27e1a7440d87f04e2e533ea970392c9da9a083da0c9372055864b2fc54e047d572968b4ae58", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535129, "uuid": "f33d19f2-f1eb-4edc-84e7-3f947855817a", "value": "T183937CC0F683C4F2E84705B1507BE7379B32F1B9101AFA43D3699A72DC91951EA1AB9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535129, "uuid": "c27572e4-a952-4be9-b7fe-22ec9b33671c", "value": "1536:W/QCZaxGdvts3i5JPho0sxPu++4HRsUIKqI4FrS4LSM:WYCZa8dvm3oJPhpsxP5lR+KfUmDM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535129, "uuid": "8b2a784a-7bd9-47dd-a055-bb3a2ed982b9", "value": 89992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535129, "uuid": "b030bfc2-14c3-404c-8e7c-c65e380844a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535129, "uuid": "f005b05f-0857-4e1a-a4e3-25ad365cac20", "value": "main_x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4d8ff27-c594-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763590400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590400, "uuid": "537f4ecb-cffb-4a94-af2a-77022dbac99b", "comment": "Malware payload", "value": "f32027078a345e969f8962543185d95d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590400, "uuid": "5efdd567-168f-4609-bf57-bc4ccdbf8ef7", "comment": "Malware payload", "value": "46149a4e6bd7f01e816ff0e98d10e2248f6560b8dc075a2bd00a48d7095c51d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590400, "uuid": "e2feebc5-295f-43b0-99af-6cafb5e25ca7", "comment": "Malware payload", "value": "cd928400ded54c59bf35b5f801968b72965160d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590400, "uuid": "0f25fbe9-70a6-4bd0-8026-bc7abfc8e878", "comment": "Malware payload", "value": "b6582496818212f66391cb0743e651060e38a4ef741beba47db36b64acec7498163ee124f84ed0ad229d4fb77bf402f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590400, "uuid": "5aa40326-5eb6-45ff-ac08-69230869f91b", "value": "T1ABD3E052891044B2EC761E7010A62B2AAFB3BE2C7CF4958B778475957B333C2A53D52F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590400, "uuid": "8e36caef-828a-4007-8e9f-a69d16488b8a", "value": "039d1617d5f0788dacbd04b35a141ebe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590400, "uuid": "3baf58f6-39bf-48dd-923e-3c9dc74e0109", "value": "3072:7sJY7SurwgsHszCev8yI0kmsXELcAv6KZLzZFBOk88cb:7PKgcevfZxsX5Av6qLo5t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763590400, "uuid": "4a82f864-61f9-4f79-b9f6-58cb54973d6f", "value": 141280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763590400, "uuid": "9c86e778-4911-4bd0-a520-6374a96fd6f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590400, "uuid": "74622ef0-23b9-4110-bf2f-92236eb486b9", "value": "gogle translate-2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee5bd77-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594873, "uuid": "16583014-9dba-43c2-b04b-a6deb07d7e11", "comment": "Malware payload (Mirai)", "value": "ff97146c9bf8358aa8d8d568443fe298", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594873, "uuid": "14af4706-1c20-4cb4-8c95-9c17246ea84b", "comment": "Malware payload (Mirai)", "value": "461b82b300176336c5067e24bec39945e2f68d62bfe985d3579894ffa08567c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594873, "uuid": "9bb6391d-d1e3-429c-815d-26844cafe09f", "comment": "Malware payload (Mirai)", "value": "ba7eb0726786323dfaa018835852d420e9d62f42", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594873, "uuid": "18c94396-58e5-4dcb-84df-2629582515f8", "comment": "Malware payload (Mirai)", "value": "631c6aa288674f2bd37cc92497f18a70e5de88e04e2d1fde0e0df44fd756543e35b53abc2f31f80aeb4e16764089c2e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594873, "uuid": "c48fb62d-0407-405e-98e3-80c29ac8f40a", "value": "T156D2D024294A3BD4F4B51C37D3BAC1CEB597ABFCC18B7526B0601650BDCA24356B0AC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594873, "uuid": "d3e69ac9-ebb4-4a83-927e-7b57a97fb2d9", "value": "768:vomSnnTLKtK1REzNTsiyag1XQ1dAi7s3Uoz7l:vomeLKtKbTj91A1d6z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594873, "uuid": "178bf76b-e0db-460c-bb1b-231993bc4619", "value": 30948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594873, "uuid": "2a6a7eab-6706-431e-914e-eb6005dba026", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594873, "uuid": "01086bfd-a3c2-4dca-b433-e74fb7783df8", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d00ae987-c55b-11f0-a129-42010a9c0007", "comment": "Malware payload (LummaStealer)", "timestamp": 1763565857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565857, "uuid": "a1e894cf-9874-47e2-a9a6-dd3c8d40c76d", "comment": "Malware payload (LummaStealer)", "value": "0e03b2a62f6af760d31b4a7341d3bea3", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565857, "uuid": "869733b4-4210-4f28-b820-eb33b40c4ab0", "comment": "Malware payload (LummaStealer)", "value": "47633b39ac044e50fd5667ae26c676dfbd215aff8ee28e066a9ed8dc67ae1e56", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565857, "uuid": "d8d4e9b1-f5bd-4e84-872c-8fbfb49589c0", "comment": "Malware payload (LummaStealer)", "value": "91665c3afd2d18832b63fe1c905fd3fbb84bdcca", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565857, "uuid": "2b2e3e15-0291-40e2-9ab9-4df00f8b8a09", "comment": "Malware payload (LummaStealer)", "value": "87e058a825f1e61b51b53652237d809ba8fab55fc41274b392c3edda3ba0f124953d300f902e3b08882993e0b1417573", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565857, "uuid": "5ae1138e-900e-42cb-a6de-3d2e9d782b56", "value": "T12D65231B7BF46095DAB357B298B283534A3039714B6285DF2689C73A6E333C4E935723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565857, "uuid": "b0f86b4d-d0e8-46f3-a261-4f96f41eda33", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565857, "uuid": "4173fffe-d940-4607-b85a-d4bd2c701f15", "value": "24576:Wjey4c7UN3copogWYO7k7OYduftkjFRXc4S98Ya5FZXApmtk5HFR9z/SdtrSBHf/:Wjt4c7Y3ZG7YOw7jd3jbS9balAprb7ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763565857, "uuid": "9683cd82-7bd9-4933-a7aa-8ac5070750c7", "value": 1457320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763565857, "uuid": "352df831-85c7-45e9-9087-ed286d3f5f7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565857, "uuid": "5f14215f-31f8-4b38-8c0f-29338920e0f8", "value": "activate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b16d56-c55d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763566784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566784, "uuid": "29131f2f-3e31-4ea7-80d6-3cc253a48c14", "comment": "Malware payload", "value": "6e81105dc43fa18489f8a9efc0bc9a0a", "object_relation": "md5", "Tag": [ { "name": "dropped-by-NodeLoader", "colour": "#45A975", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "itibanembalagens-com-br", "colour": "#6E5BCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566784, "uuid": "3de0a1dd-b5ee-41ca-a256-fb1ea59eeab1", "comment": "Malware payload", "value": "4777649d5b0b588320a29efac60b61a094388e2b6523b3ad4bf6ec3424aebce2", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-NodeLoader", "colour": "#45A975", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "itibanembalagens-com-br", "colour": "#6E5BCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566784, "uuid": "c48fb785-7f45-4350-8595-a7af94b270a0", "comment": "Malware payload", "value": "d8fc2259441c84f88d6547fa30712aa16e2e25e4", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-NodeLoader", "colour": "#45A975", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "itibanembalagens-com-br", "colour": "#6E5BCC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566784, "uuid": "25690725-d149-429c-a4eb-70b03837760b", "comment": "Malware payload", "value": "46f4e3e010b5c89cc253e50e8d7af9c70292b7fd66a6762a80f6c6b6f8ba54828e668d2683f417b52a08da6feda8b1ef", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-NodeLoader", "colour": "#45A975", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "itibanembalagens-com-br", "colour": "#6E5BCC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566784, "uuid": "120e00b7-aeca-4359-b293-19a5e3172f06", "value": "T1B925FB518A639C25DC7613FA5035D9B952237FA93472D24C84F9BCA3F9F3B83089A583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566784, "uuid": "767e723e-7748-450c-86e0-6dc37c6a3185", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566784, "uuid": "c4c42b7e-49df-469d-abe9-83bca3e95702", "value": "3072:+WhlU9DmCls6gSsmjTk0MqHhO/dqubPBhwbvWDTI:+UU9HlsWsmj62JuLjw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763566784, "uuid": "54e46902-deee-4106-81e3-9a40853aef8a", "value": 981504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763566784, "uuid": "da5d7aa0-45d6-48b9-9e11-a4e5d5bda31b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566784, "uuid": "f2d5b994-13ba-4053-becc-8e7a2d370480", "value": "ludJOtidPXEVLfMdV9cNKIomf4916BHa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afe1d66-c59c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763593470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593470, "uuid": "72bb7f95-b0fe-4ac0-be04-e8ed1efe9a30", "comment": "Malware payload", "value": "b5a1714454cd48768276e53c7e75b42a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593470, "uuid": "97ddc73b-3837-4227-93c8-db15f9c3ae8a", "comment": "Malware payload", "value": "477dde6ac5001c8d32d3f6392cef69219786a38a36c82942dde219210e5bbda8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593470, "uuid": "20eac9c8-6d28-4d32-8b9b-edfaf58f5c01", "comment": "Malware payload", "value": "f488dfa004ff4faa045f7dc648559c3e731e5963", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593470, "uuid": "424de0e2-4fed-447f-8688-72f6ea94fc16", "comment": "Malware payload", "value": "b5706238c80853f4b5a74aa569ceaf8835734e2d3d7f3cb13842e40ca141f07b0350f0d75d5f3b7a2ce91d6796ea28c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593470, "uuid": "65d4cdb5-4fae-4fa6-81c1-c35e5c6451fb", "value": "T1394422B8E1188AFAD44453FB4903004C5FB63FA55ED1B52B4B3985124FBE9B09F4972E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593470, "uuid": "6bd2b650-ebef-4931-9f8b-a2dd4389e9d5", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593470, "uuid": "6503ff92-e02b-4ded-a652-9d38d5b42186", "value": "6144:7vOiUHO3R9pr6Dk1I3VoSXtTkk6K5l6LvvXwV9thxRMs18IcVS+0X:7vOiUHS9d6DiuV/XqvKb6jvXu9tzeSh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763593470, "uuid": "5230be51-cd99-4f33-9fbc-8b2b80d33be3", "value": 278528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763593470, "uuid": "67203a28-c4af-4f74-a45a-286e961ae251", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593470, "uuid": "dd67e5f1-cc5e-4b56-ad19-8055b338d812", "value": "SecuriteInfo.com.Trojan.PWS.Steam.38543.8568.14741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a2b2e66-c570-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763574571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574571, "uuid": "16fdf774-9a80-4f1d-844d-d330e5a5c6b9", "comment": "Malware payload (Mirai)", "value": "e638c435456bcc32e65cdd4a11c17e0c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574571, "uuid": "9f7541ad-83f8-4269-adfc-a0ccd947ab38", "comment": "Malware payload (Mirai)", "value": "479b59dc72d4f7f7cb06ea6a9fb47c4aba4dc3277f087260cd1921c2868cf340", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574571, "uuid": "8931a267-a2f9-425a-be5a-030551d99711", "comment": "Malware payload (Mirai)", "value": "1991ea5fafb73b4885ba950d4150e1cd2d12517e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574571, "uuid": "f61b0f2b-e963-4493-91a2-a00a25d44415", "comment": "Malware payload (Mirai)", "value": "2b87d1d31c22d893650ddd43ad0cf8e55a681427b5f591a1f14a7ff45683b8b495004f5a4442223e045f1f56c7dafb93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574571, "uuid": "990f6883-026c-4726-b7cf-9799f50d82a3", "value": "T145834C41B30C0E43D1A76DB03F3F23C6D3AAAED111B4E648255FB74A91B6E325646E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574571, "uuid": "37b04e7b-a157-48b1-9cf8-b00a19099b70", "value": "1536:cy1npbio6hrjlyMdOEkAN2mJlMiQTM/tI9gafzemwz:c2BidVlyvduJNQk+kz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763574571, "uuid": "3668703a-8a1a-435f-acb5-0829adb0e75d", "value": 83252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763574571, "uuid": "4a54f61a-56b2-405b-9c62-0d88d4bcedfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574571, "uuid": "f636567d-377e-4f24-80a8-0b9d8319323f", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0b8077-c57b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763579540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579540, "uuid": "4b6031ad-e290-409e-866d-6248e6c5920a", "comment": "Malware payload", "value": "407afde349ac5d5663a2e075be0117d9", "object_relation": "md5", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579540, "uuid": "4578ba88-9b91-439e-8193-5a161f0e723e", "comment": "Malware payload", "value": "47a58140dd9bedfc71ff3d169213270864a009276023a761f7bc74e71d70bbb9", "object_relation": "sha256", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579540, "uuid": "f4bea162-d93e-4174-b44c-63aad223f4c4", "comment": "Malware payload", "value": "475e5379983fb271d9f85c630310706936b5b2f4", "object_relation": "sha1", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579540, "uuid": "c71b91aa-83e5-4ef7-839b-44b247dde029", "comment": "Malware payload", "value": "111791f5c4e5eab890d1ac2d8abc0a9808c65f8589638cd15fa10a56232fdecc494e96079f79655a640e403346d05ee0", "object_relation": "sha3-384", "Tag": [ { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579540, "uuid": "e702d31b-1700-484b-a044-a28087b570ad", "value": "T17CD0A778D681D00ED673BD3BBC50BD21A80DBE5B08C3BAC814A2D84B18D11F6A0547DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579540, "uuid": "e65f0117-6e8a-436a-ab81-66ae19555fe7", "value": "6:HRYFVmiTQWNTzsiATky5UAaiATaKBBArSDxDXtx1GE54vVG/4xHy:HRYFVmwQWNiTkCATlBBArSlXtqfVW4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763579540, "uuid": "d4201c71-9433-4ace-9602-7ac2d279b118", "value": 251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763579540, "uuid": "283deeee-77e8-40ac-9cb6-32833d2a6497", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579540, "uuid": "59eca8f9-a261-4e4d-bdaf-936c8aec68e8", "value": "Tax_Documents.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77dd74c7-c558-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763564420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564420, "uuid": "2c026c9c-0f6b-41ab-a803-8355a0a9e1ee", "comment": "Malware payload (Vidar)", "value": "e00a71c5775dfe53818aeeb733c6f6ed", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564420, "uuid": "9cdca5ff-1c6b-4273-b91a-f62c53102ce6", "comment": "Malware payload (Vidar)", "value": "47d7c773c88f5119c41b22fcb4318860bdd1c331fb0d5b1fae5a2023fa02cd3f", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564420, "uuid": "4b992132-e5f7-47e7-9497-774d7ed1551b", "comment": "Malware payload (Vidar)", "value": "6b9bd5803b97feef7a4815be4db4b8c8e8c385a8", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564420, "uuid": "2b52200a-29eb-4f7f-8e25-1953d9b3983b", "comment": "Malware payload (Vidar)", "value": "103fdc1b40cc0e1ca631586f0381111fcfa2a9bc781032caa14021b367b43bca1958a9de6c5dd46e86b7fff2387bc12b", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564420, "uuid": "b54a80be-9c1e-4593-a8f2-51aa33361e9e", "value": "T1BE95230663D43169DA7BD3709AF123838A70BC71176946FF33D6C5398E32B90A931B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564420, "uuid": "86a17ec4-bd9b-4e30-84d8-03b69e61d160", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564420, "uuid": "20efe5b4-ec4c-4a54-8c50-4889bb5b507e", "value": "49152:CjGaee5R/PPdTXZ6YJEx/isXpdRmvWoHpaa6lk8ifYbz:jevfdTELpHmOoHpaa6lk8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763564420, "uuid": "56add8b6-69cb-4a76-89dc-07f69bf1f7bf", "value": 1915312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763564420, "uuid": "38df98df-47bc-4a76-a2c8-be64d68cb169", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564420, "uuid": "e995895c-1938-4395-92b7-369cc5476f5e", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152dd107-c55a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763565114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565114, "uuid": "a88b318b-2136-4910-8c69-242ef378d1b8", "comment": "Malware payload", "value": "2f26eaab12cf68ab71383f77d38e43b4", "object_relation": "md5", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565114, "uuid": "38f2a3e3-9af9-4045-9bab-13d78de2a8b5", "comment": "Malware payload", "value": "485ca14719f8635c4aecca238e167d338bfad7aaba3187c1c6216dba776146f7", "object_relation": "sha256", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565114, "uuid": "18f41f45-7e41-4a92-9f31-a3679a57e3de", "comment": "Malware payload", "value": "81b893c9aa2573fec58ba3125009dfcef043b716", "object_relation": "sha1", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565114, "uuid": "df3b181c-73e9-4e95-a525-1829bf29150d", "comment": "Malware payload", "value": "9def1c45cf63619dcc6af24b1b674d7f7de53cc5507a18215d4bb02a4c1d3e367ae985109119cfa4f4c509cfb9f451d3", "object_relation": "sha3-384", "Tag": [ { "name": "SmartApeSG", "colour": "#C06213", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565114, "uuid": "b86bcfe4-4e76-4791-9485-743d2b826494", "value": "T1A4A7335CBB72218BFD9DA13FFB227EE654A4C1789FB125410F81A022D3A2FC9E751611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565114, "uuid": "0f0d61fc-20cf-47a6-a7ca-844c2298b12a", "value": "786432:UOMG95lz4QK2rbubBlVgrsDG96dXH0FPIhVTjWBQbCJa4EmvIxDo8cepLQ00K6XM:dMG95mQKfgrsyqUIRjWBQezA1o8jpLQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763565114, "uuid": "f36a0062-e5d9-4585-845d-39390e21705e", "value": 45521738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763565114, "uuid": "4d1cdd46-4c4b-456d-abd3-2496d94d9d7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565114, "uuid": "6c88c884-0b25-43c2-a0bd-8148fefc20d0", "value": "sdjkkxx.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a28e1552-c576-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1763577377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577377, "uuid": "7a008ef1-0c0d-4bdc-97d3-bbf3c4e59067", "comment": "Malware payload (N-able)", "value": "0750224e9170850f8008afb86cc4cbee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577377, "uuid": "b382026a-74cf-4210-8dc4-82608b16e2c9", "comment": "Malware payload (N-able)", "value": "4ace76561057cc02fee5fd71f70a834492f76e850699008f1ac2473a2847e837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577377, "uuid": "4ea9c42a-cb93-4da5-b95d-2915754a2a43", "comment": "Malware payload (N-able)", "value": "f8e406cf073eb3bc11645e3f3d4a94dd209119c7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577377, "uuid": "3708c41e-668f-4ba8-aca1-fc444190acac", "comment": "Malware payload (N-able)", "value": "25c59a1eda3bcb20cce7fbd90a3adb20ab216d0e341f0e79efd901f7198460da7c3483c9f9b1537ebb81cd3b64768bc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577377, "uuid": "821308c6-85b0-4908-831e-0a857ec31754", "value": "T1D5E633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577377, "uuid": "e1fc6652-a96a-404f-8015-e2c726ad1315", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577377, "uuid": "0e27725e-1498-40e9-9c15-be0f121f8de6", "value": "393216:b0F/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1O:srRxvoC/7a0jUxX7h1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577377, "uuid": "47e45bbc-f9c3-4a43-a18d-e691707bd29c", "value": 14781992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577377, "uuid": "77a79050-422d-484b-bbeb-2a31abc0774c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577377, "uuid": "002a3f7a-ed60-4d03-b6f4-3587991645fb", "value": "FILES098767878787876534536738AGENT_468117_V10_14_4_RW.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892dbf7c-c4e9-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1763516775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763516775, "uuid": "2fdc3aaf-e542-4231-84b8-4630aeae8da4", "comment": "Malware payload (PureLogsStealer)", "value": "29e0018c54595d7b81c292bc3c206a56", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763516775, "uuid": "b47eb753-93f7-49fa-afa9-e55bbb91550e", "comment": "Malware payload (PureLogsStealer)", "value": "4b539a573c022b9076c26f3a581bbf7d9867e597193148855730134fb2877e88", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763516775, "uuid": "40437181-1359-4920-8db5-afa2196de3d2", "comment": "Malware payload (PureLogsStealer)", "value": "491a6adcf442b85432997cfd201d70f04b3de26d", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763516775, "uuid": "875abb67-ae92-458e-98c9-c616a77dc4be", "comment": "Malware payload (PureLogsStealer)", "value": "5f7c51284d416c08f3ea083bc218894848a042c89c62a17ba0f41b0727060e196a1021a0607a9a9fdbbb6f903fb99898", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763516775, "uuid": "906c367f-388f-4eff-b993-7f0bdefb7f91", "value": "T117F57D072CC148B9E099F23588B761A77B74BC080731A7D32E51AF785E73BD12AB6395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763516775, "uuid": "bc900324-8bdc-4140-952b-6ec25f88e911", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763516775, "uuid": "a704269e-5610-4dec-9f7c-63ccbe408f59", "value": "49152:+Q1+r47VoT8kiCycETgzOGIvog+k/oBXs:+9bycE0ztk/Es", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763516775, "uuid": "64546383-654f-4db5-be18-9aaf4d60dcf1", "value": 3475592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763516775, "uuid": "e49765ab-b233-475b-b965-f944900ff6b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763516775, "uuid": "28dc4778-d4e2-4f3e-aa8e-a65771ffa91f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f848a7-c4e7-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1763515807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763515807, "uuid": "5e2af0d4-02df-451c-95ee-d32b03f42fd8", "comment": "Malware payload (SnakeKeylogger)", "value": "6373654f6b3afd25cd3eaace5b958d56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763515807, "uuid": "e257cd69-e27a-4757-85bc-0f0a012d3dce", "comment": "Malware payload (SnakeKeylogger)", "value": "4bc7c3ee641390b78c356aef216d987fa7eba48192678f73048561762b11a5a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763515807, "uuid": "51e25beb-79c5-4d4d-a500-76a84510de3c", "comment": "Malware payload (SnakeKeylogger)", "value": "02566a10c7c2172749bd84d685cf28a15206647b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763515807, "uuid": "d97926ea-5cac-42de-89b6-bb0160ef424f", "comment": "Malware payload (SnakeKeylogger)", "value": "95f8ae1d1d3823c3cb54e30396a73aa0850539c249f4c9fd6ed4a43d63b7c7ef54b53f282c7bebd2f08c86993a21b320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763515807, "uuid": "a1484fb7-c438-4f39-9a5b-56bdb7106868", "value": "T17AF41254226AEF13C0930BF41970E2B067B9ADC9A022D6175FEA3EDFFD16B850945393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763515807, "uuid": "1243862e-ea0c-4b96-9d13-b4f6c549da7d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763515807, "uuid": "adab7481-54db-42be-a3db-f61bfd887092", "value": "12288:LRWJfRec0YijDDOvJoRyl4b2kYokZy3/v1lr7YqDAcwsjGpt5W0LtBAKbbctSwUg:epGjDgJVG/YVZyvvnYqusARjbXwUDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763515807, "uuid": "7efb0d11-aa35-45df-8784-3462ffa3d514", "value": 772096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763515807, "uuid": "4cec9758-13ec-4483-b322-bdb7efd8b9b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763515807, "uuid": "76b5b3a6-d07c-41ce-9fdc-db27bc56f8c0", "value": "rRequestforQuotationMKFMHSRFQ251119.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0f1066-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589716, "uuid": "5d548bad-effa-47db-9d43-2890c05753ec", "comment": "Malware payload (Mirai)", "value": "7619e689891bb18e39abe0142a7d2900", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589716, "uuid": "801f717d-ca54-4794-b14e-9b26ab79878a", "comment": "Malware payload (Mirai)", "value": "4d4e8d719306083b2e363997de327259bc94a9309224615c7d6a95a6ed4fbfb6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589716, "uuid": "0fd4abab-8745-4ac1-b447-5fc1db43197b", "comment": "Malware payload (Mirai)", "value": "a2da5d8dbaf852b973a44eab6bf1bc23ed845d0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589716, "uuid": "ece0c0f7-c830-4cd8-8988-c5035382f219", "comment": "Malware payload (Mirai)", "value": "f6756dc20ceeb20a694addfa4f85aeeab8589a34cbe9bee011300a02fc6935ba834a2673a5ee0b2d0ca60525dbef99c4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589716, "uuid": "839685b9-171d-4992-a7b6-ede4835fdbf3", "value": "T13F6302B3ED5324426AB00D33E5695186DDD997FB817EE9172B218D04ADE10438AFF28B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589716, "uuid": "201bfb02-8501-4cbc-a7ba-2916411bc48d", "value": "1536:+UAqghn4tRPQNojltJOkD+hG52FqWI7RmG+DLUyJRZKa+Wycz:+lh4TPQNoTEVhw2kVQLUsxjz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589716, "uuid": "ec32ead9-21e7-4fce-8ced-a6e32cff71e4", "value": 73024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589716, "uuid": "f78675d0-be3b-4190-9ab2-0b3a641a2c2a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589716, "uuid": "0cf7dc54-876b-4912-9340-80bf3c73303a", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957750be-c575-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1763576925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576925, "uuid": "8309aaaf-83f1-4d64-a132-074f07f7d1a2", "comment": "Malware payload (AgentTesla)", "value": "d64144b18c05605b56472720640a2acd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576925, "uuid": "3914bda7-8d50-4f8c-b584-7b46f4699665", "comment": "Malware payload (AgentTesla)", "value": "4d9923f7e2cb1f9cfde7b6f4e426dba6fff5570ac61d3b78b60defaa866dde13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576925, "uuid": "45dd4aaa-f07f-47c6-b6f7-1b4b02e7cbde", "comment": "Malware payload (AgentTesla)", "value": "54dcf77e324c57a3c0e0af93046d0830f3f561f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576925, "uuid": "ec63d1fa-e91b-4365-8e17-b6dcb6f91fa2", "comment": "Malware payload (AgentTesla)", "value": "e9186ac35e593d120861a5f64bb888138894e3fef5845b893935d5f7f1f58e49b2df7d8af98ce7cd4db6288e4a5c5436", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576925, "uuid": "5779a2b8-aa67-46cd-a9d6-f522b6083cdb", "value": "T1BB4502158DD82FB8DFA8591C50FE160EE3F0164B5466758ABB37BD46AFFB604020F189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576925, "uuid": "93cf8c10-9725-4f31-9f01-90d89a11b4f2", "value": "24576:akrbIMNKflKLeJixBO3CMHtbPGLUVS9JrCeHsgPAurUTw:DcMNK0L0iLYiH4eHsgYQr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763576925, "uuid": "8c3090f1-a10e-47dc-8977-d1c1bbaaa4e3", "value": 1241780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763576925, "uuid": "8e3fda2d-ff2e-465b-a403-5fc3eb7f8b0f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576925, "uuid": "818ab384-4982-4a39-bfc3-64e2e8389aca", "value": "25102466TLXHBL.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c742110-c517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763536564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536564, "uuid": "db00e21e-fa96-4875-95ac-ca0a5f7ec78b", "comment": "Malware payload", "value": "715781bb6ca48ca1372b7615fdb5d039", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536564, "uuid": "70c9b64e-bcb3-4fdb-8c59-437999e4cae4", "comment": "Malware payload", "value": "4de47d8a15aae4aa5333c99cca6908a81e9a3e0a0157882a278a6ccaa756980c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536564, "uuid": "244c1d14-481d-47dd-be7c-79bc0c176b34", "comment": "Malware payload", "value": "cfcd17d2aa4ae8506065738dd93c9f38e01d9833", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536564, "uuid": "7b8f5efa-7598-4ce0-9f3a-05caeb773e89", "comment": "Malware payload", "value": "7fea730e5ddde684839c31dfa19c31c5267d8647e5a5bd7cd6334a53990a19c289dcf6e98ca21894418d39ccc3cbace5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536564, "uuid": "a11bc6e3-3265-461f-9c51-4fe2f324271a", "value": "T1B326F19BF708A92FC87B14F246AE523152574D178A83DB436C44361C68B76D83F9EBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536564, "uuid": "ed17bc21-277b-49ca-9f38-3492ae6cb760", "value": "98304:34FP2pbk342TQsuj/yZOPX47qj4TeFdB26ccEUUify2SEgLCr4lR:34poWUsujKZuI7qMTk2JrNoy2oR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763536564, "uuid": "6caa6e00-9538-4d45-8807-b137a655d65e", "value": 4858390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763536564, "uuid": "32311e0b-e4f8-476f-bc34-05c9bffeeb23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536564, "uuid": "079ea3d2-89b3-4239-9a54-ca1bc9d69861", "value": "sapu4d_1.0.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25305981-c51e-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763539371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539371, "uuid": "d7762754-6e6e-4363-ad2d-f8c841bb4f31", "comment": "Malware payload (Formbook)", "value": "51aca412ef605a3e3d9f28ce40c16951", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539371, "uuid": "bb0e5cdd-8ce5-4036-b9c7-929b367f6870", "comment": "Malware payload (Formbook)", "value": "4e830eaa9a4e343d1e2d437ff678fc7e884bee9139807389db70e3cea3cc9770", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539371, "uuid": "83e1195f-5edd-442e-a37f-9e218e5c80c8", "comment": "Malware payload (Formbook)", "value": "6d51d602553f0244588bded13c59b3a05d707b7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539371, "uuid": "1b8daf30-9899-4cf2-b56c-15adeb74e247", "comment": "Malware payload (Formbook)", "value": "44175884553863e78f5313cdce89af1cc3f18c0a291b2988b337210ab8a9375ba198935e76d71de80b3b78c3c7aead6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539371, "uuid": "4c13870b-8f36-4819-9271-740fbbf69664", "value": "T111E42260A9D4CCB2E6913370C17ADE851A797F32CD852FAE4795F20E74B13036986B2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539371, "uuid": "d1855357-98d1-4a8e-a532-063e6e5c9c15", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539371, "uuid": "21df4931-30d5-477d-8850-a360489d7f10", "value": "12288:5Ov5jKhsfoPA+yeVKUCUxP4C902bdRtJJPiLlFUgMdz3vdxdvEIAzh8hD4:5q5TfcdHj4fmbYUgqvdxjAzh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763539371, "uuid": "f4c00032-5638-4352-b665-0be33b48b2fd", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763539371, "uuid": "699cfeab-c73d-4109-abea-f1ec716ee1b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539371, "uuid": "54a6d8bd-bdcd-48f5-bdd8-1da5cb0157e5", "value": "BANK SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d005f92-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589769, "uuid": "b045d650-c1c8-4970-85fb-8d39d53a72f1", "comment": "Malware payload (Mirai)", "value": "be1f54d9e87f372eec9d160888b83897", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589769, "uuid": "4de717d8-919e-4192-b48e-26854474be1c", "comment": "Malware payload (Mirai)", "value": "4eb8b301805b7fbf62b8e15ef363753cc31f3b304c4fb98b74f14bf9571913ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589769, "uuid": "a04b9c4b-a65e-4d60-b383-a3ce7507b70e", "comment": "Malware payload (Mirai)", "value": "9df4d0deb3bf333c9846025b09932fd0b7da7841", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589769, "uuid": "af91fcf7-4021-458d-adc7-912340f6aab6", "comment": "Malware payload (Mirai)", "value": "c52a75ecb25d709c9d7b3aad168a650b3f683071ad13db87608067de44e7abaf22f7dbdfe56a33a601904ce8de0a3aaa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589769, "uuid": "4eb0794d-ae82-43d5-b33d-77a1215b5306", "value": "T1B9C31946F9828A22C5D713BEF92E118E331357B8E3DE72229E105F2573C661B0DBB945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589769, "uuid": "488faa22-29fe-473c-b792-7f2bd035bfc7", "value": "3072:vgEcXParsxIImPN7T+aJFTpchKORtrF9URE:vgEcXirsx/WN76aL4KORH9URE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589769, "uuid": "a3d5bf24-66c8-4e71-af72-0326d9a6a795", "value": 124384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589769, "uuid": "f4b69069-349c-426d-8625-5595723980d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589769, "uuid": "b2e5b2db-95f1-4902-bc92-7cbf736c5ede", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbcf759-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594921, "uuid": "73dafe33-6c0a-4aa5-8ce4-05b16ed4581a", "comment": "Malware payload (Mirai)", "value": "e2013448c288a992f9ae39ed6d8f32d6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594921, "uuid": "f3cea424-f8c5-47cb-89b6-d1a51f9dd599", "comment": "Malware payload (Mirai)", "value": "5024346ae3346f9c218c3969c011a91e2a23b857d77061977cb3484bc2c5ace3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594921, "uuid": "bbded09f-04ad-4ff6-92ec-2352a873327c", "comment": "Malware payload (Mirai)", "value": "743f9cd44fed1cce53df52eb16af2bd42eb4ba5e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594921, "uuid": "add26b4c-7252-43a8-b98b-ba21093cd961", "comment": "Malware payload (Mirai)", "value": "62f7c7b8cf17266365b0062e96b2a01c3873d6ac2b828cc55b5a1d817bca1d807417b804dd6c5cb08c2353e7d98d36ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594921, "uuid": "b60fa54e-0121-4c22-89f6-9232fde0407a", "value": "T1DBC33A81F8C28A62D6D723BAFA6E128E332263E4D3DE7103DE256F11378651F0D67951", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594921, "uuid": "135c5dd0-ee62-49e4-a4c1-8666d22eb34a", "value": "1536:qwasAH3EkMW29wxhAH1BflYHfrewTvA+6KscEktRNqv4JX6s0NR98voR:na/3ED9/qTvrEsRNnJ6yoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594921, "uuid": "c971947d-7ade-410f-96c3-a9f3778e6bf0", "value": 120300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594921, "uuid": "7aff4c03-64d3-4405-abe3-5631c7a222bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594921, "uuid": "a9e18d6e-247d-4a1c-8d45-237e651fe54b", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b12c8c-c575-11f0-a129-42010a9c0007", "comment": "Malware payload (AgentTesla)", "timestamp": 1763576974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576974, "uuid": "75d47fff-d028-4902-9e48-7a2438b5d722", "comment": "Malware payload (AgentTesla)", "value": "dea974d4fd45a036ea5114230ed4c1fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576974, "uuid": "66f0196c-59aa-48cf-96e1-2e0b0197b61e", "comment": "Malware payload (AgentTesla)", "value": "50893d013ca4d67187da12c1e367bbee09dba6fced51addffff9a8ba4b824a71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576974, "uuid": "05c387fd-062c-411f-9450-243f9bc7a9bf", "comment": "Malware payload (AgentTesla)", "value": "91f6c34f2598d16c5b2dc568a868e45d032c87a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576974, "uuid": "59b2ad68-f64f-4976-aec0-605df0dfddbc", "comment": "Malware payload (AgentTesla)", "value": "53a48f34d160a77f832e9e5ffbd2de40a98968a6e57eb1d959bd5e47be4ea38dc3fda05f2ae79571cc896a1616eb092b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576974, "uuid": "67cfa41b-f8ed-4f46-b1f7-5cd2d82ffb2d", "value": "T14145F1118D882FB4CFA8991880FE171EE3F0568F4467798ABB7B7D469FF7644010A2D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576974, "uuid": "1aad7e73-ab5c-48b6-a382-1076d381c0be", "value": "12288:4fqg7ddRoB+xwEUOx2H/KAymk3s2LiI1Iur0zkGsZeoscx9vEak6IfjOcvI5sIe1:zqR8u4CV3aS0wZhYakdjw5sR0pVAFjx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763576974, "uuid": "0265cd55-965a-498c-a843-5ecb27953375", "value": 1241808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763576974, "uuid": "0b1fbab8-b4d6-4ace-8ed8-53ab91b6c943", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576974, "uuid": "600c99ff-6483-4da0-a512-e21e658793db", "value": "SAREGRH54657777786576.VBE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2630cb4-c4ec-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763518240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763518240, "uuid": "737c866c-c0c9-46ce-bf98-e412b7467725", "comment": "Malware payload", "value": "823494bbd37b98f34bde297fc074dc45", "object_relation": "md5", "Tag": [ { "name": "base32", "colour": "#30BCBF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "telegram-c2", "colour": "#4D7F84", "exportable": true, "hide_tag": false }, { "name": "xor-obfuscated", "colour": "#C3D650", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763518240, "uuid": "934647df-112a-4e85-8da9-eecaa3a4c995", "comment": "Malware payload", "value": "513e56b371265091284bc32a2054d6a28cfdc02be980446130d57c906ab1646c", "object_relation": "sha256", "Tag": [ { "name": "base32", "colour": "#30BCBF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "telegram-c2", "colour": "#4D7F84", "exportable": true, "hide_tag": false }, { "name": "xor-obfuscated", "colour": "#C3D650", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763518240, "uuid": "89f036c3-3a7e-408d-b344-6b73c48eb147", "comment": "Malware payload", "value": "ab145d116ada37c96d5de3124f78957af5714e86", "object_relation": "sha1", "Tag": [ { "name": "base32", "colour": "#30BCBF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "telegram-c2", "colour": "#4D7F84", "exportable": true, "hide_tag": false }, { "name": "xor-obfuscated", "colour": "#C3D650", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763518240, "uuid": "8599d491-6bc0-48f2-8472-768e737e9ad2", "comment": "Malware payload", "value": "756c84e9a87b61b1f317d71bd0031ec2452b4dc63ee72fa7cdfc05c5c7e1cf94978d043a98f80ae0078ec9b7089790b0", "object_relation": "sha3-384", "Tag": [ { "name": "base32", "colour": "#30BCBF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "telegram-c2", "colour": "#4D7F84", "exportable": true, "hide_tag": false }, { "name": "xor-obfuscated", "colour": "#C3D650", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763518240, "uuid": "077fc8bf-0446-4d61-abbf-af811a4373f4", "value": "T1DAA3293F86422B5D4636CFE8DB922114FF62D09F931B6265BECC5E529FB9C009412F98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763518240, "uuid": "8a97e299-ad2c-4277-b865-2e3ebbcc2fb5", "value": "1536:AmbLD2JYtglBgHHNr4hdudTTa8J0ld/Zn:A8PfmlZX0y8Kld5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763518240, "uuid": "61e096c5-b1e0-44cd-96a7-9dd3db0f916b", "value": 105245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763518240, "uuid": "894d1fa1-f9e0-44a5-808d-76fa96963602", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763518240, "uuid": "9273a2a7-ddca-4efb-87dc-9ed75b20bdd4", "value": "wl.g-582191.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbeb602-c547-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763557051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763557051, "uuid": "321e804f-8b67-4869-a6f2-83df12a0a83a", "comment": "Malware payload", "value": "e9de4f805e32e8e11b681446c57e6cad", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763557051, "uuid": "66570ff9-23c7-48d2-a61d-25239a670e0b", "comment": "Malware payload", "value": "525bf6a085b396a7a086e56aa4b0230e1ae6918c87e977c3c9392e7f7ab4dc3c", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763557051, "uuid": "7f85baff-6874-4638-a02e-5e120782cb6e", "comment": "Malware payload", "value": "5865e17e3ec6991fb3678a541768227fc945500c", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763557051, "uuid": "c63387a7-72b3-45a9-846c-8997a1ddea17", "comment": "Malware payload", "value": "69c9591452767f1ab595ed52ae391a062a3e057e8d5896f3370adfcd73281e4948f587274fe30da7fad863f985484860", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763557051, "uuid": "846f5598-1805-4281-9bdd-006b8150e88e", "value": "T108E026798EA12517C0C028B06070BB9656E8C4A08987C2521147A28B09A36E28E09B06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763557051, "uuid": "3442f578-e553-4c5c-9bf5-35ad56b27cc5", "value": "6:5j3DA7ILgIdkC/aCeQXBEVwGiV4VSosu33ViAot+lC1/:5j3cMkmkCCCeQuguHhotaE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763557051, "uuid": "74d88532-7c32-46e5-aec9-ee0dbe68c5bc", "value": 345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763557051, "uuid": "f2c85007-93d8-4310-b92d-1021cf22d9a3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763557051, "uuid": "f07895aa-e0ea-4ffb-86f6-738822b254ac", "value": "Invoice46839.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c79ef89-c56e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763573743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763573743, "uuid": "59715154-9efe-4058-9542-c840907b0be8", "comment": "Malware payload (Mirai)", "value": "b6cde4459b9bd6cedc974978e7bbd771", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763573743, "uuid": "e99c0718-bbe0-4b1e-b8f8-54a675ac06ba", "comment": "Malware payload (Mirai)", "value": "5280f96c442ec0c21c24f5ab5355da8969559f18c1840cc74338ed3be9ba15da", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763573743, "uuid": "3dcad88d-eeb4-42bc-a482-0c1d1a846148", "comment": "Malware payload (Mirai)", "value": "8330a1ff152f3737036c36795abf0a3c6381e3a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763573743, "uuid": "bac02dca-20a2-4232-b4a3-5ac823aee2a6", "comment": "Malware payload (Mirai)", "value": "3ad549385b6cf0771cd367268bbb8ccc082d9a9242ce31f9c4c791250c19b7474494b44e92b4538613a5272936cf7d35", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763573743, "uuid": "45bb5b59-45e4-4ad5-9f20-3d77e6c39557", "value": "T12CA3185AF9819B11D9D522BBFE1E018D33531BACE3EE72129D209F2477CA91B0E7B501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763573743, "uuid": "187c9ed6-9848-428c-94fb-0bdcba15569a", "value": "3072:W8ZkU1nxHtGqJwlwExAyOaFDL866oZHuAsV2jWugG:WqkU1xHtGqJwl3x1OaFDL866oRuUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763573743, "uuid": "4d3757a3-aa30-4756-aa93-90c1b58e9b15", "value": 102912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763573743, "uuid": "5692c099-2a30-48f7-89dd-72bba9a3896a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763573743, "uuid": "d7f252e1-0662-4cbe-9c39-0e97c1521595", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cfa339-c57b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763579349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579349, "uuid": "d37c3a47-ee49-40e4-983f-3ee6f2a1b417", "comment": "Malware payload", "value": "d6e22e721c0c93c299ab53eedb9f94e4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579349, "uuid": "cceeb21d-c40c-48da-b1f2-3d8f525a111a", "comment": "Malware payload", "value": "52ae2bd23355fe6588ea888661de66d5a7f97802925706d7d0bcce544c8157a2", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579349, "uuid": "1bcebf59-ee68-455b-aca9-219008d8a0b4", "comment": "Malware payload", "value": "da1349fd87272832a4ec5cec2e97f2ee86fb1943", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579349, "uuid": "0fd989c6-9e76-4b84-8d52-437fe3a23d0d", "comment": "Malware payload", "value": "76546f7cee7e7a72eb7e97458d7d77f9f56be0eb6579e24db1f20d545685d92e02f989b4486160e9a586c14d583e1ef7", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "UKR", "colour": "#5E818E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579349, "uuid": "26afba1e-5eca-4985-919a-ea8903e01b1f", "value": "T1A8E0E7750303461057DC436D5419AD2A24707C0FC0567CD4F4C1A48C54DB382B7F446D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579349, "uuid": "13bc6a28-8038-44d0-a041-48e584b907dc", "value": "6:s8GFPoSkaRvTihcWgG5efxTRQdWNYLkd8Y2F09uLgyKBM3S1R+jsbywFHhW6MFW:s8d5xAfj8/kd8v0oLgyaIS1IobDFHhNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763579349, "uuid": "ce4f7792-09da-496f-8b3e-9ae05d1a42a2", "value": 303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763579349, "uuid": "f411f632-a0bc-477c-a096-db6ae042355a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579349, "uuid": "43481b2c-47b0-4909-8fb4-7f1db47d1c17", "value": "t.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f224fd9-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589719, "uuid": "7dea86df-e5a7-411c-a589-3fbb59f45d9e", "comment": "Malware payload (Mirai)", "value": "0d7452c42486d228ff7caf1c271b8bd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589719, "uuid": "defd58f9-6b59-41a3-b5eb-d3a3e77673b9", "comment": "Malware payload (Mirai)", "value": "53615a4af4790950949ac8f23efef5cb59e337f45aec153bfd04300b0217d9e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589719, "uuid": "ece954e3-adac-4e1e-918f-e724c95344d1", "comment": "Malware payload (Mirai)", "value": "54b585be6dcf9f8d8fab2b1e7927ff52d20ceb7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589719, "uuid": "60620a52-990d-452c-a5c6-db3b0d7f1ac3", "comment": "Malware payload (Mirai)", "value": "625f7a9418c86af1dd632a6255ddcfc60f5b82556f714bf3f9ffdb9f692bdb941e6127fbbb1414a4c4cd485eff2f6f5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589719, "uuid": "7f1ac1c2-1f41-45ca-a5e5-a3beef6ca40b", "value": "T11A23E1AC171148BACA0FD2772BD20FA52FB80FF0D1C3AC82A576ABB75F518562052CD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589719, "uuid": "b5efa389-1d91-47e1-ad16-b5bb2c5afc6e", "value": "768:Mu4POh+nKiTMJAZP6LZgiPmiQJxVXQcO8RTJXL2gvzjg5Ew4fX9luTKqJgGlzDp4:32Oh+KiTMrZvOxtVRTBbXg2zfNlWKOVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589719, "uuid": "341f6424-c24b-46ed-aada-48949cdaf8cd", "value": 48488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589719, "uuid": "aa21d908-a04a-4d3a-824d-709b33b19bf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589719, "uuid": "19e34a91-e756-4942-b7a2-00f8c8e6d904", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989c6cd9-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589815, "uuid": "5f8d7928-0d9f-4c52-b265-aeb30347ec61", "comment": "Malware payload (Mirai)", "value": "45029795478da3f6028006349fbe1eb8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589815, "uuid": "072d6f03-c85f-4b19-865c-b095a4c428e4", "comment": "Malware payload (Mirai)", "value": "53ff3a065acf408af72e4ecde75e2ec2e573215aec66f95953c035c600979c1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589815, "uuid": "8fa9e9b6-939c-4819-ab91-3f2f79a50574", "comment": "Malware payload (Mirai)", "value": "4c52afb5024d93b8880e16b0c13f735adfdf2e5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589815, "uuid": "0338413e-8a23-4a39-b325-789b53d0a096", "comment": "Malware payload (Mirai)", "value": "15a6043c8452053392866871c91c5b03657b5a4251e3618aa61685f02367a05459be5ea11311f16950047d5753790864", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589815, "uuid": "7cf032e9-d71e-48ef-870f-93cff2097c2d", "value": "T152B34A03B9C28DFDC049C038437EB536D925F0EE1739B29B67E5EE266D0EEA00B19955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589815, "uuid": "bcbb53db-df15-4265-a585-0b7cf21aef12", "value": "3072:5Ku4lbmjzXIei+vgQetq05ELlCvTjiu+9QOGNOGoy:5Ku4FmvXIei+vgQetHbjOd1hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589815, "uuid": "3f2ba8b7-62ee-42f5-af06-eaa48f97b647", "value": 110000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589815, "uuid": "789ac31e-0127-46c6-85d0-9de93bb149a7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589815, "uuid": "659a1f61-527d-484f-815c-f324998f7ab8", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99cc4aa4-c55b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763565766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565766, "uuid": "1cabe8d6-7506-4158-b4a8-03096ef83417", "comment": "Malware payload", "value": "7ce0eae4db7930357dbdf9a34febfef4", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ywskxh-com", "colour": "#9CF688", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565766, "uuid": "64d402ca-fd8e-492b-957b-27ee35d19b4e", "comment": "Malware payload", "value": "53ff790216740e6a8d4a18f93bb258dd42905ed40800f6e797d4a22105cf5b37", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ywskxh-com", "colour": "#9CF688", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565766, "uuid": "25642899-f7df-4585-a7cf-60f3403cff1b", "comment": "Malware payload", "value": "b1ec488404c04e6fa8778be81a810bf25e950c38", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ywskxh-com", "colour": "#9CF688", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565766, "uuid": "eda5c078-9567-4ef0-8887-d43d2f8e974e", "comment": "Malware payload", "value": "d3497450e91ba984b6fa77bf2931a9adb50b21ec1e2465e8232c7f36946dd53aea68acd83192303bb65f022a9e04bb27", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ywskxh-com", "colour": "#9CF688", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565766, "uuid": "b3ad2b22-e608-421f-b055-4f5565570f3e", "value": "T10806BF527F580C2AF01B82304948E674F6EF6DB31F36029F9598FE19A9336D16E1C46B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565766, "uuid": "ad36e567-b273-4ecb-8cfb-83bbba126a68", "value": "e67a4cc30d75d56bde8457a7644f80a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565766, "uuid": "7e4f9482-bc97-4e67-8d23-d380d326bef2", "value": "98304:N2kU18TRdsgJQPFcgTz+iq+mH74bm24OiZrq1DfPHNADtV6v+Z:jU14RCaUFc7D74bm24O7NADtV6v+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763565766, "uuid": "0fbcef50-3c25-4ae2-9c33-fd89b0956223", "value": 3711480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763565766, "uuid": "68366080-4bb4-4b9c-8a93-8add3de56b6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565766, "uuid": "ff8d045a-3680-44c6-aefb-02d944a4ccd4", "value": "AutoRecoverDat.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a97662-c58d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763587289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763587289, "uuid": "36e6e7cc-dc51-4b6e-844b-afb1afb60037", "comment": "Malware payload (Mirai)", "value": "ae901720c5b0197cf8538a5b1632a044", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763587289, "uuid": "e8fdc25b-fa17-4f33-ad7b-b5d16595f84e", "comment": "Malware payload (Mirai)", "value": "544b46674bf46e725e509f1965353246ceb5096a22abe96dc39639750ad2e269", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763587289, "uuid": "007f33f1-945c-48fc-ab77-78b61a7a70c5", "comment": "Malware payload (Mirai)", "value": "7179a405167d9d3da7d1528c84900365dc0af452", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763587289, "uuid": "57f63df0-1589-4988-b804-07971eefb60e", "comment": "Malware payload (Mirai)", "value": "bb9f2644270eeb7e7ffa2f307ec8ac8872065683a631f46c10abb4d667e3b06a23788f493b67acc09a476c7565e3c4a4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763587289, "uuid": "d50585be-e435-4224-b659-def58d76d42e", "value": "T1B4935CC8F283D5F9D88600B12037AF32DB32B1B5211AEA47D3AD5933FD51515DA0AB9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763587289, "uuid": "19e32414-9a5d-4f14-b6f2-40475308a8d4", "value": "1536:A25OoXFQIMFi74h/PSLWWxxbfM/wQwvq0KoSGm77eLbSt8yN/R:A25OoVdyCt9DQUq/1H77gbSt8yN/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763587289, "uuid": "7790b6cd-aa8d-4abd-a06a-1378eb2d072a", "value": 95404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763587289, "uuid": "61ce89ec-c98f-4a23-a7aa-48d45196ccf0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763587289, "uuid": "a2dee71e-440d-4f89-abb5-a852d7919660", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4158ff84-c558-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763564329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564329, "uuid": "2f1cbadf-8bc1-486f-a32d-56d2b14582fb", "comment": "Malware payload (Vidar)", "value": "26f4e4458656cec56cc170f767c03b21", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564329, "uuid": "85d30df3-e53e-475e-8eea-24306ddf4e32", "comment": "Malware payload (Vidar)", "value": "54f6e742463d075bc1afa87ce302827ef813da9a3e4db303ab7c0beb72753ca5", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564329, "uuid": "1e6ad597-e6af-4504-9662-8cf4fa080d17", "comment": "Malware payload (Vidar)", "value": "6b041d49817a84110f0760d7d806aa2fffbea031", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564329, "uuid": "af7c3778-bcc9-4c21-9316-a012cff63e6c", "comment": "Malware payload (Vidar)", "value": "dc4d2bea43ac1e23975b08d7c6c288cacb068e1c956efaaa0ca37e7656de1f5ec623420bf4636816b2d0f3add5c24ce3", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564329, "uuid": "cf8e74b3-6740-4cf6-8684-c17fd8b9cfe2", "value": "T1DAA5331613D9B0AED9BA4B7180F646936131FC652F2451FB03D8E9BA4D227D1B631F0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564329, "uuid": "04a63caf-9f43-495e-a71d-3795a5547386", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564329, "uuid": "71fd3ccb-6ab7-47db-9815-83f51ad3e455", "value": "49152:/ji0DTa2FzeaklancP8YI8T/MV5MXDYpCY2djGVa9PbuND:tDfzeakocPO8T/M9CYU9Pb0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763564329, "uuid": "41b2f4be-2f9a-4661-b314-49b23787d06f", "value": 2079744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763564329, "uuid": "f3dd54b7-664b-4ec7-a29e-5a45ea60ad82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564329, "uuid": "7c47c4bd-1e0c-457f-96f5-150797cdcf11", "value": "Pro Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15bc9187-c4ea-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1763517011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763517011, "uuid": "fccc72b5-29ed-46bc-b2f7-130cf97130ed", "comment": "Malware payload (PureLogsStealer)", "value": "14fcd225713cef9965ecad6e37bd53fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763517011, "uuid": "c55f2369-34f5-4b9a-bf6a-ab846c036948", "comment": "Malware payload (PureLogsStealer)", "value": "55a4228fd84a40ecba70cbbf8b77f9a0b19b9ac0b8e969f4e07acef0c78e679d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763517011, "uuid": "759397e6-a7d8-46ad-9c5e-0eb677bbca96", "comment": "Malware payload (PureLogsStealer)", "value": "7dee83430939dbe1107374300165ed762e0a35ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763517011, "uuid": "56fe92d8-b52c-4892-a166-6bc99a746314", "comment": "Malware payload (PureLogsStealer)", "value": "befa92a532131725b7ab20189ea5fb07a8a2a59504938cf2723cb75afe8eb86567edd5245da8d516405f4f1c7d850b9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763517011, "uuid": "6489b584-2fe6-47bc-9d99-46f9347fbcea", "value": "T110C4233239781D52E2E4E73F589470E053F9941C69098E4F764D2362DD05F2FCEBA29A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763517011, "uuid": "3b4157a9-78bf-4f7d-aec7-387ccf5ef317", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763517011, "uuid": "ff287290-9a50-4cf9-adb3-3b347172c81c", "value": "12288:BLMBscP8T+gVzXt1J989Quj833ZO2J0AQYK9Xv1K0bekD:BeGNXDz89633ZOiQTo2ekD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763517011, "uuid": "29bae657-8774-4599-bcda-a742b6e1fd12", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763517011, "uuid": "7142aa11-d581-444b-a918-139f6280b45a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763517011, "uuid": "85a3353d-e3d6-4a44-a1e0-162e8ff403ed", "value": "14fcd225713cef9965ecad6e37bd53fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb15ee1d-c55a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763565499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565499, "uuid": "18234ad3-ceb7-4dc0-834a-a5e60a4b48be", "comment": "Malware payload", "value": "9147c33f1f46151389eedb5f29ca800a", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ywskxh-com", "colour": "#9CF688", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565499, "uuid": "1fdec672-0223-4922-8d4f-6651a5cf1258", "comment": "Malware payload", "value": "55a43c3420de83e2d647fb63375cf767da6df9ede0dd20e80852a6def0ac5e4e", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ywskxh-com", "colour": "#9CF688", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565499, "uuid": "37e4d7ca-2bf8-4ce2-9d7c-e1722b3527a3", "comment": "Malware payload", "value": "1a7507f4fa21c4a2eaa03007bfe6c71c68386695", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ywskxh-com", "colour": "#9CF688", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565499, "uuid": "0ff25e7c-ebc4-481c-b534-3c7902b8159e", "comment": "Malware payload", "value": "0f0a693ee91d6cfd5ff125d2ff1378fc96647f57ccaafbac7a6944b49a2a42115a026d7023723636e8fa879a64069147", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ywskxh-com", "colour": "#9CF688", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565499, "uuid": "ec89cf64-b29f-4cd9-8c2c-75b3ff4388a3", "value": "T10505AE52BFC6C1B7D2A602B708A6977AA232F55F272455C367842F4DCD312E2BC36316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565499, "uuid": "dd5fb754-ef8a-4dcb-804d-2afb115803f1", "value": "5f8d88f5dfca2f12b8a4061a2eee5f19", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565499, "uuid": "e591b07f-a3c2-4057-8646-028025765c05", "value": "12288:kQ5RvPjL8UXXR9Nj1ck0+BdiSaHDUDxdN4JHn1w+hFln:kZ09ZPnaHDUDX8nLnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763565499, "uuid": "11cd118c-0700-4a66-8650-c4d84d79aa22", "value": 800120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763565499, "uuid": "638c60a5-2468-43af-aff3-cbcfc0704b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565499, "uuid": "eec3227d-2814-4f58-bcfc-e57241c4a58c", "value": "Verifier.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "440e6112-c514-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763535128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535128, "uuid": "6f8131ef-6244-417b-b9d1-4a3b74797f91", "comment": "Malware payload (Mirai)", "value": "326d835bfdd08424908bdf9feea7bca5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535128, "uuid": "14ec3669-55ab-41e8-8aff-d80e74a0d73f", "comment": "Malware payload (Mirai)", "value": "55ee5b2ca894eba154657b19cb093bffb4cb01394aee6442e110a54f605423f8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535128, "uuid": "ec23e8ee-6356-4473-939d-7c973d850d2c", "comment": "Malware payload (Mirai)", "value": "3dff6c60d93800da5fb2edbf5272d0d3c6689378", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535128, "uuid": "b6fc52cd-b63f-46fd-943b-4905ef7ca417", "comment": "Malware payload (Mirai)", "value": "8e2633896e6a741d29b05dcd4c7d696b4ef843bf7835ee9636b6d76d6543374dc989815942c4bf2d60ac54e73ddee4ab", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535128, "uuid": "93313cbd-ecf1-4bfc-bbd2-a48de3b7170d", "value": "T1E1D39E87F6871195D46306F043CB0BAE2DA312820F5FD5E3BD6DA63B59BA0DB0906F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535128, "uuid": "359a0b1d-3973-4308-93aa-2616dc662a77", "value": "1536:wDhReGDDu44vLfGhwpsVtLoUimW1lqHAby8xarmqg7mV+/LWD:WFPuJj+hwCL8Uimwpby4qg7e+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535128, "uuid": "7b0312e8-76af-4129-b603-c490ecb80f91", "value": 141716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535128, "uuid": "02456215-00e4-48f1-ab52-a554d0012bde", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535128, "uuid": "930dc375-784c-431c-8d58-e0371a5994b6", "value": "arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69acc57f-c594-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763590166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590166, "uuid": "7070483f-10cb-415f-88dd-55bcdab7dbd4", "comment": "Malware payload", "value": "0830b900e53f57949f64c3148a9372aa", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590166, "uuid": "621fa1b8-6dbe-4fe6-80ed-dbc8b18a90e9", "comment": "Malware payload", "value": "5623c6f436333e30604266d2cde0bb9c23e45b0b4b6c35e533725eac6e703357", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590166, "uuid": "6b66ba45-e7b9-48e9-b7bf-ad710400bef8", "comment": "Malware payload", "value": "29bd9f57bfff552b6d57e85cb3571a1ba7aa044d", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590166, "uuid": "557c5d47-b6a7-4b53-a8bb-e257c068576e", "comment": "Malware payload", "value": "022fd5c7a428e049031823960ef01b4370e2de799646bc12b713a4cff85f4b5e7cc2474d397dc449a471ab3cfea74046", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590166, "uuid": "803ededc-f9d4-43d2-be57-b832d5928b04", "value": "T1B7C63321A980AC0CC7AB01355A6FEF349F6D7E584709ACA983A2311DAC347D1F5B774B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590166, "uuid": "ecb3d404-973d-4006-ad77-41067e50966d", "value": "196608:GZjDv5bOnvtVOp22q+3UuNr48r3+BoxwbDcN1CV58Rr9zNKGwmRf77SeTxbrVtPu:GZjtbOnvsVqmNr4vCxGtVSJZY3mF/JxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763590166, "uuid": "c08478a3-d4b5-4697-b32d-64f220d7f1fa", "value": 11931648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763590166, "uuid": "8cb6fcbf-560e-4352-bb22-dc633707ca1d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590166, "uuid": "34c57e67-7873-4bec-ab0c-bc3fd285702f", "value": "\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a \u041a\u043e\u043d\u0441\u0443\u043b\u044c\u0442\u0430\u043d\u0442\u041f\u043b\u044e\u0441.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03e1562-c521-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1763541000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541000, "uuid": "383dc8cc-af38-422f-b712-33f137c4ded2", "comment": "Malware payload (Joker)", "value": "3c844a9be28bd417e838829334a7928d", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541000, "uuid": "0919ddc0-902a-419b-ae81-3f1e392c8fe0", "comment": "Malware payload (Joker)", "value": "572ee0f596462abe88d078634c082c420139df60f2357fbd05b1965648bb2e40", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541000, "uuid": "e8f555ee-9c5a-4a06-add3-503852f9982a", "comment": "Malware payload (Joker)", "value": "ddf4dd8f7af1994e5e9189763a5355cc9661e711", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541000, "uuid": "0e381931-a111-4ec0-8ace-e9b57e9cfc59", "comment": "Malware payload (Joker)", "value": "d74e83392c8c1a5e6f301888d70095af7bff7b778ed97d9e1eefea1541189b9644f3ea032244c5c07dc38d1e1d0e78a7", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541000, "uuid": "04e66b5d-8dae-43c6-a1b6-bd64ab6447cf", "value": "T120A6124FFB88B41FC9F6933799760632A45B6C3AA717D2130948B27924B3DD04B86BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541000, "uuid": "35cdb268-2643-42b5-a03d-006a9893dc08", "value": "196608:F42B1Mfh5zrizZhEHu1hnT3Aeinz1hnT3AeinK1hnT3Aeinw1hnT3AeinRieyNEI:WsW5ViEO7Eeu7Een7EeJ7EeeiPEZIo3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763541000, "uuid": "6311ca63-781c-47c4-bae2-0e41a987f611", "value": 10308196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763541000, "uuid": "6513d350-530c-4011-88c6-7acfd7b0a1a0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541000, "uuid": "dc1eecf3-ec00-4138-854c-8d4984dbfd67", "value": "Professional+Camera_1.2.2.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de3ee93-c514-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763535117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535117, "uuid": "4ab2cd86-9342-49e5-b989-67a0a27d13bd", "comment": "Malware payload (Mirai)", "value": "2b5584fd2ce00b3dd33d7f23d18a2a40", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535117, "uuid": "2d0b04f5-21f4-4efb-9431-085435caa0bc", "comment": "Malware payload (Mirai)", "value": "57738ac3d35b80cc786413ee8a389f77a293211d10a280492e1bcbbaa5709373", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535117, "uuid": "cad34682-bbf3-4dec-8f31-35b92c1ba1eb", "comment": "Malware payload (Mirai)", "value": "dd0a91caddc1fdbc798c07a13248feb0cb27db0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535117, "uuid": "e48b5b47-3a4d-44a9-87e9-859f2444f201", "comment": "Malware payload (Mirai)", "value": "ec42df4dc9c6aa6b07329183bf85b970625980bccb803811a3dceebd5f85d3de2b6dec22e896997365ee1f71ef99e0d6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535117, "uuid": "71152047-7a16-4c72-9b0f-03af611f1af4", "value": "T1F3D2E1691DC3ECB1C3B48D37E77DC641137119B4E2E258691A3A9F7CA06110519FCFAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535117, "uuid": "1069b007-c4fc-4a3a-90fb-a47c845ac399", "value": "768:HZDF9dXEv4+HcH8bN05CO1FddGEs3UozUr:HZDFDXETPB05/dd2zk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535117, "uuid": "91089113-1f9a-401d-b212-51f888fb18a6", "value": 29212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535117, "uuid": "f8522881-58e0-4c0e-9bb5-1571b2f4acd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535117, "uuid": "6807d72f-70d5-4238-b959-bffa52f0efc7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a3a7326-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589711, "uuid": "2cb61c05-26a4-4bb3-8a87-81b23a995aad", "comment": "Malware payload (Mirai)", "value": "ce987adc023062ec193af3a442a11eb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589711, "uuid": "7b0c6556-c714-4c06-bbc7-bd4ca835daeb", "comment": "Malware payload (Mirai)", "value": "58606d11375eb108d5dc0a954304f94a104ae1e8f65565eb599b1cfc6706c465", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589711, "uuid": "43fecf44-41cc-47b8-9a31-955b019e783d", "comment": "Malware payload (Mirai)", "value": "34e7c180d14e5c859348e84d7deae8605c3009e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589711, "uuid": "0c776db5-e3f8-40d3-8afd-141210ea3e78", "comment": "Malware payload (Mirai)", "value": "15150d15968c4698ed81f6db29a97bc3e0d1bb51d65d00b50743ae9d39fff158cca9a51e904b6a49e53d13e959a49fca", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589711, "uuid": "70c27bc5-b0da-469a-bacc-9ca77cdb2658", "value": "T12123F1456C63F651C5B00DFB58A20AC469EC2FBFE4A7342A69E269B074F14D7C7BC205", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589711, "uuid": "37a13ae3-750a-43c7-a239-36f168654a05", "value": "1536:/5FwVRpu6MJa3b9oqt2fmN96hm24PgcfM4uLy:/8fpuhJa39t2OqIf8Ly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589711, "uuid": "253f6f75-0f5f-40a0-aa96-ea45646276d3", "value": 50104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589711, "uuid": "c99246b7-154e-497f-9648-678ba3796867", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589711, "uuid": "0584d6ba-184f-4cd9-b421-e0b4a9d324ca", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5bb94e-c546-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763556725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763556725, "uuid": "95f358db-d2e1-42db-a92b-512ad0a8ab94", "comment": "Malware payload", "value": "47e934d648de6b45c57dc7300af2cad7", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763556725, "uuid": "d341d6db-1506-4053-9dda-77c9ab42968c", "comment": "Malware payload", "value": "587337f5229949a870208a494db0f02928ddbe61b1ea2d5acf6df86bcd4670c8", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763556725, "uuid": "5ec1f899-dede-47eb-974c-1cff7f22daeb", "comment": "Malware payload", "value": "ce92aa642ee1b249c7691ff1e72e4ea77d8b1e8a", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763556725, "uuid": "be721e86-1ac3-4b15-b100-2c3468b8ba14", "comment": "Malware payload", "value": "72c816e973bc21bf8b2e12dd7374894a415172add4159309d7029af7d46ac93a912931706db7b334d61bf9d85b873b6c", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763556725, "uuid": "31b66b2c-f0dc-4e30-83e3-337dfa1166f1", "value": "T12CD012348281808DD6237A39BDA4B521A80EFD524CC2BBC828A5D41B04D15B5A04065A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763556725, "uuid": "43bba183-a71e-40ac-9ab6-30230bfb040a", "value": "6:HRYFVmHHtvBzUAY72fzwWBBArSDxDXtx23TEGE54vVG/4xHy:HRYFVmXzS68WBBArSlXt4TTfVW4xS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763556725, "uuid": "f7061829-1c0f-4f93-a95d-6fa0a3138fbc", "value": 284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763556725, "uuid": "44f97a22-5840-4db0-bc57-2e0436e24b6d", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763556725, "uuid": "45801f22-83e0-4cff-a2d6-08f30e85e2ef", "value": "Invoice.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41be9257-c514-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763535124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535124, "uuid": "2efb5a10-cdc8-4f71-a88f-b714c522516c", "comment": "Malware payload (Mirai)", "value": "be99fb57bb64c4d26ad6042d308a2d4a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535124, "uuid": "75c8f60a-1915-4020-9d5b-6f56037c069b", "comment": "Malware payload (Mirai)", "value": "59971db133ca536f5fc2249bb3e1d4b30146e4a29d35adda8249ed91938e1d3c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535124, "uuid": "2894b6b8-5738-4f68-b864-e013a0207248", "comment": "Malware payload (Mirai)", "value": "e4e746c2784bd370c01453063cc95f01f68f067f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535124, "uuid": "f76b5713-1477-4b7f-9f59-97bf80be2d6d", "comment": "Malware payload (Mirai)", "value": "f365ff7b19de4b7856eb4d0c55011fe27aed068faa24e950a7470ac9855c9dc4d15f2faeb6b0f2348fe28bb492f4aa4a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535124, "uuid": "cb58dad7-6683-40f0-8871-0b23c9b9d368", "value": "T1ECB34B22B9761A27C4C0A47A21F74725F2F397DA21B8C91A3D620D8DEF256503517FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535124, "uuid": "e3c1ae90-8e30-41d3-a485-1ccfeda50007", "value": "1536:DkNesSTniQPsuE9UBPQjd7K5tlMAMWnW9tXhZYL569M8QsFa7tSg4nvbx:UeJDiQkvkeAwJTYl6W9Ynvbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535124, "uuid": "dbbf29f0-5cce-4e4f-ba0c-a0f800658efc", "value": 109000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535124, "uuid": "d50996dc-aecd-4023-9585-8afec25bd238", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535124, "uuid": "78c84f94-7980-4972-9cd0-acc134580bc9", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e562cac-c59c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763593476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593476, "uuid": "bcd85d18-4ac3-43ed-a07f-078bb9055e11", "comment": "Malware payload", "value": "376dcf0cc26f9de327aa6a259ad33c5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593476, "uuid": "52f94721-45d1-4088-9ec0-6656e535d4fe", "comment": "Malware payload", "value": "5a5f9e8a423c7e5df0b00c0cb7996d2a75bff85ca376c2a585ab5368471f8f53", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593476, "uuid": "70188f29-af59-4127-a4b6-b24a072c0609", "comment": "Malware payload", "value": "01482efcc41391e2e3c5f4e8ca33713fa2c91d30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593476, "uuid": "31317c46-4073-44c3-b376-d157d47fbe43", "comment": "Malware payload", "value": "e625ef3e8817ccb184eac521e4ddc38b74ac3bfab3c333062fa662830671c6b079cb2d59e2e2a9a74ca1465fba3c72ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593476, "uuid": "edb08029-0910-41a5-83e4-f37de86b5264", "value": "T16367333207C32A83DA6C92FA5B31C805F927E673930505ADAFBF9D8B904544D8FF4A65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593476, "uuid": "3254d384-a775-4ae8-9f0a-0d03cdee3a37", "value": "36f41d6501d21aeee25e23e08dd6f790", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593476, "uuid": "54b992df-8a72-456c-9ea6-aeee0edbbb09", "value": "786432:rvk6ovfTRbquH8Y04Jc7yfJEdHCuVuBFPNlSbJF8Jhl:Q3TV0YAyBEdHCuQoJF8Ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763593476, "uuid": "eacc05c1-45de-4a36-a10f-0c3895c9b2e6", "value": 32194064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763593476, "uuid": "4964b0cb-30eb-472b-b4d5-1fbc68f26d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593476, "uuid": "f9a22bec-faea-4c66-a1f6-89b7e1be1f3d", "value": "SecuriteInfo.com.Win32.MalwareX-gen.81831585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d61492e-c557-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763563866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563866, "uuid": "9d785526-9f6e-410a-8449-73472b94d3be", "comment": "Malware payload (ACRStealer)", "value": "ea06b90b46b58343e1f3d88cb7ce496b", "object_relation": "md5", "Tag": [ { "name": "65-109-1-228", "colour": "#9354F6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563866, "uuid": "4acfe724-38cc-4f80-a3cf-27b40a98e4ad", "comment": "Malware payload (ACRStealer)", "value": "5affffdf264f9ffa4fad43eb71cca1ac7d242ee03794eb30eaa13b8b2dc22ffd", "object_relation": "sha256", "Tag": [ { "name": "65-109-1-228", "colour": "#9354F6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563866, "uuid": "bfa3e67a-1503-4bfd-ab7c-60039c70c2ec", "comment": "Malware payload (ACRStealer)", "value": "8dca69f720de4145d01fa0c79a262bb368181490", "object_relation": "sha1", "Tag": [ { "name": "65-109-1-228", "colour": "#9354F6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563866, "uuid": "7e596b18-0742-4520-8171-a2eaa0a0d16d", "comment": "Malware payload (ACRStealer)", "value": "eed968d3f7f167b8e25582fadbc70ef244fb315c69c55bcba4b19dd44afb28a6591b743bb7db434b11f6440cf53fa9e6", "object_relation": "sha3-384", "Tag": [ { "name": "65-109-1-228", "colour": "#9354F6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763563866, "uuid": "1f938561-da0f-4c23-85c8-538402ec3532", "value": "T1A2B633B115C135E0E41CBB3B6388A168C5A5C39B9AF67437F0C2C1E94E1B6FB2F86156", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763563866, "uuid": "65853d89-db84-4964-810d-2f928b2dbb3d", "value": "196608:En2d6hiEO7o3sTykEMcoucNVs4BuxR+ctQ/YaVVrWt:E2d6hiEONykrucjsoctQwaDrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763563866, "uuid": "a6b09fdb-711d-4539-9681-f6e9dc410b4d", "value": 11178523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763563866, "uuid": "dd61c09a-0d93-45ee-9f81-cb6460bfa541", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763563866, "uuid": "00a6a062-d708-4ec2-a9ce-39c03274c4f2", "value": "SETUP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42894cbb-c587-11f0-a129-42010a9c0007", "comment": "Malware payload (ValleyRAT)", "timestamp": 1763584517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584517, "uuid": "acc3c510-abe4-4bdc-89b7-d00cd08c92da", "comment": "Malware payload (ValleyRAT)", "value": "4dd9502ca0968255842c5b1f9f6e551f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584517, "uuid": "bf35acc8-1109-4040-93c9-de5afedc46da", "comment": "Malware payload (ValleyRAT)", "value": "5b27227f1cb5b81175c593376e87bab3e803b39fc7f504d838d89ac1bcb1c3d0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584517, "uuid": "81a1d4fc-a189-4134-8cf4-be375d36f97f", "comment": "Malware payload (ValleyRAT)", "value": "847698a1d1040afff3b0360dba9be3fc7bfdfa26", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584517, "uuid": "e5baa891-87aa-4a38-a3f4-3f7bdeb092c9", "comment": "Malware payload (ValleyRAT)", "value": "f02ad108d1adce6e8287af1f6efadf7f934325d672247f228c6fc99e762fa60066ecd2e960d976b1c4259b750545e5e1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "ValleyRAT", "colour": "#BF1728", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584517, "uuid": "08c735b6-9c72-4675-b753-10d7ffca9144", "value": "T170D3F646BB46CAF6C08D11328C2FE79D6636B2519FD252D33B89071F9DB13E16E36242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584517, "uuid": "a909d959-45ce-4ae5-9fb7-7f48e3fbd511", "value": "ae36228bc8daf586a67ed050b22081c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584517, "uuid": "6eb92961-636a-4362-ad71-ec0a282799e8", "value": "3072:VWHtG9BlleAMOzr2PwAx/wOfV63Q6kxIHejYtY:VLmyrfAx/wOfVgRkOrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763584517, "uuid": "76c4da43-6c16-44e7-b66f-d0bceb658d21", "value": 130560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763584517, "uuid": "9aec7959-275b-4eb1-a16e-913c59ee210f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584517, "uuid": "a50f6633-48da-4ed8-b335-48bb46cc8e34", "value": "5b27227f1cb5b81175c593376e87bab3e803b39fc7f50.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92db1abc-c517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763536548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536548, "uuid": "43085590-53ce-40b5-8c7e-34170c5226ae", "comment": "Malware payload", "value": "b9ea6855dfbed596226b1efceddf627c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536548, "uuid": "e483cf4d-a1b5-4f82-a1e9-5fff6f6cc771", "comment": "Malware payload", "value": "5b274e409cdd3108fc9940227a463912c24483541347853979af9fc0da34b6f3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536548, "uuid": "9d570904-23fe-4d5e-8729-8e4e3763e7c5", "comment": "Malware payload", "value": "27fb1a6194aa9f6cc029ee1680a2db862c90801c", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536548, "uuid": "93228359-945e-43de-974b-4c644811e6ae", "comment": "Malware payload", "value": "3d600117eaf300b0127e58d63c1f212d7e380e2a8fc16e453a962dc035cb41b57fa05eb22e639a6266fb42caa5259712", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536548, "uuid": "161e5ec0-308a-4b6f-a101-45c5b1edf4ff", "value": "T1910833CAF3A58A5FD8326131485A82B517834E14E54B869FB588376C24B3DD40F7A3EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536548, "uuid": "7b901603-7514-4389-ac73-9307e02a0e46", "value": "1572864:F8AhP7PPb9nArfy3SPHKYLfX4jqh9348btl11EwrkQ2nFZcuFEj6icnL66clUL2L:F8uzb9nArfy3S5T1R4KVhkQIDcueBcnU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763536548, "uuid": "cfc28ca7-d3a4-4eb5-a0da-098b1411b3cc", "value": 80745998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763536548, "uuid": "24044958-1e38-4c2e-ae8c-b2a9cd3b4efe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536548, "uuid": "5572c0a0-c8ee-4404-ab9c-55de8a48b7b3", "value": "yunhu-1.5.7.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e03d74-c517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763536498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536498, "uuid": "7e129bdd-0001-48f7-87ff-1d2a0984c7e5", "comment": "Malware payload", "value": "135dfaa15ceb0afa38a4c755b056fc47", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536498, "uuid": "35c54262-35e5-4324-b382-edbc827ad39c", "comment": "Malware payload", "value": "5c8948262447a0bb43242ef39617b1bfe4be6e7be8f0a1f71072c8ad0f4ce7ff", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536498, "uuid": "f990347b-0ea4-4427-a4c0-b6c1037819bb", "comment": "Malware payload", "value": "f0404470ce5b2930dbe892e37cdb55a67a590bfc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536498, "uuid": "9d831a29-c993-441d-9829-3c43fea3064c", "comment": "Malware payload", "value": "302ade80d0f35bddadaff6d19079a094b96855b255a3f4e335d53d0584268631f330335218de0bb6d16ab03576689a8e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536498, "uuid": "5d0358e7-280f-4d98-9c65-b204e60dd986", "value": "T195673313FF20981AD07649364DAA87316732ED488612A70735DCBE2A6F7B1DB5F0A7C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536498, "uuid": "d3e27706-aa87-44f0-85a3-1be4d3f08c6d", "value": "786432:ebUf6MZrm49wOCWF2QaCLsVy1buSqrDwLtkeGCT:ebUfr5r7FvLsM1aSws/GCT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763536498, "uuid": "1a57481a-69f2-425f-a1a5-b1876db2f08d", "value": 30697830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763536498, "uuid": "d19ae36e-e0d4-4191-b628-3e03d2ac6270", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536498, "uuid": "570fb911-87a5-480f-aba6-26e853ed1a46", "value": "1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb6ba78-c56f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763574146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574146, "uuid": "695eaca0-593f-48f2-bcde-f799c9aa62fe", "comment": "Malware payload", "value": "99bede4af820328b1f6692f44b373080", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574146, "uuid": "e2fbcdbe-baa8-4a86-8193-76ac6293d0e9", "comment": "Malware payload", "value": "5cf8d8f444f6e0b1c4372959067fc60fbf8c2e20c03ec6833f33267330a44cc1", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574146, "uuid": "f94596e0-2886-4f1a-9d04-2abf4274b8c0", "comment": "Malware payload", "value": "c7755fa6b9fb37e830eb1f19abf6830fcb5e0357", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574146, "uuid": "50533b7d-e400-415a-95a4-897c5b348328", "comment": "Malware payload", "value": "ea884f28de3d2ca915279348f1ae6150f99367b5f2f4ced3161ae26892c32a66d9b9f753481766e2996b3b9741592fe3", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574146, "uuid": "c2476f49-4c88-497a-8891-36f7d09d2714", "value": "T1291127CE46506F65458CCA0BF6938D5C104DCBCA6A8D5BC9FCCCDC6A92C0BD9F404E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574146, "uuid": "ad0a2268-96b2-4239-a86b-695cffc72103", "value": "12:KSs6wZsWsgNyHe0fsBswsOMSYeJB/snEpLsEynslaFsFz+M7lnN:KSKZh6QspeQEpTyyaA66lnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763574146, "uuid": "7a1e486e-d0d4-46a5-88e4-8b588c0d3572", "value": 935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763574146, "uuid": "c3d16329-5273-44da-a8ec-b1b406b79051", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574146, "uuid": "7a14ec7a-9282-48e5-b827-27d9db94b161", "value": "wget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc28c92-c596-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763591002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591002, "uuid": "a3da4efe-3b96-43af-92ab-e1e7d9d0b26b", "comment": "Malware payload", "value": "bb5bf46c78b3abab9a51ab46d6040917", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591002, "uuid": "5c54d22f-155e-42b3-83a7-030408110135", "comment": "Malware payload", "value": "5e784d9dcdf69fd3bc0d59f94e1fbdc05f83fc5d7ba44e6be51ec3e4d3d0ac38", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591002, "uuid": "8079d44a-6d36-4801-9ae4-2d494a43be32", "comment": "Malware payload", "value": "d498eb3eb73fc498549325603ea84352beec81dd", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591002, "uuid": "a3bc2d23-0c93-4340-8beb-091da85c98cf", "comment": "Malware payload", "value": "316451864367cc6f2f26e843ea9c389e9a4d05c13701a77987927e5c497e5266d9c30700408eb34f4870f3ff57cd430d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591002, "uuid": "4dffa614-7c86-4fdc-82e2-beb5d99008f8", "value": "T10D4633853C1C4FADD760CDFE4AEBB10EFAF031908998961478F5D06BA9390D12E36697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591002, "uuid": "2d78bd55-156c-4ca1-a5bc-3c95b447dbd3", "value": "98304:CyQCVxl9y8/vHsuj9sGYbuq8TpNIfWY44YiuuU1E29CktSWogva1pycqLBfcHiEc:C+xzHsuBou99iNU1EgD8xycqLB1Ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763591002, "uuid": "019c489c-bb26-4094-8961-e34d6e0b48b6", "value": 5438297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763591002, "uuid": "fddeed0f-bb82-46a0-9e15-c7798d334c0e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591002, "uuid": "92bd8deb-6394-4636-9507-5ee6b7e10725", "value": "octet-stream.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633b0a23-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589726, "uuid": "931a08bb-d419-4986-a426-7ba9590d6e17", "comment": "Malware payload (Mirai)", "value": "ee74621e2f28aa58f5c6d59f979e07fe", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589726, "uuid": "49fa0b4e-c53d-400f-932d-2447dcb65a83", "comment": "Malware payload (Mirai)", "value": "5f5a706a8a71a3c575a9df6a3e8d1ba9675be972aa4c03b691a91c936a6ee1fd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589726, "uuid": "045658bb-2c98-47e6-976c-dddc6d6f5cf1", "comment": "Malware payload (Mirai)", "value": "bee89f205a49cc4e8c85cd023e5f9d90347bfddb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589726, "uuid": "7001d32c-1df8-42be-ad34-53fe276aeabf", "comment": "Malware payload (Mirai)", "value": "837fe03d4c12ee0fbb4f456c470d8018cee2926573b83970461ce905901b6f7eb532002b983cf26bb0f461a183ace15c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589726, "uuid": "cf7c038c-265f-4126-bc01-2433ac08d267", "value": "T1A7D3AEA7B3471591C86342F40BCB4BDD2E6322826F6B98E3BC2F753768760DB4506B91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589726, "uuid": "961c203f-0501-4e16-ae3d-a0338b15c9d7", "value": "1536:sqLFxeg/54VHxiQcJ+bt5aYeSZ7lcclNeAhg89uJxZJ7ZgGh5/LWV:sqLFkOmpckbt5R93HlpZ9uzZgGh5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589726, "uuid": "44974a53-73dc-4e64-8858-01851ef69374", "value": 140740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589726, "uuid": "e50d3021-c598-424b-9a7d-d63ecf47460f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589726, "uuid": "c4402fde-c93b-4f91-9fe4-12f310f0bb67", "value": "S3o.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c477b160-c591-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589030, "uuid": "eaa88d22-5d9a-4844-b3d7-c6cf0de8b07e", "comment": "Malware payload (Mirai)", "value": "6e301caba6b844f624b41a99f5a9ae3f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589030, "uuid": "4c887586-478a-4c09-9bf2-43baaa265f3b", "comment": "Malware payload (Mirai)", "value": "6014367b7b94e7309ad50a93366d517bd47ba6c6c1df578f30438c64348dd3a1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589030, "uuid": "f3a99188-13ed-4b10-831f-e92a245f02b3", "comment": "Malware payload (Mirai)", "value": "24941d6eb51578ed8c7d59811c26d2f53ba29d41", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589030, "uuid": "95ca83c8-2332-496a-b13b-7a9125cf9dcd", "comment": "Malware payload (Mirai)", "value": "c094a89575789e6d3808b945d65edd21697ec315b4773585486c20394640904c0375479845c096b0bf59532b24818d96", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589030, "uuid": "ca90f586-d3ce-417b-94ca-453ce73b9b71", "value": "T1D23182E5242706362F519A63B2BD045435F3A6E35CE0ADB4A4FEB4A9414FD543283E93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589030, "uuid": "6db0a6c9-5102-4d29-a836-ac0263169078", "value": "24:vvZQFsTB60EuJ5v/ZAYL0jhAdksHAk7JxarPIhCzKS:vXF6SBiYLYKdJgkDarAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589030, "uuid": "46fc9b3c-c29a-40bb-8f2c-af14ee60493d", "value": 1798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589030, "uuid": "05860501-6ced-438a-8f23-90f510ed139c", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589030, "uuid": "641e7f65-e554-43f7-a1cb-31e560a19863", "value": "8UsA.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21407c1d-c51e-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763539364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539364, "uuid": "635af37d-7082-482a-a8ec-3408bbbe1383", "comment": "Malware payload (Formbook)", "value": "61d6de884d13b81d04a8a6b0aa90030c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539364, "uuid": "d8fdcdd3-e447-4f63-a32b-8eeb939a7ff7", "comment": "Malware payload (Formbook)", "value": "60225d01fc1c6cc5cb97a92dd57a7072f8f5d9069e274ba6e9a9131a39577c09", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539364, "uuid": "a303eac7-06b3-486f-b2dc-88d5b4659987", "comment": "Malware payload (Formbook)", "value": "6575483eb1e16df8b3df854abd174cfd41a1c9b8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539364, "uuid": "3033b822-e501-4587-bbb9-2ca9abaa935a", "comment": "Malware payload (Formbook)", "value": "81a5a63c06e76a723daac5981e69b6af5b27097a5333667846f229f502b4ab1b31ccbf34c9dc8d69d8e39b06118bf9d0", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539364, "uuid": "c90e3df3-24b4-440d-8ea1-73cbb1c7fe85", "value": "T19CD423287CCB365102CBF4F54616FC8DBA396B8E59045DEEC012261B7DB8E2F351AA81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539364, "uuid": "c4b8bc97-d2c6-48c6-8cb6-19caf508f183", "value": "12288:/6qDqgLuIqftUzgt1rB+ySmgyVYPyaMdjpv3ddvuIAz7uhs/:CENLuIE7t1rgySyoyaGv3dlAzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763539364, "uuid": "24fd4b28-3350-426e-b809-84bf9a2bef95", "value": 656722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763539364, "uuid": "f66dd804-6a4b-4496-a777-dfb706576330", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539364, "uuid": "5cdb2ce1-ef73-4547-9852-7115a886ee7d", "value": "BANK SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaf9a102-c522-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763541421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541421, "uuid": "2257415c-3c86-4d97-8e97-e4feb51087ad", "comment": "Malware payload (Formbook)", "value": "f10e1cb2cd5731c37aaff7522eb1cce1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541421, "uuid": "7211548b-35af-4215-97c6-ebb1c3de5e13", "comment": "Malware payload (Formbook)", "value": "611ac2a3cc67dd665de102f64f1e6bf9516746170ca1cd3a32d2bc3d445c58b0", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541421, "uuid": "2f23d77b-de3f-4822-8fa5-5d1b8a2a4950", "comment": "Malware payload (Formbook)", "value": "0bf902e2ce914e14f08f09c446b5b744cf112a5b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541421, "uuid": "76e33a7c-a89c-4c94-9666-b688a2edd3f1", "comment": "Malware payload (Formbook)", "value": "cfa58f55f02f1572630bb9cffdeb6bc2cc580c8885b0a07e09cd3d849e17192ba4e941c0ec0ab0b16a44f6867121aff3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541421, "uuid": "3e19d8e1-f773-4561-9c0f-4e8f0586b8a7", "value": "T1996533125F661EA98C248638217F7F8F43F16FD0D1A8D6EAB88B31E9076DB1201578DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541421, "uuid": "bd4efc5d-38c4-4bbb-8a12-303ed05b27ea", "value": "24576:MiZWZzbTEX12AOPnia4iiJvJrBUSpDACQ47qBSF1Te4urdL/pmf4NQ:MtZ1TR4vJb2S2dAwNQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763541421, "uuid": "ad914858-c19a-4008-b400-b488f79bdbca", "value": 1461300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763541421, "uuid": "d6cb757b-4f5e-4e6d-82b8-3a6df7b28574", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541421, "uuid": "5fa40343-ad80-4d75-a98b-21a433ed6576", "value": "air.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9793f96-c57b-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763579590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579590, "uuid": "9908775f-9a02-4181-9541-d01ad82d887a", "comment": "Malware payload", "value": "22ade02e244b6ca751745a5f30426150", "object_relation": "md5", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579590, "uuid": "b103db35-4047-4a5e-972f-bde91c80dcc5", "comment": "Malware payload", "value": "61956512611f698438b335d8bdca4345e64e21bae8b57fc6f95a6582fe4aaa7a", "object_relation": "sha256", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579590, "uuid": "399a27d4-d374-4e40-a850-45c231e52158", "comment": "Malware payload", "value": "f6fab5d4c56d1d1af5fb9fe3f43b027e9d294afe", "object_relation": "sha1", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579590, "uuid": "abc3f141-ed37-47c2-a6ad-c43ff0d4eb34", "comment": "Malware payload", "value": "ea455db5db02e64a24310d017839ef12b8ef808bd56dbed9ed34d301107c0d0da5f0d2921ef538042089079a6fa65f90", "object_relation": "sha3-384", "Tag": [ { "name": "Kongtuke", "colour": "#0020A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579590, "uuid": "ae4df5c3-fdce-4b9e-a54f-26882af07737", "value": "T1BAB1DBD7E3E8DA4F646500E9992A311A24E1C2BF5CAF834465D2150FE62F950AF1BBF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579590, "uuid": "4d6330fd-86a6-4392-b255-1ad1db8cb197", "value": "96:weagnW6yuE2jfR/uU/TQV54HKIDQq94sMSfkdEEm8skN4CDQq94sMSfkiYCI2U74:w5gW6yuE2jZrUV5FIDQG4sMSfkdEEm8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763579590, "uuid": "b7b630b9-b8b1-41c0-a8f8-11f4261b654a", "value": 5252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763579590, "uuid": "14fe4f6f-efb1-4a5c-ac58-177c791df732", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579590, "uuid": "0db4e9f8-1ac2-4424-b5b7-54dcfd84f22c", "value": "meta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1314a69a-c576-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763577136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577136, "uuid": "13caed62-3c64-48c3-abf2-97da9fea40a5", "comment": "Malware payload", "value": "d162490a71c6960838bbba423e308013", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577136, "uuid": "adf8132a-6f48-49ef-8efc-e276efabd061", "comment": "Malware payload", "value": "634e8ff2b1bebf6dc31c8e1b451802ed698534be782068ba21945748019baf29", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577136, "uuid": "489301b2-c0e9-4169-9f03-9c1213e58edb", "comment": "Malware payload", "value": "5de053836a630d39cd96e15171d0190197c58bd0", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577136, "uuid": "9f08d7f2-f8bc-47b2-a128-02e4262a42c6", "comment": "Malware payload", "value": "ea447a3bf578dab034bbbad8b93f265d91640b6837333588396acfddde4d1bcf84028baa3d059da50cfe44bb03a84472", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577136, "uuid": "376ce16f-5899-4f0f-80ed-45610bb2cb93", "value": "T172662372575524B7C6A20B35B00A3773AE7D8897850C91E9BDDCD24E33DF6A2882F4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577136, "uuid": "6c878eee-eec6-458d-ba51-500726db7326", "value": "49152:vUKK0SazABGNgKsn4cKuyE6mgGP32hiQ2O9jgoj9aix+J5wLJdOSHtyequ8DtcFx:xuim3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577136, "uuid": "dfc64773-184f-4c98-b047-8dd9e4229690", "value": 6506496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577136, "uuid": "98d75643-eb59-4b17-b4ab-c701e585c5ae", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577136, "uuid": "c027fc35-0dfa-4d8f-a262-5b0385ad1f8b", "value": "BXT53364HC35898514.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d653d87-c4e7-11f0-a129-42010a9c0007", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1763515816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763515816, "uuid": "89660ad5-f503-4171-99bc-7d0c7e88c67f", "comment": "Malware payload (SnakeKeylogger)", "value": "6034a2bf592799deb2dc59d398679d1d", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763515816, "uuid": "256b1abd-44fd-4cad-99cc-80ded0d5938d", "comment": "Malware payload (SnakeKeylogger)", "value": "648a30be0ec3839dcd2fbb55f45f8fd0ad39e54066a726b319398959611dbb82", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763515816, "uuid": "f389b2be-1399-4fea-b754-4c65112e57f3", "comment": "Malware payload (SnakeKeylogger)", "value": "6b651715a4cfeca27868f16bcdebb15ca8c0564f", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763515816, "uuid": "786ea44a-ba7f-4880-9fc0-17beb83742f6", "comment": "Malware payload (SnakeKeylogger)", "value": "eee7df95cf0b8f04e9274394f46494f5cec8afcae0b5722cb32ebfd67b9b39320330c0a88bb79c731a13754854d76db8", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763515816, "uuid": "3f889d19-4120-4958-85b3-15fa63daa735", "value": "T16BE423CA434C22B92074B61F3FB9E7B72819D7FE2FA37567C70058E919607620673A54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763515816, "uuid": "1435bc83-6daa-4d14-941c-986b0b71636b", "value": "12288:k8h/7brgsuF3LkeTvPD6wZUnPmruggNp1JlTLDDNkxt6hi9F5kYxyOBVeYNWnWCV:kYzglkIWfggNr/nD8tOi9PtnBVLD/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763515816, "uuid": "c37214c5-68b9-45a8-ad83-ca8a48bbdd4e", "value": 695003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763515816, "uuid": "47855b52-96b1-4d1e-888d-f09f2c8a6787", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763515816, "uuid": "132b6436-3db8-437b-9361-40b8d9eab178", "value": "nRequest_for_Quotation_MK_FMHSRFQ251119_pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d112391c-c557-11f0-a129-42010a9c0007", "comment": "Malware payload (PureCrypter)", "timestamp": 1763564140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564140, "uuid": "6c70b8e5-74f7-4cbd-abfb-e541fcec3187", "comment": "Malware payload (PureCrypter)", "value": "72adced5904db37f18743600a0c10f2c", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564140, "uuid": "498768a9-2348-4358-9fc7-fd4cc4d66f77", "comment": "Malware payload (PureCrypter)", "value": "65a950601d22b7afae7c41f34b03f6032125b399f4586edd0552e851c256d7c6", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564140, "uuid": "7a44e300-5d67-4ed7-94c4-73ddaf762d99", "comment": "Malware payload (PureCrypter)", "value": "7a9e1ca5ecece45761552e10598a41a4ea952e7d", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564140, "uuid": "0c26dd77-9db2-4cec-b765-c022a11078a5", "comment": "Malware payload (PureCrypter)", "value": "9de62e92d1bdfda816f9f4f45ae7e3ae56dc274bcb2da9559de94c1bce4769f0820e8fbe1e6824fb4323ff609c16b136", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564140, "uuid": "bf720ef5-0b65-4d71-bf5e-9adb0392ab6e", "value": "T1CCA63368FDF3B48ADC2DACB10965E18BD3456EE694789301744E6B7D0772EC7E31A280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564140, "uuid": "cf024fec-967c-4361-896f-9a45d1b8c1ce", "value": "196608:KIvrnND00rt/EmLrNtSc16yqrLNuTC1d6MQj+A/yOB+DGSbU6G6b1ASL8KbA:KIvB7rt/EmLxtSFyqHNpCXjtKVxbXb1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763564140, "uuid": "d930ac03-8e3a-4b16-8688-b21010379c88", "value": 10387456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763564140, "uuid": "358e0592-49ee-4c39-8c55-90f9d9955740", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564140, "uuid": "2df6994f-bf18-4100-b838-249425ee0f21", "value": "Installer.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a92937-c568-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763571184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763571184, "uuid": "3790008c-a646-4bd2-b9e3-142fd31682b8", "comment": "Malware payload (Mirai)", "value": "e27253336184510f2478e10753284812", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763571184, "uuid": "f2631cc9-dfdf-4aa7-845c-cbae779aa4b2", "comment": "Malware payload (Mirai)", "value": "6628bbcfe826ff7b9ae8bcea80671d947ffc74779cbc9fabfa22ff9501dc6ba3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763571184, "uuid": "e74f940d-98f9-4edd-be18-66879f6b087c", "comment": "Malware payload (Mirai)", "value": "b563c61818f7b17a03655c143324203ec7967ab7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763571184, "uuid": "3f61d988-f116-43ad-9b86-7bfee53090bd", "comment": "Malware payload (Mirai)", "value": "e978f1cb25b1ecfead14918ed19681b2bde96ee0cdda6f997cb4493f90ffcca80eafe5f6cc8b625651616dd0bcbeeec8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763571184, "uuid": "8a1566c9-f018-41e8-aba7-342b4c75fdbb", "value": "T16A639E67C569AD94D14997B4A8B0CE365B23F20492972FFB1A85C3794043EACFA0D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763571184, "uuid": "89e015c5-4084-49fe-a174-529dca144a61", "value": "1536:5auwtcsxscPrieYRUpBxin8IKxFO2+7TSC9YDjug7Ru:5F6xDPvF88vxs7TSDjug0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763571184, "uuid": "54256fdb-13a0-4061-97c2-584b8b12eb30", "value": 70816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763571184, "uuid": "68870e8a-44a6-4077-a444-ffc8e57e8dce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763571184, "uuid": "effbf004-0756-4324-838b-558ea8eb4b83", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c5a8917-c514-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763535168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535168, "uuid": "52031318-6f13-4799-bf3c-d3921d6f6e2d", "comment": "Malware payload (Mirai)", "value": "13c917e75410538f78622a8934ca2db0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535168, "uuid": "7deceeec-4f5a-49f6-ac8e-bc43bbdb971d", "comment": "Malware payload (Mirai)", "value": "67610813f3794bd0cc277cb422d1f9ee193dc3e73d3de9643540a1ced3cb8549", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535168, "uuid": "673adbc6-82e8-4db1-a072-fe70724e52d8", "comment": "Malware payload (Mirai)", "value": "e52c79cd2087d1a989ea8aa2585d9af907983058", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535168, "uuid": "e56653d2-e964-4b83-a69f-de8d8023a549", "comment": "Malware payload (Mirai)", "value": "0a789321f31a9c4cd6bac399235b44c290805c9fbb4300a92281977b7b85124d881c8e7a2f044cc7a80122aa1d9c7bec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535168, "uuid": "1704762b-e5fb-4980-991c-5112093a57cd", "value": "T173A35B06B31C0B47D0A75DB02E3F17E083BEA6D121F4B689691E9B968672E771446FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535168, "uuid": "ebf8b80d-f26a-4004-875d-e057a2242dbe", "value": "1536:G1cNnZGVm4yiB0hzThOrzpeTj9Fn3/hmUprHU4IzM1q6a+Z3EbbxtFZ9R:QwhVhzT+eTXn3pl7bqt+4RbR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535168, "uuid": "aef718b6-f2a2-450e-81e8-528da239da75", "value": 104988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535168, "uuid": "12f3f9db-a457-4fbb-a562-70bcbfb967ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535168, "uuid": "61c6051d-3a03-4bb0-b3e0-0b438c1c7207", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daa3db38-c575-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763577041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577041, "uuid": "713f9fff-4b57-4392-a180-d53b12baa66f", "comment": "Malware payload (ConnectWise)", "value": "8cd7316f4ecec4f253e0ebeb7ddfe481", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577041, "uuid": "8b3d92fd-c736-4800-9091-77e5c1dd3f67", "comment": "Malware payload (ConnectWise)", "value": "67c47dbe7ef041eb1259bb597dd18f17608c0b2e2c56b539c6f3b397b6f2a376", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577041, "uuid": "4167cd85-1de4-4507-a6c5-1b0f8088d04e", "comment": "Malware payload (ConnectWise)", "value": "a6b3ff820e64b6a1c43d9a99644188391b202de6", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577041, "uuid": "e2bd4121-57fa-4e59-9371-b13003a39ace", "comment": "Malware payload (ConnectWise)", "value": "26d52dac7defcf145f4fc39f8d6f522734f65e21997203e6f247c27c0eafc1ab75213b78d5cefb0bad74d3557275163f", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577041, "uuid": "988080e2-271c-491a-b992-3d1ad161ba04", "value": "T11EA6233662E4C026E2B71E39E9794AF25939BC468913C05F533C795E6871E81E9B3333", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577041, "uuid": "3747983a-ac93-41a5-bfb5-84640ce636bd", "value": "196608:7+kLGB1n+Z3/L+kLGB13+kLGB1I+kLGB1:6kqBxDkqB4kqBjkqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577041, "uuid": "49fa5a4f-35b9-4860-b2d1-6866fe5373d4", "value": 10063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577041, "uuid": "72501613-ec06-49b1-8f2e-73edd983dc25", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577041, "uuid": "63b058bb-e84e-4988-a58f-f7e4a95ed6bb", "value": "Docu8737.pdf.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "304347da-c55b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763565589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565589, "uuid": "07f23289-fb17-4cae-b054-adbb920c21a9", "comment": "Malware payload (Mirai)", "value": "feea0b3bc213f4eff7302cb0c9f5eb7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565589, "uuid": "00a96526-a8d2-422f-8fdd-6eeb73090ea0", "comment": "Malware payload (Mirai)", "value": "6836b884ef70d93b60a6f1c7a8d432a9236517cef2d06402c2152d9e9a84fb14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565589, "uuid": "f8a2de30-1894-40d3-bb21-59a93d663fa6", "comment": "Malware payload (Mirai)", "value": "2ecdbacd3d5b43544d34bdadb267e0b6191f6ede", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565589, "uuid": "21a1e359-acb8-4019-90bb-f373f48c0589", "comment": "Malware payload (Mirai)", "value": "05eac265a293aa13cd411ccea683287e56a0d9acdaf120fed13e9d80416e1c3e51d3d89356e60e18e44592fb65c6955f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565589, "uuid": "e0ad8419-1c3a-4696-8281-e0b41c63a6af", "value": "T19B732A42BC919A13C6D452BBFF5F428C332653A8D2EA3203DD256F25778A91F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565589, "uuid": "30ca2362-92ef-43c7-bd13-69904f4219ab", "value": "1536:TVa0pMt5UFKGO3Q+wikGgfUe7SgycNUenQqFfeVFE4vwug7Rs:TVa0pMgBtfUGSgycNUejQVEugq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763565589, "uuid": "d4e75f1b-40b8-4edb-bd35-a2b20f4daede", "value": 79512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763565589, "uuid": "2acc2465-37bd-4b1d-b349-a1ab30aefba8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565589, "uuid": "c7a9b5db-7a95-4530-a365-950375ce5bf7", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffecdbf8-c564-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763569802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569802, "uuid": "3a093a44-655e-488b-88d1-90bff5b2da18", "comment": "Malware payload (Mirai)", "value": "071c2c564595e4e41f2a16f30c8d73a7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569802, "uuid": "3eead89b-1cf2-4ffe-ac4f-2922344d63b1", "comment": "Malware payload (Mirai)", "value": "6860a57beddd492f0b27ff7ff3666f54e4ce91c83578cc1a561bdf1e3a884f92", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569802, "uuid": "d7454eab-5faf-45d7-9d49-591068b7d64b", "comment": "Malware payload (Mirai)", "value": "f8e457925fbafd65c8d9f9b965d8208fa1d77055", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569802, "uuid": "1a77f314-cd1e-4107-8877-a9fea43d48ab", "comment": "Malware payload (Mirai)", "value": "c6fab66760040ccf07eea9362a1723900fcb7ce8b2635f9a95d18fde2278186c2aeb6ceb02402a5d5a26ced2396e6f11", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569802, "uuid": "588ccc0f-a113-4c51-a072-6dd98dbce291", "value": "T18F833C41B30C0E43D1676EB03E3F23D6D3AAAED111F4E688155FB74991B2E325686E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569802, "uuid": "e17f6e30-d3a6-4949-be1c-f55b6bb44195", "value": "1536:wlwMPwyoRwtPHiMSOUkH922JziQrs/9YdAqTPJdemeT:YIy2CHiQtTJeQcePaT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763569802, "uuid": "0d127279-e815-4890-ab29-af37d6a919f1", "value": 83252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763569802, "uuid": "ea36b710-dacb-4b63-b74c-0fcaf5dec09b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569802, "uuid": "b441a188-6cd9-4e2e-9db4-ada5c7783cc6", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c54338b4-c565-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763570134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570134, "uuid": "d54e27b8-ae0d-49eb-9f87-507ddddf9807", "comment": "Malware payload (Mirai)", "value": "4a63d8e22fb594bd3eeb3ed69b2bd2c2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570134, "uuid": "88507447-d9b1-4deb-b079-46e6b78bb1a4", "comment": "Malware payload (Mirai)", "value": "68fcc475742b0e14fd844f6bd18562bb5cc7b5d5a63617f8e74c4c3dd157a1fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570134, "uuid": "629809fd-411a-4e91-998e-0c821f3aed0d", "comment": "Malware payload (Mirai)", "value": "3bf1154c374b505e31dae76a5150d9123c9aaad3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570134, "uuid": "f36705db-a6ee-4c1e-baad-d05367484c8f", "comment": "Malware payload (Mirai)", "value": "d88c1ca2fa7c38cdefa12bd52c06be5ed31343ecd81a911d0bbd8e290e13b3a41f794e0bcdb144f3e412f36420bf5875", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570134, "uuid": "d2736377-0fa8-47e6-a894-a5fc76f4fee0", "value": "T106B31956F9419F11D4C631FAFA9F81493313ABB8D3FA71029D20AF6123CA99B0F76502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570134, "uuid": "3b6d146e-7c8d-4433-afa9-94f8e7323c6b", "value": "3072:tzZMJnIRZRPanYmqwXzw++U9vzXUTBRVL:tzlDPanYmqwDw+PzETvVL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763570134, "uuid": "02f7327c-c495-4968-a582-28aaa12a43f4", "value": 111268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763570134, "uuid": "2c10bf4a-07fc-4f67-a1e4-4f15bba38b7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570134, "uuid": "5fee2f1e-c8b2-4c94-ac6d-bd4aae7b7248", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e94c794-c558-11f0-a129-42010a9c0007", "comment": "Malware payload (CoinMiner)", "timestamp": 1763564458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564458, "uuid": "f40c2f79-e1ab-48d1-a22f-108c5eb7a3d5", "comment": "Malware payload (CoinMiner)", "value": "00292eb09813b07f669b277c656cd550", "object_relation": "md5", "Tag": [ { "name": "bmw4i428-su", "colour": "#EB9E3A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "digital-marketing-pro-365-com", "colour": "#EB7CBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564458, "uuid": "393ad3e1-6c74-48f8-941f-41670c200c9f", "comment": "Malware payload (CoinMiner)", "value": "6a68953c6581b725787472d713690790fb7374f26e4d62888f32169a1813e240", "object_relation": "sha256", "Tag": [ { "name": "bmw4i428-su", "colour": "#EB9E3A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "digital-marketing-pro-365-com", "colour": "#EB7CBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564458, "uuid": "07d76384-b48b-48e7-b0a4-c2cd47575999", "comment": "Malware payload (CoinMiner)", "value": "320b1b27445e5f58e113e43a85ce3df78339438a", "object_relation": "sha1", "Tag": [ { "name": "bmw4i428-su", "colour": "#EB9E3A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "digital-marketing-pro-365-com", "colour": "#EB7CBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564458, "uuid": "22737832-3175-45cc-92e5-e1c6576d2e76", "comment": "Malware payload (CoinMiner)", "value": "8583b54f77f3f809d01652c7fce94d2edb2a61ef6795530379d2d0785d4f6a42690420b6111cc5ebb8249fac6736d2ba", "object_relation": "sha3-384", "Tag": [ { "name": "bmw4i428-su", "colour": "#EB9E3A", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "digital-marketing-pro-365-com", "colour": "#EB7CBE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NodeLoader", "colour": "#E2F2DE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564458, "uuid": "38bd324c-4e45-4bf0-98e5-9186642524f5", "value": "T12C087B4267EA04C5F9FB9A3499E65213D673BC067F3086CB324C172A1F736E09976722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564458, "uuid": "30178809-d96a-44db-9955-26871cd1c8b7", "value": "35686f86a183dc6a9ec694033bf670c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564458, "uuid": "28228c4f-412f-4127-beb4-e4024fd8afc9", "value": "393216:bEI64mShA4qF0mHlhDCDv7aClkNRI147WBK0QSI8w5SvDazn1d5VRx+Abr7nB9G/:bQgbLfQlRXHnysf+tgPdBse6NX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763564458, "uuid": "c1a52eb2-ce21-4667-a9fd-88514d7d1d68", "value": 78331542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763564458, "uuid": "e5a2d445-4569-4870-9778-0bce99d3bab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564458, "uuid": "51c81d5d-2663-4d6b-b25f-9d1a04b211c0", "value": "EasyMaster.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f17d8b5-c59c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763593477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593477, "uuid": "0acf9849-d660-4ec1-a8ac-fca106b100c0", "comment": "Malware payload (Mirai)", "value": "ad08f74ad5c4a7ebee4351a06bf06938", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593477, "uuid": "c08db755-c054-48da-ad49-bb52f7b66018", "comment": "Malware payload (Mirai)", "value": "6bdb2f60a123e87811a1f292ad2b1212a376ac8c9336bf5c0cbdb24d3119923d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593477, "uuid": "e2572fc2-5ff8-4107-95d8-250b253c5d81", "comment": "Malware payload (Mirai)", "value": "65e9b8118ec369cfdedd09914c2d40cec06b8980", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593477, "uuid": "27b4deeb-9e7c-451a-9de8-300a60775731", "comment": "Malware payload (Mirai)", "value": "d454c8a3da3378f48e6615d58d81d299bf58130a79c8bcb620887c8f8c44cc0121e9487d6b6267b2a118c43f35f44287", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593477, "uuid": "73d2ec40-dc0a-4fec-9617-c4ff4841c669", "value": "T169B31956F9419F11D4C635FAFA9F81493313ABB8D3FA71018D20AF6123CAA9B0F76512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593477, "uuid": "a88bd6bd-e803-4b3b-b625-798cfe3a033f", "value": "3072:TmUoOSk0RbaNrCug1b3uS29+zQus0qKlMEL:TmW6baNrCugt3uwzdsEqEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763593477, "uuid": "4c3c5322-3952-4946-93e3-911b4645c82e", "value": 111268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763593477, "uuid": "431f4ce4-ce2c-4842-b792-06b4623882d1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593477, "uuid": "75e8350e-0b15-4320-b572-ce5aa8550f4e", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dcd7449-c56e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763573745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763573745, "uuid": "ea8d2c5a-47dd-42eb-883d-c5eadc6617eb", "comment": "Malware payload (Mirai)", "value": "c47a8f305691177e9a9db61c3f539950", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763573745, "uuid": "30397a57-cf1c-4737-a230-5123e0abce72", "comment": "Malware payload (Mirai)", "value": "6e2be21fb84031d766130e63df54ac801afdcc52963e8f7ffe72681f572a6247", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763573745, "uuid": "1328754f-d0d5-4aa1-b2f0-8ee28b60d038", "comment": "Malware payload (Mirai)", "value": "a159e599456d7468f37795d5400c7243241c71fc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763573745, "uuid": "2e370684-c27b-4d40-9291-38bef9121f73", "comment": "Malware payload (Mirai)", "value": "876fe2afba7bc6ea3d668cfdeaf03cce34533ce36d7eee6087ac5c3b0f8b743eba0ec9f26af283cf1bbdb2f81be32dcc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763573745, "uuid": "bb413e8d-cafb-44cd-8c40-07deb8b27fc1", "value": "T13E933957F9819B11D5C116BAFA1E418E332307B8E3EF72125E20AF2167CB56B0E7B506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763573745, "uuid": "95b193cf-7818-43f2-86f6-bd54ed6515dc", "value": "1536:4stnshZaPOoVf7/i5A+VlhzPY7O5Gpa3aaAw3nhadDilEZKkWSO7zxUYLf0emrM:4p7aPyA+jFKOIpIaaAeE0kWSOPxUC5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763573745, "uuid": "c20abe1f-20fa-464c-ba11-aa53a1591966", "value": 91344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763573745, "uuid": "741cf635-828c-4b5e-b770-0ea3b0bfdd86", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763573745, "uuid": "023a4796-5ed4-4025-bfb5-e2e1a27e5aa6", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c215dec-c550-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763560911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560911, "uuid": "285153f3-157b-4ef8-9836-837ec296f7f7", "comment": "Malware payload (RemcosRAT)", "value": "edc8dd932a5ffe7673cae05db52fc525", "object_relation": "md5", "Tag": [ { "name": "46-247-108-59", "colour": "#EF2039", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560911, "uuid": "f2af58a4-ae2b-42ae-81dc-ab2a4a7f5d04", "comment": "Malware payload (RemcosRAT)", "value": "6f52e6c46213bbef26c41be5f5a50c05584b53c4865d65201fac82908ee906ec", "object_relation": "sha256", "Tag": [ { "name": "46-247-108-59", "colour": "#EF2039", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560911, "uuid": "993d1633-48b9-4e1b-ae12-1c47ae08e20c", "comment": "Malware payload (RemcosRAT)", "value": "67fc485a593d1cd182f57c89bf03c5bdb80191ae", "object_relation": "sha1", "Tag": [ { "name": "46-247-108-59", "colour": "#EF2039", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560911, "uuid": "bc340568-a5fb-4be5-b7d6-149cbc44b147", "comment": "Malware payload (RemcosRAT)", "value": "cd35132dd31e57d1387dd5a25cb2b257ad6c61ef09b7a7c8cf33a1fe1012185aee4c55595132f5696a40de83bcbb144a", "object_relation": "sha3-384", "Tag": [ { "name": "46-247-108-59", "colour": "#EF2039", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560911, "uuid": "90f7feca-29f1-44f6-a353-48a39a9691e0", "value": "T19C55D01273DD8361C7B25273BA257701BEBF782506A1F96B2FD80D3DA920122525EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560911, "uuid": "4082be32-6123-430f-bb8b-31990431e99b", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560911, "uuid": "89743720-cbad-4c0f-9d70-9024647d0827", "value": "24576:ltb20pkaCqT5TBWgNQ7aaDMGSi8dSshF1SmzejtIusRT6A:WVg5tQ7aaRSiglhF1SnIBd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763560911, "uuid": "262ae638-9e3b-4560-ab21-eb8f50f44fe0", "value": 1282048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763560911, "uuid": "ae119e39-d712-4742-8327-6125871d1618", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560911, "uuid": "cc815b36-4104-4d53-b761-5ccc330c1a37", "value": "5107634802.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee788c4f-c57b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763579652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579652, "uuid": "ae7f3818-2827-4ae5-9a29-65617099b76f", "comment": "Malware payload (Mirai)", "value": "ca7235692f1c497e3fc32dcaddf19525", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579652, "uuid": "4590a192-7091-41a2-ae6c-da0328a1a5d7", "comment": "Malware payload (Mirai)", "value": "6f60b7c773bcb79b2a327e647eba6e5e21509447e1eaa6418434d62a17be51ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579652, "uuid": "07d6cd08-d5e4-406e-a8f0-f09b5b7e44e7", "comment": "Malware payload (Mirai)", "value": "f6c04f2c7a89f024c4c314cb910359748fe2cbc9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579652, "uuid": "1e73391b-6ee2-4820-848f-edeca5f4d7a1", "comment": "Malware payload (Mirai)", "value": "bd8497345fb420b9b083191bfef15a35a1a489e3de47a9541b0194caaa607254be78334e212016813d6fe1c9a6879ee7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579652, "uuid": "6ceec73b-1576-4f09-99f2-101109cb258d", "value": "T1B1B3F70AEF910EFBE86FCD3706A9074535CC691A12B87B763974C52CF25E14B0AE3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579652, "uuid": "e68523e9-f8fa-426e-816e-1cadc761de47", "value": "1536:0kxTuCsOZ2bQb88vwTjWBp1TXiKneie8sYdrsj5X5dyiKU3aEPX+5pFcY7Qy2dq3:0kxCRbQbj6WleoeiPsKhfVwq2dM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763579652, "uuid": "21b11819-b01c-4dd9-9253-cae2abe0808b", "value": 107868, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763579652, "uuid": "456b1fac-c19e-4870-b882-92b23b25b574", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579652, "uuid": "9ec7b1ac-b55b-4f57-baa9-48b7feb9f35b", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9fef9e5-c575-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763576987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576987, "uuid": "b844ba07-bfa0-487d-9185-32def7f6daea", "comment": "Malware payload (Formbook)", "value": "29a4e4dce1fc450d8ac210f4a7ba52a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576987, "uuid": "d5cafbe3-501d-43c7-8203-90327581ca93", "comment": "Malware payload (Formbook)", "value": "6fb40a7c2293fa13338c5463ca1daffb588bf523cc60ad0e4b206d03438012c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576987, "uuid": "bf416dba-2b1f-48de-8c28-56213231c2c5", "comment": "Malware payload (Formbook)", "value": "c6d538d3b950b3d1bbcbb8e34e76c955bdee130c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576987, "uuid": "40024110-452f-47f4-99f1-98ea1b958fe8", "comment": "Malware payload (Formbook)", "value": "d25e2edfcb939a0864f719550138f7c28b453c7245b1f4dca7a356cb548cef2b5bdc1376b6cef4ddf64b0b3ba1cf398c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576987, "uuid": "6c92a9cc-ffd9-4384-9709-c8ba7490e7cf", "value": "T14E05129A1A08CB2BE9E787F12D72C37507B42E9CD451D7878DEE5ECB7820721A940367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576987, "uuid": "a714392f-476d-4cc6-9884-c1ae97b84884", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576987, "uuid": "5622897b-5019-4cdb-9e25-0fae4305fd73", "value": "12288:VE2iNFeRPA6/OxTB09BB325kQQfoFzR9cwjWf12YFIyScGQhbKj2rVMrs:VE1f+NYTi9BsFGoFrTWf1tGQ0IYs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763576987, "uuid": "608265ae-e89c-457e-857c-f84dcaa03cfd", "value": 869888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763576987, "uuid": "42d044f2-d9bb-45bd-aeaf-3aaf7c30aa65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576987, "uuid": "ca966870-dd2f-4653-80ac-d2b31a2ec963", "value": "UmcqtTJ5pAzy7Qk.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcc30f6-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589720, "uuid": "aa17d05b-71f6-4770-9e7a-e1930116c754", "comment": "Malware payload (Mirai)", "value": "fe279581022a80ebc98c4452dbe0fd3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589720, "uuid": "2269931a-d47e-4c5b-a91d-282e2fa3a031", "comment": "Malware payload (Mirai)", "value": "700842323b582df5df7144083b602b167a94495e3f4343cecae383f9e2b2615d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589720, "uuid": "eded5b53-4201-48c6-b5ba-13a49f98d3b2", "comment": "Malware payload (Mirai)", "value": "1a1b16a697905324f139ef445641badb289cbaae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589720, "uuid": "094988d7-d618-423a-856d-55ea1a5585c9", "comment": "Malware payload (Mirai)", "value": "c059b697d8462d96c384a8a1b029be1c08feec627fcae4744a19ab0e237b7b37cb0f34565b8508c8e1920335d82423d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589720, "uuid": "3114d53f-0ade-45c1-8c18-ccec021a9079", "value": "T1E723028E96DF8FDDC6CC7078F16E26CB202AD75C164588F62A8C410AF244FAC76187C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589720, "uuid": "8cdd0d26-7ddb-43c3-a9d1-9d63769826ab", "value": "768:6Mxa+Kqs+LOFt47TbIX29hPd3UBq3jTOXwFD/uxKb2eprcmDR6I+gUDTWVnvnbcm:ja1qsf47TMX0EaTOXQDLH1cu4I+gfvnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589720, "uuid": "b75f14fa-230d-41fd-8e38-998cefcd57bc", "value": 46928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589720, "uuid": "16d9328c-a855-4699-9ac9-adc1c20b818d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589720, "uuid": "c9d106d1-1905-4e1f-87fa-941f1560c776", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962a0334-c513-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763534836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534836, "uuid": "dd0062be-30d9-45d2-b6ce-731362cb1a67", "comment": "Malware payload (Mirai)", "value": "5caa1ad549ad23f4f2411175a48aaef5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534836, "uuid": "8b59b2fa-1586-459d-b068-cea4cac648a1", "comment": "Malware payload (Mirai)", "value": "70182483f1ee1973f0fa6f1fea38974a19badb8d899f136dd89bc65a6ea82fa4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534836, "uuid": "1d607710-29d6-4eba-ba4d-e423c77ad15f", "comment": "Malware payload (Mirai)", "value": "854aa41fae5688b92b9bd0913b0656b830d65320", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534836, "uuid": "47b3bafb-0d72-478e-ac6c-6927f690edc3", "comment": "Malware payload (Mirai)", "value": "40f4064a384416ee4d1808e7958653542491bb1566ed6a597dbdb5c613d54597bc3ad8d1a22eadad39fdcf736408b754", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534836, "uuid": "38b4e97d-75d1-4cbb-a885-db8c5c2cf700", "value": "T1C423F170E4D8BCB2D159447D78BFCACA5953103545AF73B8842A637CA5C7A7B0070E99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534836, "uuid": "51fbd46f-9e9e-422a-ac60-e23fec9bc49c", "value": "768:h0C5U2BV7x0swTwxMIYSF+UtqAsySsgWGeTyqkzhnua2I9EuCwZ9EsvVHzkG8hlf:hnU2BXLwTszttqARgWx0nua2I9AsdTRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763534836, "uuid": "90a85a9b-7305-4194-a06a-f228d287681b", "value": 46532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763534836, "uuid": "ceaa5827-8c0a-414c-be05-b8125866325d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534836, "uuid": "5d57f8a3-6245-433d-aa99-da9095769af7", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dbd6a6-c513-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763534837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534837, "uuid": "6dd37112-1be5-456a-8c29-8e6ea66a3fa8", "comment": "Malware payload (Mirai)", "value": "a6cb6ed95c5326115c7e2b5c8f29df52", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534837, "uuid": "df6d599d-01d6-456e-b0db-9016ccc05d80", "comment": "Malware payload (Mirai)", "value": "70218fd00cefc876899d896229a28b7ce28c9b0e7bee568ab717f4f96ed5d85a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534837, "uuid": "cf0148d5-dba1-403b-9882-ca25a93fbf15", "comment": "Malware payload (Mirai)", "value": "ba22438914f496e1f8f132bb07e92aa5ca9699f2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534837, "uuid": "49c85ec0-72de-46d3-927e-c5df3c9ab2e4", "comment": "Malware payload (Mirai)", "value": "040904a4aa9f32ba2d15bfeca37b94e6ff0614e3231ec6cf7e7bfa8077cba26c98d0fe5758212736cb0a62c1cdf2be8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534837, "uuid": "8df7a0b7-d0bb-4768-8065-72a91e0ff598", "value": "T10A23F0AE9415674EEDEF9537802E0B2E8909F032728F578D13305DC99293E4AA5D427D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534837, "uuid": "1f195da9-78bb-4d90-aa60-cbb744f57468", "value": "768:7XaQ60FS6J8GZee0bdc5u+pgPEvDUZ0SrIOCn+JqIOp4d0qGxWPy:7XaxWRZZR0BspFCsBp4K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763534837, "uuid": "de1ad292-ce99-44b2-a0ef-f8dddbec01e7", "value": 49776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763534837, "uuid": "a5d3f7e2-e3e2-4cb5-b280-04464a36997b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534837, "uuid": "9c868d29-7337-4e0a-a1c4-8322c052449d", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a60285a-c514-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763535165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535165, "uuid": "28bf7adc-28af-44fb-acf9-b3b051076ee2", "comment": "Malware payload (Mirai)", "value": "ed96cdc29234c15f2b4b7f2fab7bdc4b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535165, "uuid": "86fa08a9-3d22-4170-a51e-c68569baf2e5", "comment": "Malware payload (Mirai)", "value": "70d212375cf9e1ed23327cf877aac8e29cc54efba15c37600d46c22b829baada", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535165, "uuid": "55e6d9f5-67e5-4dd2-b039-0d40549113ec", "comment": "Malware payload (Mirai)", "value": "800d253f1875e26368aed5a28ef142fd5abfc927", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535165, "uuid": "fcf2619b-57ae-47da-9af1-c3c237c92e2a", "comment": "Malware payload (Mirai)", "value": "0b703a54584d7aa010dc743f374abdbc5aa301237a377666fc1b1ac123c377b2fbfc546948fa1f5513b882fd6449fc21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535165, "uuid": "fd58a4cb-9545-4e4d-b3d8-cd0fe3973c2c", "value": "T1F4630992F8825767C2E023BAB6AE968D336273E5E3CF7117C92047157B8591F0D33A85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535165, "uuid": "28f3d849-a8bd-47e0-b765-78c5290e844c", "value": "1536:x638qO8pGxjGkrrTobFxAybSYBoEAX6N4f:R8pGxjGCGTGxKCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535165, "uuid": "a4fdff38-675c-443e-83c7-61b4bb85d92a", "value": 72088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535165, "uuid": "b5373fd7-1be7-4245-b804-97564358b89a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535165, "uuid": "4ef2d3fc-0e7d-4d17-8c98-58a8cb16deea", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a443cb6-c558-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763564290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564290, "uuid": "dfe90120-b128-4c1c-83c7-3ced9783750c", "comment": "Malware payload (Vidar)", "value": "a1d040eef2db7821562d3c15c0f1b34e", "object_relation": "md5", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564290, "uuid": "5280097e-da06-4b2c-b2e8-e769e05fb030", "comment": "Malware payload (Vidar)", "value": "7132556008221a4eff0c8a586e48bcceb41b50e941e737fb90a0993823e26668", "object_relation": "sha256", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564290, "uuid": "3d9fbb00-15b8-4dc2-bab6-4f1d77af02db", "comment": "Malware payload (Vidar)", "value": "ec977491845343f46808ac488c5bb2447eaabe63", "object_relation": "sha1", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564290, "uuid": "9f65f746-e0c9-484f-891d-6f76ed6177e0", "comment": "Malware payload (Vidar)", "value": "d4a0241fbd14d3c0b548606084565429f9b35c8a65fc23e662e6644dd057ca01cb10cfba10dd6db88e6329658b8c68d1", "object_relation": "sha3-384", "Tag": [ { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564290, "uuid": "635018f1-66da-46b1-97fa-a357def0e4c3", "value": "T159082BF7641CB06928470193F6EA8B2D371ACE9D61275325E6DCF0DD412E8FB824AD1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564290, "uuid": "648e1ee9-6fbe-4ee5-9ebc-b9678d37b3af", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564290, "uuid": "5149dec1-4654-4acb-b256-00a947b0988c", "value": "49152:Qji0DTa2FzeaklancP8YI8T/MV5MXDYpCY2djGVa9PbuN/:gDfzeakocPO8T/M9CYU9Pba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763564290, "uuid": "93338574-4585-4349-8ee4-b909099ef9ab", "value": 83897369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763564290, "uuid": "ba82d630-b6b2-454b-9ce3-1e92ad2c80f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564290, "uuid": "b066bbb5-e380-46ba-9414-87a145b18b9e", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1b0ede-c564-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763569529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569529, "uuid": "e5cea419-2aa9-4adf-9152-86623d2c02ce", "comment": "Malware payload", "value": "5c71f842fc7d0e949910e4dd3251bda4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569529, "uuid": "86989a11-dc0f-4082-8612-ddd0aef6c289", "comment": "Malware payload", "value": "7139bd889d0406d0135e246cb9dc5554bfd4377a93990f5e458de88a167ee5c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569529, "uuid": "fa2eed12-b832-4b2f-9bd6-e6d1172b2c52", "comment": "Malware payload", "value": "d18605b79550e7638e5ef8fd3963984b2349d880", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569529, "uuid": "61e5fbd6-8947-42e6-a410-f2c2b66ff8c6", "comment": "Malware payload", "value": "2a49a5023e38a384a4dc994aba50923809fbf3ba69a187c759c475339e83a3ae658223c15d80c18137b4374c7f432113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569529, "uuid": "739ff129-1445-4cdf-9f29-91504cbc96c5", "value": "T171451B1AF6A611F5E0B9D274D9632127FD7238958338A7DF47809A0A5F31BE4DA3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569529, "uuid": "4929d332-47e9-4b57-a558-5bb2e15fbed9", "value": "54e492bdd3d6051d9c6f63eaf6aac704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569529, "uuid": "d8998310-b704-412c-aa6a-a1c3519e35eb", "value": "12288:GRuZubyp0hXF5AT0e1YZenRVE33GiPY5ociR5miXhRILpaWnxVtm+gOOz:GRuu1h1KmERVE3nuociRWLpakGXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763569529, "uuid": "8a34c3ff-d346-4703-abf2-1d1f5a71f057", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763569529, "uuid": "db5ac47d-a726-4c64-bba8-da3f7e087cbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569529, "uuid": "42fed781-b437-47ef-9d7e-1517d4ad9df3", "value": "SecuriteInfo.com.Win64.Evo-gen.99933263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65805212-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594884, "uuid": "70d67f77-9461-4d02-a6cc-73b5c80cda81", "comment": "Malware payload (Mirai)", "value": "4c7129cd8277db5e0711bcd20357c455", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594884, "uuid": "38defb41-18cf-4a35-80b8-bccf692bfda7", "comment": "Malware payload (Mirai)", "value": "717bd140570e25eaf8cbe7cb15322dd33117d851b813c55ce7dcb44806d37ff5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594884, "uuid": "814166b1-da82-4500-b71a-dd3734089565", "comment": "Malware payload (Mirai)", "value": "8bbc5c3bc5036937c809f9e09997f52f96c44d31", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594884, "uuid": "2e138f20-9402-4950-9762-511b560d7114", "comment": "Malware payload (Mirai)", "value": "50c5819389ae9d3fc2d12e0baf3d1f075c9390d95374992827cb4fd708835f10c8c35bc6abb1caec8d422f993e354d88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594884, "uuid": "b7e2d938-93f3-4a6c-a61e-deffdcbabd07", "value": "T1B9B36C21B4391E27C4E0947B22F74766F1F617D924A8CA0E7E720E8EFF256503647AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594884, "uuid": "46da3563-9640-4963-8890-f49e440c9c9c", "value": "1536:Pc1EZR9LVRmL3w6ONcaaToLTMIe5ifm6p79jwYJPtGs+X07/tDPYm5MeYMFJit9c:k1aXhVPfFp7jCs+kL9PYOMvJq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594884, "uuid": "11e95cfc-e30f-4358-9299-bf0a8e729bb0", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594884, "uuid": "dd0f9222-ceda-4565-8c1b-c7fd011546cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594884, "uuid": "302ac008-9882-4952-b594-1f70831da793", "value": "S3o.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea05764-c59c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763593530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593530, "uuid": "f3d0db49-a26d-4426-96d9-824996e67e12", "comment": "Malware payload", "value": "6f3767bc5cb5da9fba2c499de99e9680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593530, "uuid": "5526baa1-207b-46d4-b1a5-2f84a95809f6", "comment": "Malware payload", "value": "718363de3fe6afa820c181f5797d006a0f2c5ccc0acb4b5515ab03b77c28a39c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593530, "uuid": "f5cf5171-6fc6-49d6-ab79-2a58e8d8fc90", "comment": "Malware payload", "value": "62be23f8c51e505b62db12600cb1db98e9c4daea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763593530, "uuid": "4b15801f-1bbf-4c51-a160-d007371832be", "comment": "Malware payload", "value": "1dc178acaeef521bd0c8d3c15deb2dbaa3639184564246b8b341080b440768a9aa84aa89b256cac892f535668bd3a5e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593530, "uuid": "aaf40ff9-7a0b-40b9-8f49-a099fb13593f", "value": "T101D45C7AB490D142F918C4B414E1AB2DF921B07286752AFF099091A3D95BAF08FD53FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593530, "uuid": "4061715f-3a15-4fe8-9e9e-9190ec098827", "value": "006748064ae2ea0b7d198ab8c4d5aaa4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593530, "uuid": "badc21ac-d7f5-4400-a268-79b3f2bb890c", "value": "12288:B3QMO9+az7+lw7uEcj2s7NUbQaR4Zl5re/I/Bu48CXTq:lZO9+az7+lw7uqs7NUb09q/c8GT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763593530, "uuid": "39d7e404-8cdd-4e61-a403-63d0aebd8b3e", "value": 607744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763593530, "uuid": "01748044-3a16-419a-b886-7eb9b1d30224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763593530, "uuid": "ac51f0f0-948d-4a2a-b81f-b5b7a17159ed", "value": "SecuriteInfo.com.Trojan.PWS.Steam.38543.8568.14741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e00d68-c577-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1763577545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577545, "uuid": "a88a414f-7878-40e8-b102-71ee8fec7f7a", "comment": "Malware payload (GoToResolve)", "value": "7ca85982b9e7fa32317c1f8aef1ce09f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577545, "uuid": "66cd3119-9c67-46ba-bffc-c51d2dedd582", "comment": "Malware payload (GoToResolve)", "value": "7290221af95be2e0c07edc2ea80dc710cc5fa586a70c82326a68ccd302528492", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577545, "uuid": "33b10eac-14c9-4c90-8cc0-3c434172aada", "comment": "Malware payload (GoToResolve)", "value": "7976886dd9ed0440552ffbb1222cd304c54406c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577545, "uuid": "5edffe8d-8327-4d2c-89ed-883c7b013ae9", "comment": "Malware payload (GoToResolve)", "value": "c416a4e7d1648a3e2fb272fa3282597933d0dea1e0af1b86b1875d4ed8678010cb1c726ac4d6b09fe145d06d8abed71a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577545, "uuid": "742b2699-7ec9-4512-8d97-e7ef1e36b195", "value": "T10237333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577545, "uuid": "5ab1cc5a-3380-4e43-a0c0-6f1f0d4edd32", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577545, "uuid": "261c6cc2-c239-4ab6-bee6-ba0c3dcdaf39", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXp+:q9WtLzgOTbjZvk/ekS/mcp+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577545, "uuid": "976db913-36b3-4d12-9b22-beb495f467cd", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577545, "uuid": "c71b9445-3545-4cf4-aa2d-aa4bbe9357ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577545, "uuid": "9fae5abf-08a5-4bbe-bcae-a0b040237acc", "value": "Company_Develpoment_Proposal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5a49cd0-c58c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763586885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586885, "uuid": "c1098835-be4d-45de-9bc7-e158dec83882", "comment": "Malware payload (Mirai)", "value": "dd9be80c35b6738a94242ca5407cffa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586885, "uuid": "1c9b0999-7c27-45e0-9a7e-8a13afef1768", "comment": "Malware payload (Mirai)", "value": "72f03be5ac97eabf10c70f65d64144bae093507044816566d77e685255f705ce", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586885, "uuid": "d894c79d-07f2-420c-898f-618986ab794a", "comment": "Malware payload (Mirai)", "value": "9d5447ed98f70055cb9308d2ba8eeef57df3d70f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586885, "uuid": "a2e2641b-4275-4435-8e65-c2de9d6352b2", "comment": "Malware payload (Mirai)", "value": "03d373d08a4cc170ba37fbc9e2b19663cf54481f03cc0dec190689c143dd06a9082ef4e70bb00466a1932544213f6789", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763586885, "uuid": "d2b677e8-53d6-427c-b06b-f9b9c89fc163", "value": "T17323F143517C426DE7CD613768AE241E8411A20C529CBE6B21CC7AF6B82FACDEF18775", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763586885, "uuid": "bad32abe-566b-478d-81b6-bc69c9461f1e", "value": "768:n63P4UIZ19U7OORuUkKVYHv8VUHu4xvPexhb6UdqOnbcuyD7UHQRjo:nQ/R73QoVqv8VUDvPIh2UdqOnouy8Hy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763586885, "uuid": "8f7e4b9f-21cc-4d30-ae90-3f640d573927", "value": 48036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763586885, "uuid": "85c75b58-ff6b-44a4-98e7-08e4143c0108", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763586885, "uuid": "136aa43a-7a98-4c7c-998d-63bd50db4ac0", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a7414f-c517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763536518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536518, "uuid": "a1b6f233-69d9-4f46-923b-316e0592bf1d", "comment": "Malware payload", "value": "c802f2233fe42a79dc8bbac801874386", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536518, "uuid": "61fbf3fb-ad17-4eb6-9522-bb2078ba352a", "comment": "Malware payload", "value": "73054f1bcfa67fa27db7e95cbbd59de8a630ca09826ff7bacc738c0300c119c7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536518, "uuid": "f863dac8-830e-4a8b-a734-306acd1b6ac6", "comment": "Malware payload", "value": "0f379b23732b889fcc5ea1d2fef485c9a252f99b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536518, "uuid": "80b5cbe8-f51a-47e4-91b0-6fa860462a99", "comment": "Malware payload", "value": "b1908f9fe1e6e80d58c5504c5baedf592b52997654cf0202a84c392c05c8b358e838d79869cf22982f0d9df38fdf4c70", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536518, "uuid": "6995d524-4f28-455b-97e3-22001786d49c", "value": "T17F762306FA19B56FC4F3D33308B0077A2026DD2AC793E787652973B529BBAE44B456D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536518, "uuid": "e946aee0-edf4-409d-9cd9-926b7a0b70e2", "value": "196608:OKm9gtYGLkrPyjlDwYa+eIDG2yvmOh6qPCuKKg/lRNCAUTQ0R5DU:tmGtIPeT/DGpuOAqHKKMRNiQ0R5DU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763536518, "uuid": "f7dc3ef5-5732-4840-a7dc-2e1db41bf5e2", "value": 7510555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763536518, "uuid": "5377b7ff-e023-4f08-bfe5-869e84fc368a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536518, "uuid": "89972135-48f2-4773-b2e8-622656e08335", "value": "V6.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "444c6925-c4f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763522243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522243, "uuid": "716c3fee-6301-41bf-80d3-97558e423b75", "comment": "Malware payload (Mirai)", "value": "f383cdc5d4a67f74659f0c12b22d372f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522243, "uuid": "4dd72652-f9de-42b1-824f-63c0267e57c8", "comment": "Malware payload (Mirai)", "value": "73e7ed2204e83835c33cf87c011999a26db9ba3fd56d4e89270fa92a091c48db", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522243, "uuid": "255f97a9-72d5-4864-a071-7205e97339c2", "comment": "Malware payload (Mirai)", "value": "f058571375e51b108637660dbf30f93c4ae112d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522243, "uuid": "b632b789-9949-4821-b9c7-1655374b1dd1", "comment": "Malware payload (Mirai)", "value": "3bd8cdb3123aed21aa4757295e888b64dd28e328f0d8e6479220484c8c6cbe190e1ea3892f47f37ec5d66d25881cf331", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522243, "uuid": "2fa1b8ca-368c-4197-a6e6-3732693026dc", "value": "T1B823E891BC819E27C1E0137AF9BE558D372077E8E2CA722BCD610F113AD652B0CA6F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522243, "uuid": "6fdd9c3a-443c-4de2-b70b-fe12300cf29c", "value": "768:GzX+Y5BFSkKDjLxx0H0A/qwOrxuMmsBZQFgvStfqM2BJ73lugoz3e+1mA2EDEy0u:wPF/KCrSwOoMmsHpvStfqVSmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763522243, "uuid": "a970ec23-d16e-4d0c-b5a7-d84a0062ab36", "value": 46300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763522243, "uuid": "f742374c-7d7d-44ea-9678-5b5065c08a56", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522243, "uuid": "a5c030b0-1344-48f4-8035-362fc4c9fd54", "value": "boatnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b84c7a-c57c-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763579853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579853, "uuid": "7d95cb8d-ecdb-4d55-82e5-e49aaee8983c", "comment": "Malware payload (RemcosRAT)", "value": "ebbf9ce4a5373b7f86816861a4dab5a2", "object_relation": "md5", "Tag": [ { "name": "46-247-108-59", "colour": "#EF2039", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579853, "uuid": "c7de8fa7-8bc7-4a6b-b353-305bc4df4795", "comment": "Malware payload (RemcosRAT)", "value": "76d044f510603caf6b128599efdbc6db7c6aa83f26412139671253b9a996b3b0", "object_relation": "sha256", "Tag": [ { "name": "46-247-108-59", "colour": "#EF2039", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579853, "uuid": "c6f9749c-10fd-4127-a453-867ffb40cdcf", "comment": "Malware payload (RemcosRAT)", "value": "179dae7868348ff4f6dcb921512d020d7923d3d9", "object_relation": "sha1", "Tag": [ { "name": "46-247-108-59", "colour": "#EF2039", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763579853, "uuid": "ca59de9d-104a-4de3-8661-426fce596feb", "comment": "Malware payload (RemcosRAT)", "value": "f7035156015a8e2b766ece92787cb24e97ca9ec89de7b61da6394ad15327e4d17e79f9327380cfe77c19df425098bdf5", "object_relation": "sha3-384", "Tag": [ { "name": "46-247-108-59", "colour": "#EF2039", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "Spam-ITA", "colour": "#DE8A25", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579853, "uuid": "bc589234-0049-4fe2-bc7d-659f0d80ff46", "value": "T124F433563B73CA3E698C15168BAC550EFDCB20BF1C1FCD112B7DE245AE888972E4856C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579853, "uuid": "012e01ef-f578-47d9-ae2d-4880a6834ca4", "value": "12288:pr5w3/NZjCnkSnTMi3hR/UFhc6r5ZD/8BU1Kq1QNYELoZ889/SeNDDWAe9NCSWYj:pS3un3Tj/X6fD/h4fSgK1dSe1perCSZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763579853, "uuid": "7d688b29-aeff-472b-9a3b-1820b4b9f93a", "value": 773845, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763579853, "uuid": "62cdbb12-4b96-4c75-84ff-ad869af6ef58", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763579853, "uuid": "51ad9d49-7ef9-4337-951c-2d7ac4611ed3", "value": "5107634802.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45f45d7a-c514-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763535131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535131, "uuid": "bd13e37b-0005-4f0a-b3c8-85c170bff854", "comment": "Malware payload (Mirai)", "value": "9b16f003a3d31261f983ddcae53ed6f3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535131, "uuid": "74ecc53c-9cd1-40c9-92e7-e94ed3d13e97", "comment": "Malware payload (Mirai)", "value": "78789b4155e09e301b8f4d2ea94139fc7bc2a74e71893ec842b34a6422e2e684", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535131, "uuid": "8cc6beba-d2d5-407c-b7eb-f3ff31f5e2a7", "comment": "Malware payload (Mirai)", "value": "f9236945ea776f235dba9a0b0213c422136c8247", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535131, "uuid": "29a6e358-9122-4a62-82c7-9d47e09a2fb2", "comment": "Malware payload (Mirai)", "value": "ae1b399a0946ddc77bc373f6aa1443d69c935804f3a7d0a60d3562a8c952e2d5d5c59b19a4a7f3bb09dab216ab544928", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535131, "uuid": "10823cb6-d315-42f6-ac8e-c6ae7fd45eff", "value": "T185B35B86F401CE7DF84FD77B44570E0AB530A3A146831F366667BE63AC321A46962FC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535131, "uuid": "690ee9b2-3647-4840-88c3-8f3b4d3b89b6", "value": "3072:p5VFSJZI/y/v0y9Zt1ln2HInk3Dpvdeu8Y:qMy9L1ln2on4vgJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535131, "uuid": "c716eb7f-6b7d-4e64-8de9-e5d1d6e83905", "value": 108980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535131, "uuid": "0bce2202-ffdc-487d-b090-cf51436a35d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535131, "uuid": "52547954-9ee6-4517-969e-98bd7e4140be", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcdc09e-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589717, "uuid": "d2b31fee-38fe-4b47-bd44-e60114ca7848", "comment": "Malware payload (Mirai)", "value": "8a808be8296d0dd325d65d48029ccd41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589717, "uuid": "2bee1f91-de89-4fba-9ca8-695d06e158d7", "comment": "Malware payload (Mirai)", "value": "78ac4725a3fdeffee93d194062e4bb7a9bf6ade097e01c1f22879e66cb566641", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589717, "uuid": "d91fc34b-aa5f-4a24-8f32-522f68db52c3", "comment": "Malware payload (Mirai)", "value": "3488ea92ce6955c3ad2991f6f2bbe7276575e76f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589717, "uuid": "4f6ea8c5-04ef-41af-afc1-fa86e83912fe", "comment": "Malware payload (Mirai)", "value": "b5b2e4467da9a8a320c2d83e7210964fda5be8354a1e7aad82586c568129ea677a9d0e1774cf1f528d724723f9d6936e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589717, "uuid": "16e8808b-d494-40d1-8fe9-60b760612239", "value": "T14E13F1E0E9E4AA85D99C8032117D7BFEB010936CB41ADD8B868021F7B87EB5E1E141D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589717, "uuid": "0e75d2a4-5354-4804-b169-7d8801218e42", "value": "768:aPVsvPr3Jsdaxs9r8mBn09VHzjRnX9TA7bX+GBpDi8t/8g6MYGnbcuyD7UoQRjp:ysPFpslD+5xp2OkD71CCnouy8oyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589717, "uuid": "186f7dce-baeb-4f35-851a-c79d9f18910e", "value": 45080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589717, "uuid": "1efb1824-0ce1-4e2d-a73e-d4a358bf6c33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589717, "uuid": "d6c76674-48f3-471a-aee5-1e0016276710", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df84274-c57d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763580295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763580295, "uuid": "2e5a02d3-1f87-41dd-b415-436c5853c650", "comment": "Malware payload (Mirai)", "value": "bf3301a6ee404ca3dc4ed55090ca02a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763580295, "uuid": "f4462bc5-f0e5-427b-9eab-76800b5996f2", "comment": "Malware payload (Mirai)", "value": "7ac845ff8d1b6b557e410966284686e065d33d2eb536a90ecd138a03e3fe7349", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763580295, "uuid": "06709845-afc3-45a9-9ea7-9399667fa4e5", "comment": "Malware payload (Mirai)", "value": "625daa7f62c4e7a692a2d9b28d23d3dee9818762", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763580295, "uuid": "5dcd4789-99c4-4107-9fde-278f3d859133", "comment": "Malware payload (Mirai)", "value": "e325db439ba1cf3dcb47c4f03a0b74407de0644da0abcb52160ef4f5583ef95b60766d2f5b2ca9bd23f78060a0be91ac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763580295, "uuid": "7fb26e4b-5b8c-497e-947a-de84be2d924b", "value": "T1DC737DC6E783D8B9FE6602B56137A7374672F6390029DF46CB28BD35AC16601B31A35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763580295, "uuid": "4fa5be15-15c7-4be7-b8f4-200eebae0d6b", "value": "1536:aIOU23pIpcz2XwS3xM3USfaOaf/JzZTWKP7CEn4AYmQc/6:At3+WS3xM3UtOa5zZ6KzbnI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763580295, "uuid": "a6986190-4d7b-4e92-9118-299cb379533d", "value": 74740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763580295, "uuid": "d3922079-e832-4c57-809c-ec7b03254e52", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763580295, "uuid": "e4bc0c43-abeb-43e8-a866-2fd6f0f344fe", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9cc97c-c54c-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763559169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559169, "uuid": "e8f4c9c9-b36e-4f90-a5ad-e5f2a68112b0", "comment": "Malware payload", "value": "067c7ac4b7ae2383dfa913fa8bccaaba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559169, "uuid": "698059f0-86a6-4355-b2b5-36a38c434ae0", "comment": "Malware payload", "value": "7b196908ea1003b77adcf58210e0ea71d6b04724244646e3818e890c14706c13", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559169, "uuid": "40b5807d-1de6-4649-a1bd-0371b4064934", "comment": "Malware payload", "value": "4e5ff1d091abcaf7a09a031485926c6d20a3c825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559169, "uuid": "3ceb41c7-bcc6-45c2-a29b-e6bdb726c29d", "comment": "Malware payload", "value": "4574b95c2267a59e689956da4f70a743b443f7ee4c890376b6ab7c0ed3ca829f4ca8cd8b69018f6b300d559260fc4a7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559169, "uuid": "fb5ffb17-364e-402f-a073-28a70d395ffd", "value": "T197430FD47AE45CC6EE14627C55E692322A3CB6E0C78347076520B6321E23FD17DEB62E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559169, "uuid": "065584de-c062-426a-97db-8d14ca7f5698", "value": "de7bb182fbdfa4909be44c9a7d4823a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559169, "uuid": "4a576679-7749-4d9e-8975-db2da2b9caab", "value": "768:X3ymd1JrN8j0d1C2BY8S3X5QHbUMCYUNa//SzWsFQrZpjA:X3ymrIjp2u8S3pqtYCsFQrLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763559169, "uuid": "f3c6fde1-880e-405d-9b3f-e4a98399056b", "value": 59401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763559169, "uuid": "afa7f418-c88e-403d-a5b5-6639c469871f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559169, "uuid": "b6340345-d9cb-4d3d-a864-e96cea28fc3b", "value": "shell.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61858875-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594877, "uuid": "2443f199-836a-4fe3-88b9-fa9f9e76bdc3", "comment": "Malware payload (Mirai)", "value": "4b8210f4c5cd987ae70553385a1b915d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594877, "uuid": "24e062f4-67be-49ec-bb3d-8bb9e9ee6614", "comment": "Malware payload (Mirai)", "value": "7c397f2e7780ffdd3a1f5ad750f1b9c3a0367be127f1f02f1686600099fca5e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594877, "uuid": "b6ea9d56-6c42-422a-be4f-f5f1454f621e", "comment": "Malware payload (Mirai)", "value": "839749eb03cbe7492bb51bcfef7c78a59edb90bf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594877, "uuid": "54ccbe50-7cb8-4291-8dc2-f7bd3845ad26", "comment": "Malware payload (Mirai)", "value": "8e5d5f848f2e94c0ff5469427a29a384987337555f39a0ff588b311cf806ba897ab20f1b2482845b36d6e3dbaf1e5dcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594877, "uuid": "46a1e968-aedd-4f28-bd0a-04b152c27d82", "value": "T11913F218900AA0C5D8BF11724A3B37991D18D718BE28C9BBD761232F6D52F42BB3D5D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594877, "uuid": "a13c8237-b995-46b1-98a1-c6d97965ca9b", "value": "768:dcKmeLMxHfx3DKQsfnwGaE/NIpODDKsHZK8Aj4l9m1U/B2Viy3ocanbcuyD7UoQz:vJuJxsfapOfKsq4bmyMViLnouy8oy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594877, "uuid": "6a339c14-7989-4546-b645-e90fa2ffb168", "value": 45112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594877, "uuid": "bd8dc678-5cfc-4155-ac4c-028736745d8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594877, "uuid": "e2461df2-23d5-4334-a938-3f6e5ff56bb4", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "797bbaa9-c517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763536506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536506, "uuid": "efe2ca6f-f34c-4441-b321-485d38f4095f", "comment": "Malware payload", "value": "8ed02caf908380e42eca7dd10de0a4ee", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536506, "uuid": "eaafaa48-da86-4f82-a4a6-750b12d617c9", "comment": "Malware payload", "value": "7d92593b747fe3985adf46cc2dab4ac92dd12f9ffaeb0c34392380288af3fb90", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536506, "uuid": "32c64eab-5c08-41b0-b62b-ada527b004bf", "comment": "Malware payload", "value": "6b703e3316d7733d32857ae98b968fecda38f8ec", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536506, "uuid": "1e4d4c77-aab9-47e8-a860-6f39c60302e1", "comment": "Malware payload", "value": "f99d3072b4cfcbe9dd0ef8809a3a0acbf10576717579a00306c62263742da42a4438caf27077df15f8f5bac5c882d07b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536506, "uuid": "c1d59205-0c71-4653-b3b0-edbd4b9d8bc0", "value": "T14C96F08EBF0CE92EC43B5173CA66862332A7CE115A835673752C720C69771D98F45BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536506, "uuid": "50a572f8-b52e-494f-832b-7649b6161cbc", "value": "196608:znSskkybDZG5LS384GW86RobTFoJnyvUr0dfN8cb:TSskBsS8X6RWyJnSjdl8Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763536506, "uuid": "50550e57-cf7a-43da-b155-293ac69b75e7", "value": 8801650, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763536506, "uuid": "f333f1c1-afa1-4475-942f-e5bbed41a2f9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536506, "uuid": "3a3e2106-3fe6-4339-95fa-69757c170233", "value": "Al Huda Foundation.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19ca7899-c596-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763590891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590891, "uuid": "1765fcd1-4cf3-41de-99c7-28504e0ec47e", "comment": "Malware payload (Mirai)", "value": "c7d61fcdf33943c9bc3572c6b3dd602c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590891, "uuid": "9efafcc2-0bcf-44f0-946c-64b338e51808", "comment": "Malware payload (Mirai)", "value": "7ddf8817fdea9c4809676913e266ef18f3a16c66b87c781cb470bf54164e8868", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590891, "uuid": "293ee6e5-d73d-4d5d-90a3-6129ba7b742a", "comment": "Malware payload (Mirai)", "value": "872f7f0e1f4a2179c02ab28a9c47bda266a4432d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590891, "uuid": "05dd053e-7805-4f4a-9c39-dbf3d0840ab8", "comment": "Malware payload (Mirai)", "value": "5d66d5885292aab707667a94ff8f54ea97e725dc356899ef9c9f18559a91bf9485ed9b0d395bbdbb7a3b0b584a7c2219", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590891, "uuid": "686be803-eaea-4332-8939-62fa0d2c550b", "value": "T10D3302AAD6603D29FC95B8B3CD3683E1AB720E39B523CDE6B240FF60C45A651C5085F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590891, "uuid": "f673354a-3f3f-4d9a-a2db-e0e8b8cc72af", "value": "1536:js0pDgzNBYOens26J+kAAc5GyJ4u+qgw0Vui:js0pCNBHs6LyGC4u+qgw2ui", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763590891, "uuid": "648cee59-ac83-4a3a-a942-5bbeb61b9eb9", "value": 55004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763590891, "uuid": "bcb438b2-6ea4-47b1-943d-aea75624977e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590891, "uuid": "e2ce62c5-b23c-4024-9def-395076a9a40c", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926d2712-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589805, "uuid": "e84e411a-fab6-46d9-a241-5b82f75c3612", "comment": "Malware payload (Mirai)", "value": "277d3baa403de944fb498d46c21c0e8e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589805, "uuid": "1ca33551-8f2d-46bb-8614-93494b238dae", "comment": "Malware payload (Mirai)", "value": "7ee968868f6b173150296e03ff273819044afe7fbd8d55219d59909ff89cfe07", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589805, "uuid": "ad0126e6-ad73-4f85-801a-0b90a056fc56", "comment": "Malware payload (Mirai)", "value": "0b53fb51a5948c4e8c8586c55f3b25d294eb48f9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589805, "uuid": "1d1c77c6-c928-4db0-bf4f-4bbb46a60914", "comment": "Malware payload (Mirai)", "value": "b53c053dba04cf005e9e4a6a23533ba2d5b58159e8ee5c6be8bb9e70d515203fd002697464fb2887fa234249bb9a82af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589805, "uuid": "d9166fc2-596e-4330-b511-bd95e088a713", "value": "T195831842F8828B2AC6D023BAE6AF658E3361B3E5D2DF7517DD204B12378510F1D67E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589805, "uuid": "e1a39a55-9fb3-4a9e-b8f4-aa780b7cf5a5", "value": "1536:zTxC0qyV2Y73aC80nExbngqXmI7pOYfAWKYd7ZI5GQEMA7:zT00qyV2i3atccGiZItA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589805, "uuid": "325af230-b5a1-499a-9e87-a5730a1295a1", "value": 83396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589805, "uuid": "9b1a9f3a-c369-4b92-99e5-9f662a4f6494", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589805, "uuid": "2a6fe37a-2c62-41da-8006-031afc5faa00", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e99da4-c517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763536533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536533, "uuid": "7ac277ed-bd14-4087-97f6-b7b6bd2623f2", "comment": "Malware payload", "value": "470b95b690c4f65a813dc534c56f446b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536533, "uuid": "6a006419-ddab-4bff-af0d-b09473cf403b", "comment": "Malware payload", "value": "7f0671a2c0774fe8fb5d4f17fc5447fd1e61486db9784fda5595c693f3c4fbd7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536533, "uuid": "4b69ac61-9ba1-491f-b973-79ecd9253367", "comment": "Malware payload", "value": "a9980dbe2b33cecee160bce31d975b5a74febe6d", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536533, "uuid": "a2d27fb4-a987-4830-b441-a50fc8e39e0b", "comment": "Malware payload", "value": "70a9c4638b3f9ec8564960d60a69d9814de00473d642bf780484b891fa3167c9b805c5a288379b0e87a64efbef506332", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536533, "uuid": "90b13d43-23ef-487c-875f-645ee3097571", "value": "T15A66F1D6F7D8992FC8375036C97A62F255474C128E879F836918720C68BB6D40F9AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536533, "uuid": "47e6ba5d-ebb2-40fb-81e1-7d5c7c203afe", "value": "98304:VJ0RUOAMDgOP3XPgXxtqOscE5SmBXiVnGxPOfHBE4Ldk9ysoTwr+m:b0GTinP0xucE5lNOpNhq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763536533, "uuid": "1c976d22-1108-4fc8-9126-ae2316a8df95", "value": 6856979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763536533, "uuid": "47602667-951f-4058-9f3c-965fe53987b7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536533, "uuid": "db673fbb-fa96-43f4-a888-6b5c7914190b", "value": "keyword-monitor-v2.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a13de452-c4f7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763522828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522828, "uuid": "bdcf860c-72f3-42b7-92de-aab62ccf6411", "comment": "Malware payload (Mirai)", "value": "df0208e1b71057abbd4a1db95697058b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522828, "uuid": "933d8f5c-41eb-43c8-a7e6-b5d7df44f6ac", "comment": "Malware payload (Mirai)", "value": "7f74ae404f5d5d0f370a691d7a334cc9c773a21fdd2d7bf5c3e508b4545a4cf5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522828, "uuid": "d280d83f-350a-4a33-922e-3acf041155c0", "comment": "Malware payload (Mirai)", "value": "ff2734d0aa5e08ef6c7a0b434aeab0ea93a97038", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522828, "uuid": "01342fc0-8f9c-4a95-9b81-9c96f92f8715", "comment": "Malware payload (Mirai)", "value": "c86dc8f9837e8c5293c9c30010386a0bf88c29ce715b8eb18871ef366873e3410a78de36b13bb2d32f5659774f2062b1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522828, "uuid": "9dc76c1b-bc8f-4807-8e5e-978ec28913e9", "value": "T1B7530845BC919A17C6D452BBFA1E42CC332653A8D2EF3213DD216F217B8A81F0E7B641", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522828, "uuid": "c13ad992-48dc-4d4b-9b79-9953fdae7116", "value": "768:tR+OYa6/WKBW0bo8DxC4Ek3xC/SUaVTu1qqUIKTyjyYNJELEaJBLtamTkPR4eugJ:dYf+hr4EEySUaV61U9qELECtzUug7R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763522828, "uuid": "4384cef5-9fa5-4d8e-9fc8-9ba308a23bf5", "value": 63532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763522828, "uuid": "7642b678-90ce-4382-88d4-373767f3db29", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522828, "uuid": "eb20d1d2-f059-4c64-8d9c-6d993f0f804a", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95111ec3-c54d-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763559745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559745, "uuid": "b48c86e4-37cc-4aee-badd-5b920cb2d08f", "comment": "Malware payload (RemcosRAT)", "value": "b98413818b444fd02b2a5b4ecaa59beb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559745, "uuid": "0a34483e-1d6c-4c3a-9622-fc5eb3179a1a", "comment": "Malware payload (RemcosRAT)", "value": "80eca79426445f6bb320520bef624f7b9d1bf2db5c088912161b49d0fbf4ca7c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559745, "uuid": "8dd7caab-0a88-4c61-9dda-dffe4a0381a7", "comment": "Malware payload (RemcosRAT)", "value": "e315dc038e67e82c5db5329d3d3607649f7f4284", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559745, "uuid": "a6880de8-f671-4cf0-b2ba-c296ec7e57cb", "comment": "Malware payload (RemcosRAT)", "value": "85b38b097d2ae6ef82ff4f5be73c8d1fd724257e3ab74506042bd4d9dbf137a9f14af3bdc0eec9144e7095ffe5c23277", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559745, "uuid": "1e38d5f0-71f8-4d39-809d-8f69e7b005de", "value": "T10B652734985396DDA26FE4B321E2D6C67F7D3173931EB92C20BC1E421997D0E2538B68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559745, "uuid": "9f9e355d-7367-4334-90f7-ebdd32b3147c", "value": "24576:J5xvALqe7J5j1+myDM4A0R9+HzBY6t3eQzGvaO:i59wMF0CT1gJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763559745, "uuid": "5404cedd-8103-4a4e-8266-c3289fa6d662", "value": 1545658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763559745, "uuid": "7d174b9b-a67a-46c7-bed6-2d70237717cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559745, "uuid": "80fa0d11-dfd0-42fa-bf0a-6d76e8b48f34", "value": "INV-PO3029998 BAL-USD23,000.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4209cb45-c557-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763563900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563900, "uuid": "946f3239-446a-4681-aaaa-f2a1f9ced4cb", "comment": "Malware payload", "value": "60758e29d9f996346be9c9d5111072a3", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563900, "uuid": "d1a9c147-9933-470d-a448-bacd032ea609", "comment": "Malware payload", "value": "825c617b6172d31312b6fb8d898be787d08b6cdb9c216a4a050707b479d5dc34", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563900, "uuid": "2201ec12-d0df-475e-81f3-6477fa9473ec", "comment": "Malware payload", "value": "7cf369aefc9a87babe219c5c99971affc0d7e707", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763563900, "uuid": "2184c522-0fcb-4321-b12d-28b7b5949c9b", "comment": "Malware payload", "value": "57460ed87766d083dca607be44019d0029d416effdefa5dcd072ddf12778781a5cdea2fc55c2e6af1318f8da8549d1c3", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763563900, "uuid": "3ea5c9dc-cef2-4f14-aaf0-e6abeaaa79bf", "value": "T12A33BF11E7A0C077D5F2437129363B679FFA952516E45B0B43902F5D3CA3A82D90FBA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763563900, "uuid": "e8e6a1b3-e38f-45fb-8100-09f4a7183bb1", "value": "573bb7b41bc641bd95c0f5eec13c233b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763563900, "uuid": "bcf35ab6-0c54-4b9a-8601-2c54705178c7", "value": "1536:zT4HrN+noJHCq0Zs0s0DAVeuGp6rFI+Pl/:zTIN8ogtjDAVeuGpPWl/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763563900, "uuid": "b4145104-cabe-4b0b-a8a0-5519977a7579", "value": 51047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763563900, "uuid": "5602fe8b-ce26-4a74-adbf-860d3579304b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763563900, "uuid": "a63244e1-393c-4db7-b72e-265e478af3ea", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd469912-c56a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763572375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763572375, "uuid": "1094a40a-8a32-411e-88c5-e8faa755ae35", "comment": "Malware payload (Mirai)", "value": "f93f82de24555a7c07b670ef35a871b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763572375, "uuid": "e3563ce1-895b-4127-b46b-bba4f33b3081", "comment": "Malware payload (Mirai)", "value": "83af71f759f6816799de342d0513c979de0239484d39dbc289a30135a0b6e48c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763572375, "uuid": "78e26c41-a9ad-4ff7-b4e9-0bc716085e09", "comment": "Malware payload (Mirai)", "value": "49db5552a83da959ff6765b3cb9344581d01ac76", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763572375, "uuid": "be0e7240-f1a9-444b-bcc2-e827efb7de8d", "comment": "Malware payload (Mirai)", "value": "2e8b4ad592ec903149d29ae635ec4e52ee406933c1a86a142ba18fbbfb2718da3076e8b3d9540da20a12f968d1ecdb93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763572375, "uuid": "bd2fd9ad-3d31-4b4a-aaa3-d9c7daa35e7a", "value": "T170D30945F8504B23C6C611BBFB5E428D3B2A17E8D3EF720399256F60378695B0E3B946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763572375, "uuid": "be1afabc-d682-4a4f-9d2e-51905b861d7e", "value": "1536:UFKdzElm18uZJNb4A6Fa8eAZHk4VB7fzTTr71igYSvGueqZvd2UlqKwyw6RNPYTV:UFKp50VU8e947Lb71izSftBdRalKo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763572375, "uuid": "61636f6a-0029-4799-a073-db834c238746", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763572375, "uuid": "5dd8db51-cb0f-46dd-83e5-bc812f88e481", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763572375, "uuid": "63f82662-efe5-468e-9972-37a0e089722b", "value": "main_arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ee115ec-c564-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763569532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569532, "uuid": "ee197e27-8ce9-4efa-829a-8f70490e3207", "comment": "Malware payload", "value": "df7130a0ac5d692ed317f63e81610866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569532, "uuid": "70a10dc9-e3eb-4120-9dfe-7342af5bf1ec", "comment": "Malware payload", "value": "84e07e93ea30913d09dd30168737fd95d2ee45253b74ced5ac6eb661930d1e0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569532, "uuid": "c79942cf-4b11-44a0-aadb-bdb6845f4b8b", "comment": "Malware payload", "value": "0555a2a44e2797a23acbdf27f5fa338e8b065506", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569532, "uuid": "9b868de5-479c-4caf-8660-c3fcfc084602", "comment": "Malware payload", "value": "e87b6cd96fc1f9d87db4fdae7518ccf8b93787cbdb67f31d54d5ceaa96efe7838225e12686cc509077b7b6eecd9f426a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569532, "uuid": "3ce16abf-7d5d-4034-9b74-545e8ce02514", "value": "T106451B1AF6A611F5E0B9D274D9632127FD7238958338A7DF47809A0A5F31BE4DA3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569532, "uuid": "ebb8375a-a29a-4729-8163-8c73f2898fb9", "value": "54e492bdd3d6051d9c6f63eaf6aac704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569532, "uuid": "73ac58ec-9449-46b0-8b9d-931f2288e450", "value": "12288:GRuZubyp0hXF5AT0e1YZenRVE33GiPY5ociR5miXhRILpaWnxV7m+gOOz:GRuu1h1KmERVE3nuociRWLpakcXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763569532, "uuid": "24ef4841-bad7-4283-9c85-ec1de65a8cc5", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763569532, "uuid": "7ffd675b-76f1-4c22-aef4-77f5aa0cc158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569532, "uuid": "361598e5-8bfe-42b7-9cd9-342284140038", "value": "SecuriteInfo.com.Win64.Evo-gen.77686892", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b81939-c514-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763535162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535162, "uuid": "9e5c579b-4cda-48d7-b78a-0e15f746d1e3", "comment": "Malware payload (Mirai)", "value": "dbdf22ed4e2e310fc082af34f30909ce", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535162, "uuid": "2e7c6f0c-8938-4216-8d7f-f2916b314cbd", "comment": "Malware payload (Mirai)", "value": "8590a9cfc7ef2323261771bd23ab543c63f4d723e8753da58d15066838b3949f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535162, "uuid": "74617935-0a6f-4923-ad3b-ee11e2f051c7", "comment": "Malware payload (Mirai)", "value": "8f8bc2c6a9d51c9dd7668e9a7d7ba79015d02c83", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535162, "uuid": "e4132966-9eeb-464e-9057-376b54e5edd7", "comment": "Malware payload (Mirai)", "value": "86c71228dbf91beb3f7c32318c5391830490c929b249b978a0473cd5a38c25fc0bf39bbecadba5a8e87615a74fde0197", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535162, "uuid": "0ddf74d5-a890-40dc-b56a-bb65cf99f4b9", "value": "T1BFD3C71E6E118F7DF359823447B78F26965833D627E0D586E2ACD6012E6038E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535162, "uuid": "4c6aad83-781b-4fa0-8158-3b817551aa9f", "value": "1536:0jT1cjXUCn/fs9saGf59ux/C9T39fkTcui1afJje3oASNoXntOg:0XtCn/fWZTcu4afJzNoXtOg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535162, "uuid": "5aae1a4e-f9e6-471c-aed8-4c7984540a02", "value": 131600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535162, "uuid": "806a0ff0-1f5f-4703-bbfc-bcca7a4e41da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535162, "uuid": "be2b8cc6-80aa-4aa6-8796-ef0edaa88b91", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6459fba1-c527-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763543342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763543342, "uuid": "b9a8a6e0-fc29-4575-a751-f6ea14a0854a", "comment": "Malware payload (Formbook)", "value": "610a19b9c192b0a9edcba0edd4382893", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763543342, "uuid": "4c0fcab7-0c03-49da-86c6-91361522e129", "comment": "Malware payload (Formbook)", "value": "861e174b88d28b3e015527674a6a6397aa99b05c1a1b5bff045f9c6fc68ba47c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763543342, "uuid": "7399e26b-9b61-48e0-8b7a-928d99890952", "comment": "Malware payload (Formbook)", "value": "ee18c0fa07b2b231ec6fc8c47a0f77ec6d4cd850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763543342, "uuid": "162de1cb-2865-4951-9825-04f1f9b92de5", "comment": "Malware payload (Formbook)", "value": "8d34e1bfeb7417d98a5d8ecbf3960dbb9419722bb09d82792de251dd91beb5b1b7a4c89aefd7703dee971439b97577dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763543342, "uuid": "8c9bcc24-a475-470c-b0a3-6aa2c49452ab", "value": "T1AA45CF1363DDC365C3B25273BA26B701AEBF782506A1F96B2FD4093DF860121525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763543342, "uuid": "9d1792ed-6af3-4945-894a-f060cdc5af3a", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763543342, "uuid": "86d0038d-c7f8-46fb-843a-eb600fc394c7", "value": "24576:Dtb20pkaCqT5TBWgNQ7aLLV1SzJGXQuooNgsIOVE6A:AVg5tQ7aLLV1jXQuooNBy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763543342, "uuid": "4f96963c-1d71-4ded-b03f-555b11d71a57", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763543342, "uuid": "5b3fc554-653e-468d-b90d-9f853bd903fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763543342, "uuid": "bda19d17-de8b-46c6-bf43-63fab3d2c0a9", "value": "SOA.exel.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9496c8e7-c513-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763534833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534833, "uuid": "058c46aa-612f-4e8e-a231-f34e1a77c83a", "comment": "Malware payload (Mirai)", "value": "b4ab1a7a5425045709390cb8c596e18a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534833, "uuid": "2e21b649-f197-4050-94ef-f873b8c203bd", "comment": "Malware payload (Mirai)", "value": "867eee9fefd841d6d2022596b768ce7dd7c06fecaa3f70b456d2134a0ef6bc53", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534833, "uuid": "28293ccd-fc5e-49fc-90dd-a31adcde8884", "comment": "Malware payload (Mirai)", "value": "062a1faa0cdcfedc002c71eef84d754bbac071a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534833, "uuid": "64d2b09f-362e-49fe-9ca8-4f204356f316", "comment": "Malware payload (Mirai)", "value": "1b6633a161f381784bd711f4338d32721872b7f7c0efbb8cb74db074dc7e5c4cd192dd393a121574ec0edeceb40dc532", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534833, "uuid": "8d1fa6c2-ac71-413e-88d7-d3bc1ad4f7c5", "value": "T1F423F10122BA5F65CD48E6B32CDE7B0B0431852A1DDF86F2E565B7928C17FA1303868F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534833, "uuid": "1bc053e2-1378-4bf1-b7f5-6f16ce7a9724", "value": "768:C05fEmnG/+tBrmLxt77HZVjsjFiKtGB/3mQ3zLheJu54RCkjkZVtL5RLTqBMnbco:C05f3DmP7j9K4fmQ3zLhe4545jWVtlRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763534833, "uuid": "b8ed574d-992d-4583-b74e-17b08ee2ed3c", "value": 48068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763534833, "uuid": "64b62419-a93d-4225-b858-f657109f11c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534833, "uuid": "55b17e26-4084-4814-bc65-d8326baa6c06", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dd1c82-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594930, "uuid": "0fbc2659-8b63-4ee8-bcf4-6f1fd8eed2d6", "comment": "Malware payload (Mirai)", "value": "80f19bd2664e8c58f1b9eceb72d384d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594930, "uuid": "e267e177-be9c-4676-86be-6b35cc49bc42", "comment": "Malware payload (Mirai)", "value": "86a067cfc41d3bbdd967f571665b1b5762978b359715b1ef843a302ad146e0ef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594930, "uuid": "b307d5b0-f2a9-4eff-a5a7-e64ca1e49b0f", "comment": "Malware payload (Mirai)", "value": "f9bbdd6351267484b76cb374d959a3f7e4954d47", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594930, "uuid": "64bc1a7e-da67-4587-b6a9-a6fd415832e0", "comment": "Malware payload (Mirai)", "value": "ad3ac425d65a6c1225aa79637db94ecb27cbf22bd9c9bd8c350c921ce3ed300001c80ff029c9e49c438b34fbb8d20b87", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594930, "uuid": "222483a5-74b7-41b1-b658-e58f544e76ff", "value": "T1A7A36CD6F243D8F9EC2241303176FB378E72E5BA2129DD83D7A49A72BC52942D406E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594930, "uuid": "c4d8eace-af86-4cc9-b225-59d11babcf86", "value": "1536:KnJyYba2qd7fRRI7GEBOkfmuWwqUwRkG03g4aKBtlgALf5SZ+ZeiNE/:qFbaViGs1fmBwq9RkGyXVtXD58iNE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594930, "uuid": "20d7ce08-f251-4fc7-a4c4-a1392cec5704", "value": 100564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594930, "uuid": "f55a9718-13b0-4a65-bef7-e6eba9209403", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594930, "uuid": "65549538-0716-4360-974d-413b61c0315e", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed22c09-c54d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763559520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559520, "uuid": "be2c1d02-38c2-4613-a349-d5c4c88e899c", "comment": "Malware payload", "value": "af56f9399e7bc0f8fa737f2ac29e2872", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LittleDeamon", "colour": "#3F8EE2", "exportable": true, "hide_tag": false }, { "name": "PlushDaemon", "colour": "#15D663", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559520, "uuid": "36c8bc2d-e350-48d8-9e61-9fa27193c52e", "comment": "Malware payload", "value": "86ec75124c41ce5dfe05adeaf3c889c00f693c94903c22ad682580cae0ce6a94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LittleDeamon", "colour": "#3F8EE2", "exportable": true, "hide_tag": false }, { "name": "PlushDaemon", "colour": "#15D663", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559520, "uuid": "2147673e-5976-4eb0-b09c-18ff6c0e061f", "comment": "Malware payload", "value": "2857bc730952682d39f426d185769938e839a125", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LittleDeamon", "colour": "#3F8EE2", "exportable": true, "hide_tag": false }, { "name": "PlushDaemon", "colour": "#15D663", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559520, "uuid": "ab81e36a-f3ae-481e-9613-675fdb35fa06", "comment": "Malware payload", "value": "b8a18197efd8c17eada904fc9a8413b5f2bb0c15eef7ebc19f9c3a9bf178c463cc40e9844e0082219d9bbd324a30e8a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LittleDeamon", "colour": "#3F8EE2", "exportable": true, "hide_tag": false }, { "name": "PlushDaemon", "colour": "#15D663", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559520, "uuid": "9f84957a-3b27-4023-b7d2-d41a7a2b84e6", "value": "T14E734A2277A1C132E45616309869DAF64B7FBC7257B885C7B7C80B7F1FA02C09A39356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559520, "uuid": "9eb4f9df-7e19-4a6f-8703-e6e3d06d2c1b", "value": "ed46d3ca543624500d0e0db280986d76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559520, "uuid": "57c80c8f-0faa-4759-bf53-04fcbef7c1b5", "value": "1536:1PKbsPowq+K6U55a7IAcLrnP3M/OgHkFpKYfL:iyo7+KhTa7NUrgHkFpKYfL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763559520, "uuid": "1c22b163-9164-42a4-bc68-e409d43dfa81", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763559520, "uuid": "6da5c9d8-25c6-48df-b69e-c29052c04170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559520, "uuid": "3fe16162-70a3-4d78-9167-23d04d291eb8", "value": "sogou_wubi_15.4.0.2508_0000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5b36b85-c575-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1763577006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577006, "uuid": "7939ddf5-514c-4a99-9d4d-717bd870a51b", "comment": "Malware payload (MassLogger)", "value": "a02c0ef4cf08a2dd20ca5977194f60a1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577006, "uuid": "fe97a41f-caf9-43fa-9398-0d611f34ee37", "comment": "Malware payload (MassLogger)", "value": "88d7f6c2a10b74b10d5839492b10cac15a55d13b686bdc64111b4d3e6a4fccea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577006, "uuid": "43cfbef7-5202-4093-b11a-99b6401e95cb", "comment": "Malware payload (MassLogger)", "value": "7cb9affb2971ee745ddec10c3219a42498498fb1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577006, "uuid": "e6753a46-9f2a-4c13-a422-33dc0d00905d", "comment": "Malware payload (MassLogger)", "value": "f98efaf80de1d45e4451d035fa23596f2bed4bd4c79fb88e53ead0b87d24d071282cde5850772d5434fc11b2c7e5b599", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577006, "uuid": "5c07b548-0307-4437-802b-f9b658d94307", "value": "T1656612F851BE2E0485370AD40AB926D2F3676E0F2B8ACE19367464C84F517BD9E74B31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577006, "uuid": "4072739e-3e6e-4b8c-9f7d-187dc6e10e49", "value": "96:zpu2GZ4y1LtIu2VO89LslYbFlj2GQB6Xb/2GoGKyjVL9BM/7n6a66s4whB0Uo3YB:1+f1LtIJVOArLEFOVLq+bTZaY6qPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577006, "uuid": "da4a81b4-92d1-405c-a257-c4a4c5f2b641", "value": 6476166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577006, "uuid": "b31abdc8-4099-464c-8c67-58de39a1afdf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577006, "uuid": "d041c618-a668-46e3-ac59-c5b4c6f62b48", "value": "K-Bank CreditAdvice_Payment_1128190_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64db9228-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594883, "uuid": "a457a378-b055-421c-9b52-6ca05640a6d0", "comment": "Malware payload (Mirai)", "value": "53f9189fa25183afc66560f0cbd1f526", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594883, "uuid": "bb4be636-d630-4c0c-a006-00b65b19102a", "comment": "Malware payload (Mirai)", "value": "89f2d2bd4421d3e6182f96d965435b2fbd68419474a76ed419422d48eb6b21ba", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594883, "uuid": "d0ef5a88-eec1-47d0-94cf-03777f473d9d", "comment": "Malware payload (Mirai)", "value": "9587edff55e5d865248842aa690b6c1b4797638b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594883, "uuid": "e964b236-877a-4631-9b87-503d334ec0ab", "comment": "Malware payload (Mirai)", "value": "e689ff1d911fdd038943f261a5296afe4f18a0b20f967fd1623710cdb266461cfd667a1ded94d81a839556439d305b3a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594883, "uuid": "6166a2f2-8eec-4a79-9ce8-6ace9228369e", "value": "T1C113F1A1D06E58EDCADA5D3AEECA82E023C108CF73E5BC5325E0B711595A8F53065CE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594883, "uuid": "5e2e2d80-66ec-47d1-8f44-b975639381d7", "value": "768:U+kDFpNVWwzZcPBGYV6Sl1I9H/6901tKZTpwIu5USu++0GHfHDHq4uVcqgw09WV:UFBpBZcoYIqIZ2UtewX5LuBbW4u+qgwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594883, "uuid": "09ea4e4b-6155-4cd8-b496-1c192f62469f", "value": 45244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594883, "uuid": "2b4dd8bc-aca4-4da4-8924-4fecd4a3403b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594883, "uuid": "26545d2b-a6e7-46ea-b423-9fd6c8de928b", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6945a9ba-c562-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763568691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568691, "uuid": "4f1772cb-38a6-4470-9dae-5cff0a385a94", "comment": "Malware payload (AsyncRAT)", "value": "2d6d6b7487256f64188084ff91201932", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568691, "uuid": "0811345a-485a-42e7-83d1-12ed6d87c424", "comment": "Malware payload (AsyncRAT)", "value": "8ac170196ffb99ebfb700476269c8303c36fe3e81f55608403ae6bd4538d89d6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568691, "uuid": "0c6a401b-a63b-4e78-b7dd-60a10eb30660", "comment": "Malware payload (AsyncRAT)", "value": "0dbd2497ae33a795679945874797f0cd59df924c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568691, "uuid": "9d27e3da-b7d6-4e85-bd06-1e4252f9b58a", "comment": "Malware payload (AsyncRAT)", "value": "1ee5dd3acae0d6e1c24559f479344abdff511db8615616178ab03f457c0bd1905d90ef8b18875e4308d7f3225e4fe4ff", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568691, "uuid": "77a54709-72ff-4a1e-ae79-bbadccef9e41", "value": "T128154A56B3F510EAE8B78639C9625651EB72B8301770D7DF039042791E23BE19E3EB21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568691, "uuid": "b0c34b94-0099-4c3a-b1f0-82da4c9b75f1", "value": "4d45e1c2c77fb8ef0eeb6be3078fd07c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568691, "uuid": "a19fdfc0-8e64-4997-a2ba-df1ce2be59be", "value": "6144:2zWUsyutDGF1sgdgpIU5cjUhCWSVr6jQ48+jzWUsyutDGP1sgdgpIUyibHQDzVI7:2yUstAhi5SVrX48gyUstuheHQFItMbr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763568691, "uuid": "5d0601a1-ba89-49ba-9730-e92b8d81f846", "value": 931840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763568691, "uuid": "cef68958-f09e-4059-9727-a57f476f6168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568691, "uuid": "f94bb9fd-2953-4057-bf9d-71270f0c6bf7", "value": "fputty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0561229-c50b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763531417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763531417, "uuid": "e335ff21-67d3-4f8d-b2d6-c5d5801af265", "comment": "Malware payload (Mirai)", "value": "91649815206bb7b3b6b2bb00c050c54a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763531417, "uuid": "5851f5f5-543f-4f2c-ad54-770c02a0a043", "comment": "Malware payload (Mirai)", "value": "8e506d03141a9379c6b0259e1328076f2e26805117d977f73c76bb8b1b060260", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763531417, "uuid": "2fe1c90e-972e-43a0-b478-940b32b040be", "comment": "Malware payload (Mirai)", "value": "2f9bb443bbe561ac9ce4d42a9e3117752ebf21e2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763531417, "uuid": "f677a7a2-b038-42af-a726-ffeaa50dbc0c", "comment": "Malware payload (Mirai)", "value": "70b7f1721686bea00ab19c67f2905e7a4c20bfd182e65cf97c74bef8f42446a619a9ffeb2f9f70bb53c2e6f43839ebf2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763531417, "uuid": "9bb515f8-fa06-4cca-af22-6485e56a861e", "value": "T162A32956F9519F01D4C235FAFA9E81493353ABB8D3FA71018D20AF6123CA9DB0F7A512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763531417, "uuid": "fc74cad0-102a-436d-997d-e1f1e03e360a", "value": "3072:gIUlEfesXtxUaBoHXQ6biwBnFzqVwEp92:gItzUaBoHXQFwPzMwe92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763531417, "uuid": "f132c794-1ced-434a-81ef-59502e57159e", "value": 103616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763531417, "uuid": "7d28eca8-4afe-4d02-be48-5a087f565691", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763531417, "uuid": "74a2f2bd-babd-40db-b4fe-e5b508f8950f", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79758fcb-c584-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763583321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583321, "uuid": "189eba5f-2add-4bdf-8420-ca4099e73bc9", "comment": "Malware payload (ConnectWise)", "value": "37a256ed21e7c49f9f84abfe63eb3b12", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583321, "uuid": "04c4c1d0-eff8-4015-9870-c1cf40fea2c2", "comment": "Malware payload (ConnectWise)", "value": "8e9aa4be9fac54567979be70425b4ff5af05d780d852979b7bb7081b538060fc", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583321, "uuid": "798c3f5f-2714-4d7f-be61-96795dcddc00", "comment": "Malware payload (ConnectWise)", "value": "a88124ab258a01e8649f816b7fc2fc8d00994c6a", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583321, "uuid": "4f9529ae-586a-4344-bef4-2592c8122d6f", "comment": "Malware payload (ConnectWise)", "value": "1cb382f13594387dfd358c9c31f79403a7db3d02d9aad32602f6c3492a11d436b8ab7ff0ac3d780657789296373c4328", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763583321, "uuid": "6cbca20b-59a7-4af1-9d15-5ad7ad6516c7", "value": "T1DAD623116BF89278F0F22A35E87AA0B1A5377D515E22D12E2324791E2C75EC0C9B3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763583321, "uuid": "bf2b8afa-da3b-402c-85ad-ae065d73122a", "value": "196608:hHxcp9ym3nltDUJVMHxcp9ym3ZHxcp9ym3jHxcp9ym3iHxcp9ym3pHxcp9ym3fHX:TGplpfGprGpNGpwGp7GppGpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763583321, "uuid": "96a69bc4-08ab-4801-bc07-d2c850b05dee", "value": 13414400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763583321, "uuid": "331a4e27-deca-4ec6-a0c4-41b6f2e16484", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763583321, "uuid": "a345daec-e16c-4c14-a9bb-ae5b340b5ceb", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ece0ed-c517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763536501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536501, "uuid": "cb38e22e-ae49-478f-b393-079d72f41c64", "comment": "Malware payload", "value": "4cae2f401ec7a30a45fdca2046187cf0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536501, "uuid": "5f11ede1-4aad-4c39-be75-482f6f30817b", "comment": "Malware payload", "value": "8ef62bef2f33e486fe2a962a863dc2f621dd2369f24398817e9c4795f970c012", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536501, "uuid": "27eee713-e5e5-4da5-a549-354a34ec8493", "comment": "Malware payload", "value": "bf57aa7dc1574494a84fd0f3579334899c000bfe", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536501, "uuid": "fe17a98b-9970-48ee-841a-9fd30cbbe1ce", "comment": "Malware payload", "value": "7d5d43ebd48df1554c3e072b0d4b9a5b4d3adab9696bb35155d4418f33d65266e7c6eda750eca76793f4cdc24e276d03", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536501, "uuid": "84232f26-789e-46b7-a4ad-5e1d8fcc37f2", "value": "T1A1461286F706A87FC0B742324536067615639C2A8F83D7836A5D723C59B7AC84F5EF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536501, "uuid": "1d6b5475-b712-4768-be88-0cbb6766bebd", "value": "98304:OWOjeOh7wlPBBr3WO3f4HUS41ZIzeft4KP0ZB3fsA4XzJ2Ny6tzySqxDIoQQ30:OWcgvOHUD1uwt4KP0Z9fsA4NWyxdIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763536501, "uuid": "2b6fae90-11c2-4598-930f-743fc6bed73f", "value": 5393568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763536501, "uuid": "b03c953a-d408-49a9-b0e6-48199a7fd113", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536501, "uuid": "759ed8c6-0564-4e6b-9d1e-c1a31a4e7228", "value": "ACTED.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37964e87-c552-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763561735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763561735, "uuid": "0f7bc664-e8c3-4cce-8a1e-6dd508e163c7", "comment": "Malware payload", "value": "3c966fc13d46d998bd4b0d34fac34b11", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763561735, "uuid": "9785b6be-7baa-47e8-aafe-3dadda327d0c", "comment": "Malware payload", "value": "8f21461e569a07ddec0423f39573a8fb24c644e6b5ae26bf5e18f27759518eb9", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763561735, "uuid": "5d10623e-0da7-4993-9d11-7139c1f3f5f1", "comment": "Malware payload", "value": "029880b7dd46b1c71e8d7c2e082b2620ba0db4bf", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763561735, "uuid": "519adeb6-3e9e-4e9c-bce9-38e6b4c6b616", "comment": "Malware payload", "value": "1c760f2dcda002900a6aedd2a165b4cd0ca427ca2da218452d3b468aecfd1d768395c39b7ab90bfd4a00954ffd5e5b0b", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763561735, "uuid": "09752bb4-b86c-434d-864c-9ff4a090e321", "value": "T174F5D0DBB788693BC8B7097285AD62B1564B8C128F879F436C44361C6C7B6D42F4DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763561735, "uuid": "c497e61f-db9d-402c-ac28-fa5b59a6055d", "value": "98304:fcMMohx+ON4o9n0gLCr+FNBlVu26BzabasaR+kORTdmai:fKohxNi4jlVuBzabasarOPmai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763561735, "uuid": "16d4d9f4-c66d-4555-85b3-40e382a33185", "value": 3571194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763561735, "uuid": "2aaf0a3a-efd8-4ceb-8e24-ba6312c2f8b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763561735, "uuid": "79616e0b-fd8d-4c5e-a06a-5f4604188100", "value": "out.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e3f0fa2-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594872, "uuid": "32ae69af-a74f-4739-8459-3784e73c9ced", "comment": "Malware payload (Mirai)", "value": "00dc4a7df4b27f108d3301308f234b7f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594872, "uuid": "0e350a0c-9c18-436d-8fae-46ecbcedb760", "comment": "Malware payload (Mirai)", "value": "91785e56c8a58f31e11fc9aa147aa8e24bb2e5a2445fa9e4043a3e19fc719e3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594872, "uuid": "2ee6f07b-093b-4a1d-b9e0-8e0b1524cd91", "comment": "Malware payload (Mirai)", "value": "c5cc805d9ce4a5f99f2782da5fa8a8c4eb2b6b41", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594872, "uuid": "aac846c0-1150-47c5-b81f-76d87ddbdad1", "comment": "Malware payload (Mirai)", "value": "bdcd9f9d9d977923157c570e328efc1bc920c65cfb89264a93adf45c0e8d3f569b00d1a7d0be6794963c827ba392f118", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594872, "uuid": "e9728398-ec8c-460a-9dee-3d521b169050", "value": "T1122302893A04AB26FCB174FAB6E5C21B7E944FF492CFF9B01118416C08DB9989775C0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594872, "uuid": "f0cb1b8c-1c86-43e7-9ca2-02a822e9b84f", "value": "768:Br1tPFeRwax5QQU/vhHknHVSvIJ5mwja+J2FBcpABvgKmBtLA7+vc74pQWlB7g9c:B5FFcwax5tYZHkZja+oH1Bvgwv7gpLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594872, "uuid": "1c3bce1d-2278-448c-9926-da28e9c4e51e", "value": 50088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594872, "uuid": "52ffab5e-d2e2-485c-a2b2-96e2221ac26d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594872, "uuid": "5854f83f-18f2-4d07-b6e9-7515ed9e0740", "value": "S3o.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c729ad1e-c565-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763570137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570137, "uuid": "065676b3-f96c-4106-a979-a3c4128a88d5", "comment": "Malware payload (Mirai)", "value": "91a3b7f067e265ce3e5b8d69fb152afa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570137, "uuid": "07d0aca1-a816-41b2-8a0d-9320fb8be454", "comment": "Malware payload (Mirai)", "value": "91a17b97dbb95ae1e5d1bdb363ae0156d67da47fcb025cdb72e6e618e90ef303", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570137, "uuid": "dc6edf71-1ac8-4392-b705-de4605f751db", "comment": "Malware payload (Mirai)", "value": "3f38f5cce2eb11931c4e5390b8dbfa72d7f6c797", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570137, "uuid": "16344694-c1be-4e86-9dce-45ddf33c631c", "comment": "Malware payload (Mirai)", "value": "bac596acaa43008488d1653d2dec13981b8a076dda1c503eea9954eb18a17c68b897458a5d3cc9bfb94f9be2e56e6843", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570137, "uuid": "639ddd40-efb5-435f-945c-a042f291b066", "value": "T1A1B3F70AEF910EFBE86FCC3746E9074925CC691612B87B763974C52CF25E14B0AE3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570137, "uuid": "6fba9cca-9f6d-4dc1-b05b-7d94f45c1b17", "value": "1536:xookxC3ydZ2/QeD8XTTjWl11/giEGFBC8mwOsj5X5dyiMZ3TggX+dpDRbAryZtEY:xookxU/QeArWldE0BDm7vRQzxZtE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763570137, "uuid": "18fff777-7dea-401d-981f-18044dea2700", "value": 108716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763570137, "uuid": "06156972-43c4-4104-a189-dc36d5b62952", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570137, "uuid": "72b51529-1eff-4c5a-a65d-73ef8b08bf0e", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b3d6659-c576-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763577338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577338, "uuid": "64b3744b-360f-4da3-8316-84e6ce1a1bae", "comment": "Malware payload (XWorm)", "value": "8f641cf638fa74f9fcd42743ae2f4788", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577338, "uuid": "a2fac34a-e8f8-4e22-bbfa-17c1cad30221", "comment": "Malware payload (XWorm)", "value": "943365bbccf430933d6519ff12b88c4f5cab01b6ca9fee27b2ce71dc7caf3ee5", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577338, "uuid": "4f8504ef-64ab-4149-9aba-84faaf7bc606", "comment": "Malware payload (XWorm)", "value": "03c62658ab017f2338579d7bb2c85683fa0f72cb", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577338, "uuid": "58525c9b-2f88-4a91-8600-7cc74dbb2b03", "comment": "Malware payload (XWorm)", "value": "63e04d0006029e3ea6f4e1f9d733059e74aad93d912e7254327c10fe75bd7ff862647203792621487f35aa3ac1f4179b", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577338, "uuid": "948943e4-26f3-4511-b01c-d1afc345094a", "value": "T16BF383EAC53DAD9CCE5BB0AC9E1519C7DC680191D37E2688946CE8A61C014F0DBDF9BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577338, "uuid": "ba98f99c-2072-4537-bb52-4d2c8c54afe1", "value": "3072:vaY8/3MLwsKRBqb7oX8rB7Qz29PpjdybG:vU3MLwsKRkX7r5Qz29Bhyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577338, "uuid": "9d102157-85c9-45df-b3cf-107d94325f93", "value": 158586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577338, "uuid": "8454d7ca-7747-4f61-82a6-40f809904aec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577338, "uuid": "48a28bb3-377a-49ab-8715-5ecdd176e4d2", "value": "SPECIFICATION.CMD", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73d149ee-c568-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763571285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763571285, "uuid": "1e4e1698-11d0-4d11-a402-53ac59fcc0e6", "comment": "Malware payload (Formbook)", "value": "37496579e98a1e12a51d73ec2c3038af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763571285, "uuid": "3e14651b-e091-4355-96aa-9c12c80acc67", "comment": "Malware payload (Formbook)", "value": "94cad32fb1af01f798a74fa25acccc890ea303f4d3a720296146dd9161da7374", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763571285, "uuid": "584a7b8d-9e75-46b3-adb5-20c502a631dc", "comment": "Malware payload (Formbook)", "value": "9cf060e2a160d46a597a915e063e57d02b79c9bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763571285, "uuid": "adb01e67-f506-4cf6-9aed-b22dac0d50e6", "comment": "Malware payload (Formbook)", "value": "b6d497d65de59d36d88aa5489369ba3556296dc8a4eb326286d0aea2b94a11e168f89aee0427ee42eb902b8d99bc7d61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763571285, "uuid": "ac12238f-9274-4b34-91b1-41a1c18aa93c", "value": "T12EE422909190CC53E96232308577CED91978BD31CD853B5E9BC9FA8B78322439787B6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763571285, "uuid": "398fada9-cca1-4785-99cc-15aa08c883a9", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763571285, "uuid": "edef7c8d-b634-4d5b-a11e-820d85947485", "value": "12288:KOv5jKhsfoPA+yeVKUCUxP4C902bdRtJJPi1OAHql2sSEmMNYQ9AI0Xve65AM718:Kq5TfcdHj4fmbAQl2srAIN6yK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763571285, "uuid": "11e561af-0ea4-43b1-8045-d64f9fba9066", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763571285, "uuid": "5b8bec73-4619-4887-a428-72518d7913ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763571285, "uuid": "c5b43e88-7e1b-4065-97cd-b4e095679857", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8a8ddc-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594874, "uuid": "1ef8e362-96ce-46c8-83de-6371fd6ab5ff", "comment": "Malware payload (Mirai)", "value": "5b09947a48ebef9f27e44aaed7bc30f1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594874, "uuid": "d377da82-65f0-43eb-a1c3-cb299ce78c32", "comment": "Malware payload (Mirai)", "value": "94e28976c30cfc757d6c7ddf17f4fcb3e7f1021c052973852bb865278bbcef98", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594874, "uuid": "3c1ff98d-1bd2-45ff-b066-c370c627e1a0", "comment": "Malware payload (Mirai)", "value": "c8c28a37b0dcb7393834d0c71cd07751d2f8848a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594874, "uuid": "3f325280-568a-47e1-8a3d-461b4cd981e1", "comment": "Malware payload (Mirai)", "value": "78e0eb678a3f49a23a7d01adc3dbafab07c043318a82c22de22b8c1c42fea70022511f9e3b2339464f8b7938ffd52e21", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594874, "uuid": "cf6c98cf-cc02-420c-8ec2-99fd04c3ccf9", "value": "T18F23F1145F212CA0EAD1A973E6359D8B5BCD0BAAD1B871351802A7BC350724B16FFFA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594874, "uuid": "ea3f6fd9-990d-4ece-a6ca-631de840d215", "value": "768:nnLPllCTcqb1vxyLBICWwOkyFOOS5Gv4E/Vqy+Hy5Hnaqs3Uoz1:nLTCTcqB5yLBZvGq5Gv4EdqyDHnanz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594874, "uuid": "6d5ca939-87ae-4b5e-9c74-9f54a3f4bd6c", "value": 47356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594874, "uuid": "86850e65-9316-428e-ac9f-c5a5cb110cb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594874, "uuid": "bde9bd2d-9571-479d-94b8-125c3ba21d12", "value": "S3o.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c76cb06e-c4e7-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763516021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763516021, "uuid": "c477e985-24ec-4570-acb5-6d09624a970a", "comment": "Malware payload (Mirai)", "value": "acf017e9dc9aeb151b3501b5185f2274", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763516021, "uuid": "8561c561-694c-409c-9dd0-b35cc954cc92", "comment": "Malware payload (Mirai)", "value": "94e2bffe21b5f2abb4a9ef34b40adfd4e9dc28b8e2ecfac3a6f0e63096cf6342", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763516021, "uuid": "d9b685d1-3354-4786-844b-2371f111bed0", "comment": "Malware payload (Mirai)", "value": "8aeff6e880d947a0f71f47ac538b90c1b9d72dcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763516021, "uuid": "02832ec6-75b6-4dde-92c1-ddc9c2a55805", "comment": "Malware payload (Mirai)", "value": "d525243dc2f8324705643eac2fe3832e2b3110851a24c4740d42a9662236b9d0086196391dade412939ad41871dec2be", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763516021, "uuid": "84c03875-db25-43f0-b249-bd46d69f3e7f", "value": "T1C6733B01B3080A43D1A76EB03E3F27D5D3AABDE111F4E645251FB78991B2E325587E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763516021, "uuid": "8a07c454-9116-448d-98bc-2dc92ac7eaef", "value": "1536:rn9qBlaJ4xM+UH14tQVPReoA302hkPV/ohHIqatXwOpemhjUy:4aJ4xM+85ReHAVQhUFjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763516021, "uuid": "d620e3a6-98c0-48f3-b15f-0afdb299ce81", "value": 79156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763516021, "uuid": "8e3c186c-b011-4cb6-b7a4-4b73200593d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763516021, "uuid": "73c7726a-d8ed-4468-a5d7-d9a9bfe8012e", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78915570-c595-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763590621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590621, "uuid": "224473fb-8ed7-40f5-b163-70b34a06c232", "comment": "Malware payload", "value": "0f56226cc743852339a2674258f1aa24", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590621, "uuid": "cc2f06d4-7066-42d6-a642-16384022d96f", "comment": "Malware payload", "value": "94ed8133fece6548befe4b90afe1114add3fdf6f2cab047ab1297b450add5876", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590621, "uuid": "0e6d82a7-b11f-494a-8060-3ce04666c780", "comment": "Malware payload", "value": "69f566e428badd9d72ee7a31cc45247b8fd968e3", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590621, "uuid": "3f9aae12-055f-4e96-89fa-475f2ae58a7d", "comment": "Malware payload", "value": "4acad37d33e57dc6cb7f85b7d22512a8dc15ae0a928505c19532c527608234700343e4dc94bedbd3c25531233c3e0e0d", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590621, "uuid": "a42e01f3-64f4-4c84-9b5b-918d929531df", "value": "T10574F12E84DA0F2DCEF05A697CB91D4E129082C6527694DFFB6BDE077F9980C05AD09C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590621, "uuid": "1890ef76-092d-4d59-a922-6aa7e84d2553", "value": "6144:E2a24N/vaRClNyMvSBFMUORGKeu0G+zmQXy1RNAgKM8oBSaY68uXXXB:vchaRONLvSEGKeu2zOpAPM8uSvqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763590621, "uuid": "952143b2-1c37-4379-ab1e-900412be05f6", "value": 359181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763590621, "uuid": "0e3c51fb-6d96-4874-8f50-e8b63c5a03af", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590621, "uuid": "3c54336f-b4ae-4e7a-a1f8-5e618302a200", "value": "iloveyou.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62eb2672-c527-11f0-a129-42010a9c0007", "comment": "Malware payload (DBatLoader)", "timestamp": 1763543340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763543340, "uuid": "d32a2a6c-8246-4de9-989e-03a4b1719b33", "comment": "Malware payload (DBatLoader)", "value": "600e07b0281ed20fbeea9dbdeec96789", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763543340, "uuid": "1c8db6bb-05ae-47cf-b922-d67fb6551f50", "comment": "Malware payload (DBatLoader)", "value": "96080883257bdfe75fbf33f3a5652a92e9c0c9d8834047b83abece02cecd22ba", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763543340, "uuid": "9b33912b-91dc-43af-bf47-346e764dbe11", "comment": "Malware payload (DBatLoader)", "value": "8c862311f36513ab71326d11cd938b55e4a56e3e", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763543340, "uuid": "253a2a30-9432-4f1e-90a8-a9493cc66e13", "comment": "Malware payload (DBatLoader)", "value": "15a9104304465ef8caec4e05062854e3b1be5bad170ba5c2f71884b8fa7bda120ab0118be592ba1b9d503beedd406982", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763543340, "uuid": "58c8a9ee-23da-491e-80a3-2c33e6f6f59e", "value": "T1D875BE51B2A08536C12369345C06A39E6529FEB42D74E8453AEC3F48CFFB6A43C1AD77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763543340, "uuid": "4ad1eb2c-1885-401e-bd89-1d09667fe51e", "value": "825b81cbf84889d1f9a947979d8d2e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763543340, "uuid": "553d596a-29d2-4aa5-9449-694f4e4d0e75", "value": "24576:is2HDXNkMW1w+cVmtncbV4KhdRPtifpwviZRlsHzjkzlWLHBL:idM1q+mifpwiZRlsHzj8lkhL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763543340, "uuid": "a6ce9dd3-299d-4f7c-b57c-be6bd4c16265", "value": 1605632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763543340, "uuid": "794adfe6-4fc1-4012-a140-b7b03e11952d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763543340, "uuid": "6e5265cd-02c3-424e-9b6d-39cfca5f3cb4", "value": "Razbxujhwkvbuxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda5166d-c535-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763549612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763549612, "uuid": "dab37583-dc67-4176-8fe5-a5f79070ef4e", "comment": "Malware payload", "value": "0a3a8bc504386369c5b3d68d90cf510c", "object_relation": "md5", "Tag": [ { "name": "api-telegram-org--bot8484778379", "colour": "#76A6A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763549612, "uuid": "23ab2a4f-1b00-4d13-8f4c-019909de5b9b", "comment": "Malware payload", "value": "97acf291fe22a5a219037849f8a2126caea085bd891b0a3b8f632e56ccd5114f", "object_relation": "sha256", "Tag": [ { "name": "api-telegram-org--bot8484778379", "colour": "#76A6A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763549612, "uuid": "4f79a057-9fe6-4a5e-a8fc-c75c175924ea", "comment": "Malware payload", "value": "39838a06c3744928b084c8630960703ed6ecdd25", "object_relation": "sha1", "Tag": [ { "name": "api-telegram-org--bot8484778379", "colour": "#76A6A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763549612, "uuid": "8a171c69-08ef-4b50-81fe-d3876009d005", "comment": "Malware payload", "value": "df1a33ae3e3761b6ff8822f77eeb6b668755efa91032630e9228ce31bb07d4834cdc6dffadedcb205f095a3acf318380", "object_relation": "sha3-384", "Tag": [ { "name": "api-telegram-org--bot8484778379", "colour": "#76A6A8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pyinstaller", "colour": "#CAC92D", "exportable": true, "hide_tag": false }, { "name": "Python", "colour": "#D6064D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763549612, "uuid": "24c67ab5-7e24-49ee-ad3e-e5117dd588ef", "value": "T16C27330A56800DDBF9F395364D1FE5359769B82B1758E28F03E81BA75E9B0E04C72F28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763549612, "uuid": "e27d3cb6-d7dd-4c86-8b49-6594efb6024e", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763549612, "uuid": "f173ed8a-acf9-4f3b-bca4-c2b75e8df51c", "value": "393216:p9YiZ/m3pWBJHkBOLuzP8AxYDhQETIGXvReU75axZdGydOcI66EMzMn:p9YiZK0EBOiYXlQEMGfoQ5axzGydOcIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763549612, "uuid": "c1a79451-7c84-4b9e-a50b-2a215746bc4f", "value": 20950674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763549612, "uuid": "a4fbc043-73ae-4275-99ff-acb11245a6ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763549612, "uuid": "95a9fd6d-5844-4e74-8e8f-cfd38013837c", "value": "WindowsServices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b747dde7-c575-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763576982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576982, "uuid": "6e28821a-dcd8-4ef8-8d35-03bd9fede580", "comment": "Malware payload (Formbook)", "value": "2ee3791580ba93e69cb0d53be22dac21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576982, "uuid": "2f6d3e1e-2c31-45c8-b079-b106225df606", "comment": "Malware payload (Formbook)", "value": "989ce4dc079fae979ae465d42dabe4b8f7deec069e9ed195785bd8e00aa8ba60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576982, "uuid": "57721faf-42b3-4b1d-aa70-ea5516131514", "comment": "Malware payload (Formbook)", "value": "d95c370f80c747c22dc400798768ef4ad38c5bd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576982, "uuid": "de6a158e-9116-476e-9cd5-40a7fc404d09", "comment": "Malware payload (Formbook)", "value": "f159c23d9e234570b10df701efae448bfad10e17b23c3a350ddda57987a44ecd5aeaea856b3ae24d8179818340cd3043", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576982, "uuid": "1736335c-643a-4215-9b7f-b758d57e753b", "value": "T177F40248269EEE13E4B15F742931D3B483B9AE449831D3168FEAACDBB85E7015D443E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576982, "uuid": "b585b96d-d84d-47f7-b9f1-ed8fbf063589", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576982, "uuid": "44518d66-df59-464f-9731-f658f9ba6329", "value": "12288:q/WS4x/lYEithuihoAWfXB1yjEjOB/pCMJbDeVCQ0rw5+wJWNAg0R1q9IWZOTgJS:qenu6iR0CfB/PBGT+tNAgiuICOT+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763576982, "uuid": "d837aa52-9934-4dd5-b8fa-f4e5a90241ee", "value": 777728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763576982, "uuid": "c7394b78-d344-437b-aae4-44881bdbb3c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576982, "uuid": "f02724d9-87aa-4d87-b093-85f7dfd53697", "value": "WireTrasnfer 2025_11_17-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6106ba3-c523-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1763541842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541842, "uuid": "f175f2e5-84de-475a-8db3-00f4c1bc7196", "comment": "Malware payload (MassLogger)", "value": "31a9bb07cffc8df3422a36ae29753a56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541842, "uuid": "bab223a6-aacb-4c96-bd83-808ffe87bdab", "comment": "Malware payload (MassLogger)", "value": "98befdf040b021045e164086dcb58d1139d366c3176365a8d36d4d1fb52e42fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541842, "uuid": "8d3c68d8-3a7e-4f16-8ba2-cfcd56061229", "comment": "Malware payload (MassLogger)", "value": "fa01f9a4d74e1d4dfa4764ee09225ebaa8dafa3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541842, "uuid": "ca4ec93b-c692-4844-9983-b2423a5aae41", "comment": "Malware payload (MassLogger)", "value": "0c547152789f917d493914b40a06182de0d0a2aaf063c3e3f25585e535d61012d075ca436ac54940c065b3875619361a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541842, "uuid": "a9c35c12-8fee-42e1-9c96-5ce84cc13ea8", "value": "T1BE75CF12B2E08536C12769355C0663AE6529FE742D34E8453AED2F48CFFB2643C1ADB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541842, "uuid": "09a9751d-4cf7-410a-acc1-5c5d94d8b376", "value": "825b81cbf84889d1f9a947979d8d2e09", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541842, "uuid": "bb387cb1-e2e0-4cfe-a005-98623f1ade10", "value": "24576:is2HDXNkMW1w+cVmtncbV4KhdRPt/bCfOwTkCcvLAzm4CBDkJHL:idM1q+mFwmvLkmvaHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763541842, "uuid": "4381edbb-9ed2-4e28-a36c-3db5c303bc17", "value": 1605632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763541842, "uuid": "561038fc-8bfc-48bc-b3da-b215dc743465", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541842, "uuid": "501b21c6-c034-400e-9063-a602915499ad", "value": "PR 40039082 COMMERCIAL-BDS 181125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83e12fe5-c54e-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1763560145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560145, "uuid": "78b13775-c071-4a15-98ed-9f0578e918ce", "comment": "Malware payload (PureLogsStealer)", "value": "0dd590078af5393c5da370c3935d9612", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560145, "uuid": "28b7db14-505b-4dbf-a89e-d4f516ae0479", "comment": "Malware payload (PureLogsStealer)", "value": "99978bb92355f3b3436b8e28f416d787bafd523deae3f03c97e0d9ed292e0305", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560145, "uuid": "8ba040d6-6fcc-4aa3-9aee-efbeac3d6301", "comment": "Malware payload (PureLogsStealer)", "value": "dca730305aff7b7799e4da672381ac81d73c9b52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560145, "uuid": "ec529c45-633b-4634-ad4c-97615c8b94e9", "comment": "Malware payload (PureLogsStealer)", "value": "c9b5ce3aeef9c35d1af7be0934d894fd07ebe503a92cbe05c9cd71825775464c43a93bed8a5030d4f64e1f7bc97f13a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560145, "uuid": "cdc06c3b-1daa-43a2-98da-231de010d211", "value": "T1E4573389A314C838D8D8D07B2B7F83EE74FEDCEA1D11C449CB971AF8D5952E210B6586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560145, "uuid": "9405ca1a-b67a-4c85-bdca-634f9f5c4549", "value": "5e48fbae3520a62c95e412b293e1759c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560145, "uuid": "d8b02c1b-b50a-4572-b5a6-4ce9f5cebc7d", "value": "393216:hLNpwgeMhLDnjylVxBqAYYpfSguwQf675H1ulVc70tx+cR3WpN7HGzVWAsdtR5uO:BNph/nj+oyL8lVj+cR3MJHmWhtLo98uY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763560145, "uuid": "910d791f-e4cf-48b5-b938-c7b22ff141e3", "value": 28353253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763560145, "uuid": "f410f48e-d0d6-4475-aa3d-44038ee31529", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560145, "uuid": "c98df014-36d0-4570-8207-a22b69609551", "value": "Lets_Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e267732-c598-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763591838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591838, "uuid": "9c01de97-2f3a-4610-adda-0532edf1bf1d", "comment": "Malware payload (Mirai)", "value": "cd8bfce0c43b7d80fd93de020e253d1a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591838, "uuid": "2ac199e0-b699-4178-a8fa-9b1a9c12b159", "comment": "Malware payload (Mirai)", "value": "9b941cffd7e9a5e2d220cc7a2792733063f593854d9a12dbde896e4771fa8c14", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591838, "uuid": "87563827-1945-4a0b-8c4b-707d5eb9199c", "comment": "Malware payload (Mirai)", "value": "b45313c08b37212bad01087194c936a06f86eee8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591838, "uuid": "fc56deb5-8e09-42e5-b28a-374729d3d7d0", "comment": "Malware payload (Mirai)", "value": "4159d26897c401afedbdc2577822841035794a707707b5e5bba38651e1f30eeba39f1c3aaed464520f5d8e5ed46a7d54", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591838, "uuid": "8f1c3bf2-cb0c-4a0b-b4bd-88b8942f0435", "value": "T1F72309C8F443D9F9DC5A09742036FB27DBB2F6BA2329DE43D7A49523AC51702A805D9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591838, "uuid": "ed8dc0f2-c333-4af0-9849-8d92b9a3eb0a", "value": "1536:6nJRT4QPfZfW5XTOeY3Dve3AGAZq/4Qw7bn2i8e:Gv4QPfZfW5XTOeoEz0qAQwf2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763591838, "uuid": "6519d373-abbd-4e99-8b4c-0153b9ea807b", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763591838, "uuid": "587d68e3-6aeb-4360-a833-52c6e94c5ee0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591838, "uuid": "f7935981-476b-4b6d-9a1e-865438795301", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53af84f2-c5a1-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763595713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763595713, "uuid": "4ed6f15b-5fe1-46bc-b78b-ffdd43525344", "comment": "Malware payload", "value": "e042cbd0428ff123ff3ac1a58a05518c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763595713, "uuid": "2cf132a4-7fde-46b3-8486-76c836566e27", "comment": "Malware payload", "value": "9f11a53f99a46a3f038bbc277cb935090d521731ef806b4e9ad5cde9bcac9e0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763595713, "uuid": "72525a7c-2b38-455d-81b1-56e9dab5b98c", "comment": "Malware payload", "value": "3adc4120c1e337af7b94b427a537a7d25ea68857", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763595713, "uuid": "33591a71-4f3f-4757-a824-9de9f5ea5717", "comment": "Malware payload", "value": "c21c9621688426d5625aac62f883c8d817e0a0b4084a8982c35d09694ea4560e496057e3192615a1608995b4791b405d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763595713, "uuid": "617137f8-f4c6-433b-a7be-92d484818d73", "value": "T186469C2893E905B9D42BD638C656C333DAB0B9925736C20F095EEA452F739608F3F725", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763595713, "uuid": "5ce1e2fd-5e40-4f08-a31e-c9b4f21b7cba", "value": "ee4d0b708225f2129a5056c58f1c1d9b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763595713, "uuid": "9ee60689-d848-4498-8310-44be1f052acc", "value": "49152:k8td1m0aoGorcrIvrzoUpXxbnz3jg+TcP3sG371DLqdU5YJCs9he56tkoVhsWl14:Tiroz3jgZP3nkDFNuooN9Xh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763595713, "uuid": "169aa92f-4d67-4193-a1a8-6210ee0af2ff", "value": 5531136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763595713, "uuid": "bab2f041-bc27-4bc5-a844-5bb55598db95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763595713, "uuid": "ae867827-6bae-41be-bce9-157c2b88ccc3", "value": "RFQ JI-TECH_Materials&Specification-DB700-BOQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8968f6fd-c576-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763577335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577335, "uuid": "751c3cb5-8471-4bee-a6d3-6dbae0e675dc", "comment": "Malware payload (ConnectWise)", "value": "6228a3a94313044bbfe37c2c8519c92f", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577335, "uuid": "91d5b236-d3b5-4790-b42c-d483f027e85e", "comment": "Malware payload (ConnectWise)", "value": "9f9ba57f3c2425d94a2a2d40886d8582ec75b774814d6eeb9f0069f969c5eb25", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577335, "uuid": "6f79cb54-57b5-4f13-bd94-fcf0c23efad0", "comment": "Malware payload (ConnectWise)", "value": "7a64bb89702dcf61f222e49f6f91398e30460cdb", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577335, "uuid": "c3319dd2-0b1d-4dab-af7a-5f4b0eb51ab1", "comment": "Malware payload (ConnectWise)", "value": "53992e5ee586757d37a059e09174fb30ef229d1a39ebeeb17361108d01d75f8e279507c4099ab92d35bee8f31f78697b", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577335, "uuid": "d085019d-d673-4387-a0ac-13807b696917", "value": "T12E071212F3E58575D5BB0A38E8B946965A35BC054712C2BF53A8B96D3D32BC09E32333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577335, "uuid": "380349e9-637c-4df0-87a6-32d1e4cb4519", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577335, "uuid": "289549bc-1768-4eec-9600-bca8555143ca", "value": "196608:mQfefP+2+kLGB1X+Z3/F+kLGB1E+kLGB1U+kLGB1c+kLGB1H+kLGB19:m8kqBRpkqBrkqBfkqB/kqBAkqBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577335, "uuid": "74cfa202-e08e-4c5f-86d6-3ecbf31d4903", "value": 16934968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577335, "uuid": "e062c01e-a1bc-42b8-a7d4-86da91bb63cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577335, "uuid": "f387d63e-9e1a-409b-a5ca-5d9015ff9b78", "value": "ScreenConnect.ClientSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de9f51a-c537-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763550257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763550257, "uuid": "05f8e6b1-9126-4821-aa08-51a1ab9bad0f", "comment": "Malware payload (SalatStealer)", "value": "a95b450adede39859c069b32281d1b6c", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763550257, "uuid": "2cab6689-ea24-44e9-a702-dff03d4e6b7e", "comment": "Malware payload (SalatStealer)", "value": "a009d752494145c288387e586779a884b3f9729d6c0edab567ad5af122f7d478", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763550257, "uuid": "964e6587-6efa-4b0f-a760-f98e169250ff", "comment": "Malware payload (SalatStealer)", "value": "8d6355b0b34a33a9e20c6036fdaab6d830c94f5a", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763550257, "uuid": "95e81837-6659-4590-907c-d6b813b437bc", "comment": "Malware payload (SalatStealer)", "value": "7fb6e59cb185b2790f648abcd7fa85a84b679431fccf30ea6ea586d313758c1462806b0e5b4cf655329baa1be73f9c0b", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763550257, "uuid": "a2be649e-4211-4c46-b637-a35b9446997e", "value": "T165E53301E48783BEEEDF4EF027A7019459DB5820AB579ECC196D22F7229A0DDDC64F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763550257, "uuid": "b499b944-9ff0-457d-a8ce-0865b2de36ad", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763550257, "uuid": "902424da-1518-4a5a-9173-e09da6a3a254", "value": "98304:OCjfwUhao2LjmLTXN6nRodz9uuQzVAPp:rV2XmLTXNt1ku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763550257, "uuid": "eeca12ef-fb4f-41ce-a98b-aed2cf42e249", "value": 3289600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763550257, "uuid": "9c72ef09-6c99-471b-88b0-5690b46647a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763550257, "uuid": "bf23d556-df6d-41f3-9448-de64622d0479", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "420781c0-c577-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763577644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577644, "uuid": "7e7d2dc3-dae6-4959-a204-dfdfa3879559", "comment": "Malware payload (ConnectWise)", "value": "7d2cd0d24a1ccd7aa4019cf41d09ad20", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577644, "uuid": "7def3bf9-1dd1-4f42-a6c0-1d7eff836aad", "comment": "Malware payload (ConnectWise)", "value": "a04109c2a23268dcab67e68f80d1738121c19a364d0839a981c52f1d2388c057", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577644, "uuid": "acb50f96-b95f-4acc-a8ad-75f7e17f9d27", "comment": "Malware payload (ConnectWise)", "value": "280127ac493221fe28ae5721615a32e5242a4386", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577644, "uuid": "696d400a-eedb-41eb-9903-87f6be2ce286", "comment": "Malware payload (ConnectWise)", "value": "fdd8d6982e23ba06fc4fc0dfa2599b3e7e56ea8980f1e5acefa65afcecd8809187bd287909db9a3d294575f748368c90", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577644, "uuid": "4fbf4ae5-6548-4e16-b4e0-d84440811798", "value": "T1CBA6233066F8D226F1BB0A31FD3991B14C7ABC64E922C15F0364391E1DB5E81AA72777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577644, "uuid": "211b2b42-289f-494c-ba02-ad86c541a711", "value": "98304:+qPUuYs+fvXPYGyOQAG3L3WsjOW9BMQDqPUuYs+fvXPYGyOQVqPUuYs+fvXPYGyN:+gnsvfm3WsH9BPgnsvfYgnsvfjgnsvf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577644, "uuid": "4bb61aae-93ed-45b6-b507-ef9ca9c21e48", "value": 10063872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577644, "uuid": "235b0d91-06d9-4d61-8446-597858a73787", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577644, "uuid": "2303c26f-4b93-42b6-bd4b-bde0d03a65f3", "value": "awaits.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef56ac4-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594926, "uuid": "d0cb573c-83c5-40c8-bfa7-53206a1dce81", "comment": "Malware payload (Mirai)", "value": "c3fe453aaa339a993665cc7f3ca4e451", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594926, "uuid": "7f444b93-88a5-47ea-96dc-1a43f59f19bf", "comment": "Malware payload (Mirai)", "value": "a11a2a21c29c4f4c51efbf3e9666e92ba4c4e29473caf28e002046465926d2b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594926, "uuid": "0c17dab7-ff1a-4867-9e68-59e2185534b7", "comment": "Malware payload (Mirai)", "value": "e3642774461d46675801aef86b241a7ed99261fe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594926, "uuid": "a1c41062-d290-4469-b987-f8030f736b83", "comment": "Malware payload (Mirai)", "value": "fe538ea69a3ebbcfb4f72a01b1e108e9633b59d0747262def705dc6dbfe3e10e294d25a5a21bb67340f97062b9c56bd6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594926, "uuid": "0a45f571-c5e4-4489-8ad6-6af306e54ed6", "value": "T100B34B03B9C28DFDC049C038437EB536D926F0EE1739B29B27E5EE266D0EE610A19955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594926, "uuid": "72d2d4c0-1814-4533-92a6-b5414a69df8f", "value": "3072:zKGf4l7mDTXoeB+Egwe4RP1xAt+lLnuJTjtOEbQcG3cGG:zKI4lmvXoeB+Egwe4tJuxjn7BX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594926, "uuid": "3956285d-3b12-4fdf-abb7-c19e2137b4ca", "value": 109968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594926, "uuid": "e550050d-05be-411f-aa3f-d7a3bc1fffdd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594926, "uuid": "8e53bd44-c527-4888-b4cd-fccf55468bd1", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba96de9-c59a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763592800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763592800, "uuid": "d221877e-92ab-4023-9a56-afc812463827", "comment": "Malware payload (Mirai)", "value": "c6445562674961dafe95403d0c027e16", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763592800, "uuid": "72d852c9-9c8d-46b2-879b-321b74388ac0", "comment": "Malware payload (Mirai)", "value": "a18855fbfec334cf63149326a51977dc98bae53179ac99dc14030e349831f3d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763592800, "uuid": "3c19a230-e1eb-4dc2-a375-8f47f4937cb2", "comment": "Malware payload (Mirai)", "value": "025242f6aeb3b6710da09bc4c587fb5588b3bf49", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763592800, "uuid": "2ac58642-3e84-41de-9005-86379bad0a78", "comment": "Malware payload (Mirai)", "value": "9072573354f3e6c63d540af46e213ef3aa6fe00caf09c48991fb153d6b2090c4b0608cc388f1b7a928dd94eb6d8eaf50", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763592800, "uuid": "99f9d52f-60b2-47b4-9f8a-9d0ceb696d17", "value": "T181145C91A41559DFCE1098BE73AC8F7427827D30824B1F6D4D628168A28F8DFF1D6BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763592800, "uuid": "7f8a0ffe-3f2c-4c9b-ac95-f0cc94258782", "value": "3072:TcYoK4FJNjnHUR2j8+28zM0oHW4GTJOtrYIK:TcQgJNjnHUR2jV2yno24GTJgsIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763592800, "uuid": "b090b0b9-6d5e-40c6-824f-4d0900d84055", "value": 203184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763592800, "uuid": "ff920966-0082-4df8-9e10-8312aa84baa0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763592800, "uuid": "80850e38-9823-4900-bde2-0e1059aed697", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07142fe7-c576-11f0-a129-42010a9c0007", "comment": "Malware payload (N-able)", "timestamp": 1763577116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577116, "uuid": "fb982338-4cde-412d-9a95-6e78d4dcb1aa", "comment": "Malware payload (N-able)", "value": "87ff1f2064b32ba5f32de84a785ba553", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577116, "uuid": "1c651367-dc37-4a7b-9e23-d865bd4a5bb9", "comment": "Malware payload (N-able)", "value": "a1991028c0d30df00531c287319317bef00aff902a2d20e677df0473072f02b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577116, "uuid": "06c125cc-7ca7-44d8-a33f-72499fa3d254", "comment": "Malware payload (N-able)", "value": "cd5ef2c4dd99f86dafc499cd0c017d77eea13910", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577116, "uuid": "adefd927-0ae1-446c-a3cb-4c24cb2a5549", "comment": "Malware payload (N-able)", "value": "da7bb73159203de3da4f86124b6c1739ec408c11960f1164d21ad6b8af124638633ae0bfcd8fb54b2758844d62ccf53f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "N-able", "colour": "#3DA18E", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577116, "uuid": "6e001247-b1e4-4779-8dfe-899da9c14369", "value": "T1AFE633527C88DBBFD4212770C6429B77529B7A74481018AB6F0C1CB66FB38CDE529B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577116, "uuid": "d59d72d5-3830-4448-b9c5-a05c8cd3372e", "value": "0c40996f6e1e5f2a82b51e9950881bf1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577116, "uuid": "011c800d-c223-429e-bcd4-a51f0a006169", "value": "393216:qsF/OiT86xvk7HiMPo7c7rd+ljUxrwn5UcmQMD1W:lrRxvoC/7a0jUxX7h1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577116, "uuid": "30eb0033-f8df-43cf-9a30-148181fbf447", "value": 14781984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577116, "uuid": "74611739-989e-4f23-91da-65a00e7a7de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577116, "uuid": "7eea1197-ca0c-45ee-8d98-dd1195686a60", "value": "rws.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20886a52-c4ed-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763518318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763518318, "uuid": "2a2ba129-5397-417f-b140-c0e53c26cba6", "comment": "Malware payload (Mirai)", "value": "248c7526525efb5b43c2afb16ad062f0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763518318, "uuid": "fb0e3790-e515-4770-9af3-b8a32696dc8b", "comment": "Malware payload (Mirai)", "value": "a1d151543f9946638b20891ee375cc59d6c8fc69d432c3b3bad92add468ca376", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763518318, "uuid": "e6a86606-2aa1-40a8-964b-9e562283246b", "comment": "Malware payload (Mirai)", "value": "4b41c153b28b483a58ec2cf0f608ad02d420d1e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763518318, "uuid": "6fbf5bc9-e95b-423b-a93d-07b81b2bc6c9", "comment": "Malware payload (Mirai)", "value": "4bf2607c26032583fd0a1165f3aaf044780449bd907eb88f08213415a58b6f4b215d9187f648559e7a31ed6d4494ce8e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763518318, "uuid": "611a6562-9de1-4527-b819-04a6a086748f", "value": "T14983C54A7F614FB7DC6FCC3749AA5B0425CCA60B21A83B397934D418F64B24F59E3868", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763518318, "uuid": "62fe8511-e1cc-45a8-82ab-c597bf523f47", "value": "1536:WAKxcW+RTSmwJE6lCyC5birVpQu9JAVSxIvvJusvRug7R:WbqW+RTW9mbe6YyRug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763518318, "uuid": "abf5291b-b1ad-4ab3-af73-48a428e07002", "value": 84228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763518318, "uuid": "3f6092d2-194e-4109-be7d-b4ecd9747707", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763518318, "uuid": "92c36e13-5bc1-478a-b126-1770ea6205e9", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a058d1b-c586-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763584073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584073, "uuid": "1b50bba9-7830-4f92-8492-4091b2145b61", "comment": "Malware payload (Formbook)", "value": "a52abf4c7a054065da881449a446c2d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584073, "uuid": "b404c42f-cf8d-4717-8b7a-9a7db5ca94e4", "comment": "Malware payload (Formbook)", "value": "a22fbf8df4e4bc60d3e712cefe4827639f213a93b1a995218d3950f5edbe5078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584073, "uuid": "abadddcd-ed35-494b-abed-7da730b1a8d2", "comment": "Malware payload (Formbook)", "value": "437b55263cdc78ea61b694b00842b571ec5a6dca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584073, "uuid": "5036009b-7c5e-4c49-83c9-df60d7fb88cf", "comment": "Malware payload (Formbook)", "value": "3c9bf76db69f6fe91862290beac34ef1e0bda83fe0ea67e4db9e6b6d97afcbee6210c93ad81b72d7d523d4cc38dfca27", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584073, "uuid": "8f19c957-4e06-4ed2-8fd4-12e17320d111", "value": "T17445CF1373DDC360C3B26273BA267741AE7F782546A5F96B2FD4093DE920122521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584073, "uuid": "4471c192-9ad0-4402-a85c-5966a107950d", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584073, "uuid": "933a37da-6ee3-432e-8334-55ceec969f40", "value": "24576:Ztb20pkaCqT5TBWgNQ7aucGcvyxEipXDP6A:qVg5tQ7aun3Eidz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763584073, "uuid": "668f7146-6cc8-4b86-932a-5c9b3f604ca0", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763584073, "uuid": "b603c56a-8a37-426d-9aef-3eda8b9a1949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584073, "uuid": "27868917-89ca-45c9-b426-c60e50412b10", "value": "inquiry from SHANGHAI to CHITTAGONG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60dc9aac-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594876, "uuid": "f53af4e3-36bb-4ca5-989d-ff86da24dd36", "comment": "Malware payload (Mirai)", "value": "3228a6b0b382fb508abc6aa717dc7809", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594876, "uuid": "cce71503-a5d2-4e0e-aa4c-622b7ca50575", "comment": "Malware payload (Mirai)", "value": "a331be0da746439c8993d578891c675694d46a79c1a2ee72f61d5c7c8b3f2b57", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594876, "uuid": "e3139020-f6c7-4918-8555-5cb1de393d3d", "comment": "Malware payload (Mirai)", "value": "8fdb174ef2ecb4dbf1577d7ce4a55fe1c427e975", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594876, "uuid": "0acf0347-23fd-4bdb-ac6d-76de22449773", "comment": "Malware payload (Mirai)", "value": "c0a6b98eef88b916f7774f6a9d82603985659fe6a907305ec902098a0f7ac9371423e0432283f81e032b272b91601cc3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594876, "uuid": "721424f1-0b03-43ca-b8a4-8a2430eedc96", "value": "T17723F1A75D3FE268C9A358339B264DD0EE495E76C8428ADB0C45F3FECEB79109711A40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594876, "uuid": "6a4ec545-add0-46ca-9d56-6f1e9aa1e0b3", "value": "768:5ApV3/HxLw6uJqr8ynguJ8io58Nt7wE057qGxii3TvfLHyewlw4VKThIM5c7WTjo:5URL7uSngC4u657Jn3zTZwO0KTyMuWTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594876, "uuid": "2890873a-5b10-4f94-8e0e-7716fc5cc4d9", "value": 47596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594876, "uuid": "6ced214e-9691-47f0-84cb-ef239fdf9644", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594876, "uuid": "08c69458-e0a7-401a-a581-a55f8c05ba71", "value": "S3o.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7feb191c-c590-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763588486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588486, "uuid": "1dcf0fe1-d868-4ef4-bf8b-9d90005dbd94", "comment": "Malware payload", "value": "82714b645e276dcdd4f4e69879ae0d21", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588486, "uuid": "588944c3-c3aa-4bd7-b437-4186981eeb04", "comment": "Malware payload", "value": "a3d738ac7f58dec46b30fa546987dafa8753b9324fa948cc84fb7ac51ef8ac7f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588486, "uuid": "29dc6082-5099-4b7e-adae-4f15e8dab34e", "comment": "Malware payload", "value": "9b9bfb7475ab8ee4874c7918ec03bfa8bc47cb8b", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588486, "uuid": "ca088f9c-cc64-4f8d-8dfa-36d920e5d09e", "comment": "Malware payload", "value": "aba9877cb2d5d6429e7528b3e4d96362d74e8ca430acc3deba2ffb20ba41d26b8b2f1db714cd13cbec924a23a77a5166", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588486, "uuid": "5cb22b97-5006-4ee3-9167-93bb42b835a2", "value": "T1ED5422B7C39A9216C991C8382AF2B7BC037D3983050ACFF6E9B4817763501E55366399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588486, "uuid": "9ec6aa7d-658f-488f-8dc7-187426a93ff4", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588486, "uuid": "0c6bcb89-53d9-4326-a4eb-38f3f3f20d17", "value": "6144:tG1O4G85sO4nd81fZYoJHjPAFJhkxAhXFLuYzuQ/B4:tG4m5lEM9PAFJSs/xJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763588486, "uuid": "9a32b3ab-f66f-430b-a5cd-5dec6274dfcf", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763588486, "uuid": "f60e5971-409e-4b44-97a8-8f968225fec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588486, "uuid": "3c09424b-0e13-47fb-b50e-f1d7f746716c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70488000-c58f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763588030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588030, "uuid": "79409f8e-21e6-47f1-ba0f-3b550d4ac685", "comment": "Malware payload (Mirai)", "value": "92d26022fd1c04378f3a93f09d454e30", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588030, "uuid": "7893e21e-7655-4f47-a5fd-4d3d576068a1", "comment": "Malware payload (Mirai)", "value": "a40ae7a4bc509281822397833b081fbc68514e5a4e824163f9224a457fddaeea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588030, "uuid": "0e680208-35cc-4072-9c57-aa63eaa6da84", "comment": "Malware payload (Mirai)", "value": "a4930299a159f2f6ca86798a7c30aac7b297812c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588030, "uuid": "22d22e65-1db3-4e61-8d3b-e615724f7dfe", "comment": "Malware payload (Mirai)", "value": "d103198262c4867c037398c1a87040cd4f2b1fe4a427fb67b3e6df4daac8f61cc3d934a2864d9c7b01826472e1069226", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588030, "uuid": "44d54f52-6113-4a4c-9f55-ae1fe0edf5d9", "value": "T1D2430271EC29A2908D955EBC4BE4FD15EF61AEB6C19B70400292AB1CFFD74C626E4143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588030, "uuid": "0ebb2728-9ea9-41d4-8a25-4271f67e3810", "value": "1536:R9Pi95NMBXnsEMJv+hjgJ4tNX4oht18h0uI5kiWRULg:RQRCLQvMgi9tt18+eqLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763588030, "uuid": "f5bdd82e-277c-4a38-a5f5-01ee11399ad9", "value": 57356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763588030, "uuid": "c1dd9cf6-efc1-4e47-bb9e-371a0bf459b6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588030, "uuid": "9a7195aa-257e-4576-86ab-0e5809e88fac", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "298f3558-c55e-11f0-a129-42010a9c0007", "comment": "Malware payload (QuasarRAT)", "timestamp": 1763566866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566866, "uuid": "248aacaf-a8d4-42ae-aaf5-c7eb1ae0afdf", "comment": "Malware payload (QuasarRAT)", "value": "d596929fea4af53ab23eeb7e75d92686", "object_relation": "md5", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566866, "uuid": "f7ba0023-54bd-4aab-905f-377b6cae54ca", "comment": "Malware payload (QuasarRAT)", "value": "a4363a37a17c3708d6cd1cb8a18cf87cbe4c99baec6dd267cb7f847bfc97fa34", "object_relation": "sha256", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566866, "uuid": "23588a88-9ad9-4705-94f6-087f5ce34497", "comment": "Malware payload (QuasarRAT)", "value": "86abe86a3e2f4169867a54b07b8b5e61b5e77ded", "object_relation": "sha1", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566866, "uuid": "fcfa709f-9a01-4f1a-aa2f-d55ca5e41369", "comment": "Malware payload (QuasarRAT)", "value": "1ce3657efd66c2bbf05215144fd92159acc0655a8a01adcb6f27f79ddfbe5554614d02bd67ea110b2c9daed12ec79ed4", "object_relation": "sha3-384", "Tag": [ { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566866, "uuid": "6b0dd1d4-f520-4c90-bd22-702aa617cddb", "value": "T16AA733BDD8684861F9A63F359F4C0019A535444A5C7D4E0B387A3F8ACA3F7F9648B89C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566866, "uuid": "b9be8407-8214-4d95-b465-8930e1364390", "value": "786432:F2KU0cV7WSnHqYAN889gPZzKd8IPNvfCNK1OdTf7juLpd1WTHFLeYvHxepw:F270+7jKRt9sKvlw4UOLp3UHFLeo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763566866, "uuid": "953bb037-a344-4479-9010-1fbd16875ff6", "value": 47684672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763566866, "uuid": "0ea2b965-3c18-4487-a14b-e0b1c89f1c4a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566866, "uuid": "24cab503-de83-40e6-8524-344749abad47", "value": "pulsar-net-win64-2.4.3.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "badfd378-c523-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763541769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541769, "uuid": "b604ec1b-6e0f-4a1a-ad83-c2154fa6edf4", "comment": "Malware payload (Mirai)", "value": "93212d8dce933176a400c569cbf80967", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541769, "uuid": "3858a71f-8cdb-47df-b374-ffadf7ac24c6", "comment": "Malware payload (Mirai)", "value": "a4885db138961a9480231b6405a7703e6908935a514f260d56a85778e145e6e0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541769, "uuid": "07653bc8-8303-453f-8550-b8630f7c3f5c", "comment": "Malware payload (Mirai)", "value": "36d00dc1e3682fe9b6d8754b30f879f17ac35249", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541769, "uuid": "12526a1f-b1e9-48bc-aed2-1a350cb48c0c", "comment": "Malware payload (Mirai)", "value": "732448f94c2362379c889d7a00f7a618b0eb445a96a59c4ca507d1a090429e04e2c68bd7debb070bd403571129be9ea4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541769, "uuid": "5ff141ba-08a0-4d85-84eb-3a55d5cac31e", "value": "T1A6A32956F9519F01D4C635FAFA9E81493353ABB8D3FA71018D20AF6123CA9DB0F7A502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541769, "uuid": "acf25142-69b9-4edf-a19e-17c3bd29059d", "value": "3072:ICnSsbJhoIhaToHXQV+TwXE9zqkZEpl2:IC1vhaToHXQ2wYz9Zel2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763541769, "uuid": "f1afca6a-b8f0-4954-ac57-75324e3cda88", "value": 103616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763541769, "uuid": "88597c12-2d88-48c7-8f27-a8ea12fd48ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541769, "uuid": "122d3392-2833-4c3e-8c9b-876ca8af6fdb", "value": "arm7.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ec581eb-c4fc-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763524945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763524945, "uuid": "0fe94f58-27b7-4a9c-99b7-6db65783370b", "comment": "Malware payload (Mirai)", "value": "164495f4885a39d2e22de4c666d1dc69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763524945, "uuid": "e5fc66f1-7c9d-4473-9de9-b4cf09dd0aff", "comment": "Malware payload (Mirai)", "value": "a5b5fcce8c96c9b5021b2b55b8877df0065d4d16a3d607f1e9fad898499dc77c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763524945, "uuid": "a2168eaf-287b-4f77-9b11-9a617dc8f47d", "comment": "Malware payload (Mirai)", "value": "9cba462199c783d7c679eb8096f5475b0ed670de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763524945, "uuid": "b9e4e747-63a1-406e-96f1-629e10eea6f1", "comment": "Malware payload (Mirai)", "value": "096286b57cfec3730decbf8a8037a132f5256d4e24df93696580078f24bfe613375a3f06a77ab27ed3cf654fced576e4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763524945, "uuid": "7b164e46-5f8d-4601-bba7-705d8fcb3bc3", "value": "T13383A70A2E22DFBDFB6C873547B78A219758339637E0C585D19CE9015E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763524945, "uuid": "9e0e613c-22d7-4b4b-b360-580bbd5e5c4e", "value": "1536:v3T1zOrVagGFuSO0Vwx1+54V7rT1fXqccbug7Rp1:r1ziVgg0sQ4V7rlXqnbugZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763524945, "uuid": "658e0d84-3add-470f-b47b-9246cae221b0", "value": 84228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763524945, "uuid": "7ad4d133-751e-441e-8622-ac6c84d613ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763524945, "uuid": "a43b0503-6f33-44e7-bcbc-b26f621e54fe", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f836f8e-c590-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763588485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588485, "uuid": "07cf8e9b-a4e1-42d4-9218-45f22eb23248", "comment": "Malware payload (Mirai)", "value": "0b9a26c25fd90c36cc3a49a0a4831094", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588485, "uuid": "03dcfeb8-1d40-44eb-99ff-9e668e28ab46", "comment": "Malware payload (Mirai)", "value": "a62efec45452accb57a91de2c50e8061772f9941439f398d7628b7f0dbc63e56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588485, "uuid": "b17c81a7-2264-4202-9fc0-1f9bdda1e791", "comment": "Malware payload (Mirai)", "value": "6d6a3316eb874e8627a158ef04929bd1888427e3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588485, "uuid": "3c7b1f2f-b097-4ac2-814b-9e71d8f56f5b", "comment": "Malware payload (Mirai)", "value": "66c5e2982140949661c473e5f6df6d1c0792c3e074aedeeab499b964621af4f40fb6be6c159a5d8128392cd280347300", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588485, "uuid": "7aa7cbe2-5cfb-410a-b298-f031e8658c35", "value": "T158D34B46F6418F13C4D61776BAEF41053322ABA0D3DB730699285FB43F8675B4E63A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588485, "uuid": "8a9888bd-2400-498d-9815-14a1ed667d96", "value": "3072:sRMQurHfwUHOPr9lG1aYrytgoOXd0M/9Lk5rm/zPVsV:sRMQuroAOPr9lmaYCOXuM/9Lkpm/zPVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763588485, "uuid": "e1350a2b-9ff9-474c-a4aa-a9636717d0dd", "value": 133286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763588485, "uuid": "18a84ba5-f797-4d75-97e5-444cfa893fc0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588485, "uuid": "f75a10a3-11b1-489d-99a5-fd4f30a8b735", "value": "boatnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845eb256-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594935, "uuid": "c3e6e03d-e0b9-4ec9-949d-d7107ed2b85b", "comment": "Malware payload (Mirai)", "value": "4db2d9bbef4d0bcb14b9ffe7aae0dd43", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594935, "uuid": "362e3ea5-814c-4155-8f87-18fbde204a35", "comment": "Malware payload (Mirai)", "value": "a7e7b0ada181b0d9668258758d2b15612ea8ae20e3107600642937981c302408", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594935, "uuid": "b07200eb-bf01-408c-8405-8fbc423db070", "comment": "Malware payload (Mirai)", "value": "31bb9bb25eceb82924d9ed1967ccabbf5d664e87", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594935, "uuid": "654992b5-ebcc-4a25-b3bd-9b1bb4181f8c", "comment": "Malware payload (Mirai)", "value": "0c059acf9be6116340fbb9586d32686d3a1887804bc4eabff515005f182cf3deecd6ef61ba7c8ce3cd0ee36dd9f7aedc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594935, "uuid": "797455b4-3903-496c-93ba-f50e6615d355", "value": "T1FA144B46EA414E13C4D7137AB6AF424A333297A4D3DB73068D286FB43BC279E0E67645", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594935, "uuid": "7c65175c-2fd9-44a9-86e4-3162a4d905e0", "value": "6144:TJTPwUaRtjVevpVNZaibRblc6ssNCttch23b5M/9/2Sg:TJjwUaRpM3NZaibRblc6s2YSwu/9S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594935, "uuid": "9f215df9-6e63-4209-8d3f-00aa20633dc0", "value": 201647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594935, "uuid": "9729547c-fec6-4004-91aa-c335557b478e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594935, "uuid": "e084dfbd-aa55-47d5-85e4-9f241917961c", "value": "S3o.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff082db-c578-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763578258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763578258, "uuid": "0bc8a45d-f57e-4e55-a841-1f689694158d", "comment": "Malware payload (Stealc)", "value": "954257841e40007a6d51754693436eed", "object_relation": "md5", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763578258, "uuid": "463457bc-1c40-4459-a317-8daebca819a8", "comment": "Malware payload (Stealc)", "value": "a849d1769b7f67ac1d0872e5b2f6f2fc58554ce634f916e15462ba5a6a2f1b29", "object_relation": "sha256", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763578258, "uuid": "e76c5fab-689b-4e26-a35b-6b5b74a246ec", "comment": "Malware payload (Stealc)", "value": "00de48abd0a4cd4c5d944b4bf72cf16d45ebe66d", "object_relation": "sha1", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763578258, "uuid": "31987544-7151-4940-83eb-ab8ab59a1ed4", "comment": "Malware payload (Stealc)", "value": "5a3bdc42f614efe6ab7fd3e4f4c66d4d3464f54ac9596ec7020858d921ef516fac99e64e8ea6038abace7960590dbc21", "object_relation": "sha3-384", "Tag": [ { "name": "de-pumped", "colour": "#4EDBFA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763578258, "uuid": "a33f5070-acb5-46e8-a2c8-efc1ab54f551", "value": "T160F57E122DC0C9B6D459A239C4F261A5762BBC184B71A7C36D617FB92E33BD04BF2724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763578258, "uuid": "541508cc-1922-4b89-b531-a48a82a0db1b", "value": "d42595b695fc008ef2c56aabd8efd68e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763578258, "uuid": "da630535-94a9-4c4b-b7e3-5181cfaf3ffc", "value": "24576:0x9n/XO4Q52LDhg+gKBNngbhbS52O/sIrX3HjPL3TOPyDLr8Au8sO37mXaJZP+6o:0xhXOMg+gKBJg452O/BhJ9KajRahXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763578258, "uuid": "fbf223cd-b1df-4ff6-9215-440abc7ab01d", "value": 3483136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763578258, "uuid": "7cb74f5a-bf90-417d-90c7-a8640a6dc90e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763578258, "uuid": "9048ff67-38a8-4b75-a671-8995c7da24d2", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6229601e-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594878, "uuid": "c542717a-468e-4ea7-9a12-f820bd2dab4a", "comment": "Malware payload (Mirai)", "value": "4a9083906bcbe8d107a01b7f9be3bff3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594878, "uuid": "67a135b4-2185-45a7-aef4-41bdbdec6e4b", "comment": "Malware payload (Mirai)", "value": "a8511dc37eef99cc3ffd70ad27c7cc7297535a3cac28c5c9d854920ffada9d89", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594878, "uuid": "2248774c-552a-40fd-ac27-464625abc3cb", "comment": "Malware payload (Mirai)", "value": "cc9d128d25b7916b9698ec5cc98553f72c39150b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594878, "uuid": "9ac14877-6fd2-456d-9179-27d0de129bab", "comment": "Malware payload (Mirai)", "value": "37cafbbc08d50ffc5ce29354a2f777dd3f3516b975facbe948baaec939b8936edea76e4c2a23beca8752904ff3bc97d5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594878, "uuid": "4cb5f97a-5a57-42b3-a20f-18cfe64db77d", "value": "T1B723E1E9891388F8DDB2D4FCCFF82B0A1E354EF5A1915C0ED945EBAC8C088293157D99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594878, "uuid": "3d8b288c-a4e4-4845-9f18-132ef4fe1824", "value": "768:9eFEEzPeIJh4f4dSYMi14cJr1LtYgqj8Fb5Y+rvkpO4mAfadCsDPqT7kc61IJgG0:4EEzGI//gZ6A3cb51rvkpWcxe47o1IVS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594878, "uuid": "9653092b-5b61-4daf-85e9-6179f820cb12", "value": 48512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594878, "uuid": "0521e747-9e87-4cda-ba9e-dfe6c4cc01f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594878, "uuid": "47d691d5-b493-4a55-a367-3495f0422a8d", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070cd017-c58d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763586994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586994, "uuid": "edf60959-7114-493e-aa67-c81e1f0a6361", "comment": "Malware payload (Mirai)", "value": "39b4fc14d2831f7f08adbaf8b8a43744", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586994, "uuid": "84c6d9a1-76bd-4548-9685-215e47b12eee", "comment": "Malware payload (Mirai)", "value": "a9b11c952f91f0cdd4d4169877d62d1b1b0a1c81cbc1a635e16c7f1be53900a1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586994, "uuid": "c9fd6ab5-a8ee-4f47-8da8-0b5ace4704f7", "comment": "Malware payload (Mirai)", "value": "76a56fb1b0b8cad9b921dbd3e0699ea9e3d8fd20", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586994, "uuid": "d86e62b0-8f1b-439e-b026-8d7fa2c09cb8", "comment": "Malware payload (Mirai)", "value": "c1e434f8ea07f137cc8bfec851e145a92f61622de9d3a5e645d3974c6794d088a8257c51dfd0b5a72191612b2b3299fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763586994, "uuid": "95076cd0-6909-442d-9ee4-855f9dd58183", "value": "T1ABB3D84D7E629FADF3AC833447B38F31A758238626E1D685E26DD5052F7024D282FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763586994, "uuid": "e1fe3d1b-b9bf-4daf-9546-06dfd687cc8d", "value": "1536:ne1lUcWDDX1YG9/igYr4sT+A6KIM8eXMWboXwePxlAxXRDem7P/9:eUxxr/ir4sT+fMXMWcMxXJ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763586994, "uuid": "76e22a3f-685f-48ce-8406-c502b3dbfa52", "value": 108092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763586994, "uuid": "60b7287f-b28f-4cc0-90c8-5df866690406", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763586994, "uuid": "9e3e2879-5aaf-4752-a2e8-dd4d46f8561f", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d7b79d-c544-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763555664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555664, "uuid": "455ef2ef-23fd-4b46-aff3-e09905635622", "comment": "Malware payload (Formbook)", "value": "93657f0206d7c49ff3aaf4115c2fd878", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555664, "uuid": "44cb763c-9e9d-4744-b250-1d693f16bd58", "comment": "Malware payload (Formbook)", "value": "a9bf95048847b326d432a31548079e948c6872a1c8706d8d1630eb3d77bd4383", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555664, "uuid": "a5ab02f2-7e8d-4b3d-9f82-b45814f46cef", "comment": "Malware payload (Formbook)", "value": "689ad1e5b634c7e614755a7f7efd874d4d87ee6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555664, "uuid": "2049cf54-2aec-4a2a-bdf4-c4f7713548d7", "comment": "Malware payload (Formbook)", "value": "fa7554900bc98d7769780ba9bc87cfeab7dd7e3429deec71a6be4d4e299f91149df22062e1ad87a262f0612a86e43e24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555664, "uuid": "46259ffd-2cfe-4ff2-90ce-bd4bd69967df", "value": "T17A45CF1273DEC361C3725273BA25B741BEBF782506A1F96B2FD4093DE920122525EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555664, "uuid": "4b0aa9e8-e927-4fa3-acd3-cde0dfa02b77", "value": "0f7552f9514e3a32a8dc8a5a9d9c89a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555664, "uuid": "20227191-c68f-495c-84b6-87df02618bf7", "value": "24576:Ztb20pkaCqT5TBWgNjVY77/dnZft6VYQgj31n16A:qVg5tjVY77/F2iQy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763555664, "uuid": "ea5d15bb-616e-4b3b-af0a-b02f124bfc7b", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763555664, "uuid": "4f6810e4-6cf1-4800-86f6-7d5a3eb28888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555664, "uuid": "78c42c33-df60-4cde-97b5-a49728a15052", "value": "SOA2345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e265ca-c51f-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763539875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539875, "uuid": "0f3c623e-d501-4fa2-9597-5921246b04f8", "comment": "Malware payload (Formbook)", "value": "1c46766cf31a7be01fe7f724798f0dce", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539875, "uuid": "d12ffb19-7a8b-4bc3-b69e-b5d511fcad56", "comment": "Malware payload (Formbook)", "value": "aa5ac113df76c7e35a44261abf09b8e7f30b90413584fb2c6ffa91cb1c3f0302", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539875, "uuid": "471a90b8-d7a1-4815-9b44-3b3a894046ef", "comment": "Malware payload (Formbook)", "value": "d4f1a435dd0ab56fdf2661bec3a063ed3641e812", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539875, "uuid": "8862e712-1c38-478c-af21-5968159e539e", "comment": "Malware payload (Formbook)", "value": "fde538cc92490babf2a16fe5b64999b484e12a54e378281666e509b73163b299bc31a086c3e51e6536bdb11d4e1dc1b7", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539875, "uuid": "68aedffa-34c7-4fdf-b779-32dd0514a300", "value": "T179815489F5D9F06C4F67A123111FA957940BDC40640EC458F330EEA1B8EA71DAAAE6A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539875, "uuid": "04eaa3b0-9524-4a4c-8573-9a26f70c4c03", "value": "48:DX+t/V0q1pb/9BHTcheJCNtlSmZeJGgZCy8NMffgLjZHzipDGwxO97ne3p55gsY2:QtPZBHW9fi5kRntsYqgFYJ+C7jXkJWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763539875, "uuid": "71d3b740-09fe-4996-ade7-cba165ab78a6", "value": 4131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763539875, "uuid": "bb096cf7-85ca-45e5-932e-dfec51619faa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539875, "uuid": "5872be40-b64a-439e-9df7-25bac3ea3d2d", "value": "DHL 231437894819.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8bef61-c56b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763572696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763572696, "uuid": "17893507-3bc5-431c-a1f1-8d1b560799fd", "comment": "Malware payload (Mirai)", "value": "0f2a01d045ee580ef0a83136f210d9ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763572696, "uuid": "c48615e7-c70f-4c70-8f96-7d2d1ab16af9", "comment": "Malware payload (Mirai)", "value": "abaa849cbe1e44ae1ea1d8ff67a6a2bdbf2db8abcbd5a91a5b23ca0a9b391ae2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763572696, "uuid": "a61a5646-0e18-422e-80c4-a7357d59498c", "comment": "Malware payload (Mirai)", "value": "19046db4cc40144b73d336e52ce6c01ff5e4fbb3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763572696, "uuid": "9561a145-08ee-4473-8447-067d1a04ce88", "comment": "Malware payload (Mirai)", "value": "7ccf721a9a086174e893a6dd859051c590183930d7f94bd1c5938950329d3152b96d6d43d8958891743bce1b9a73dc89", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763572696, "uuid": "25a5751f-019a-4c0c-844f-c3eba20b6dc5", "value": "T1B5933967F9919B11D5C016BAFA1E418E332307BCD3EF72165E20AF2163CB56B0E7A506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763572696, "uuid": "08f91269-9970-4140-ad56-526b7852b19c", "value": "1536:4stnayVOOMQUBVR7L3n46ap7ApV5P5lWa9QEuhEdHSiqVFU4K5JV7KQYKnkemeM:47DOMBbn4BuVh5lWa9uV24K5JVmQLnM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763572696, "uuid": "e1811bec-cb2f-41a8-b8ea-09440df631d7", "value": 91344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763572696, "uuid": "b45d1d23-be21-4919-95f0-8a88cdcd291a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763572696, "uuid": "8aa54757-2109-450b-9c19-e33b63a83d86", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08ae89b4-c53a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763551349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763551349, "uuid": "4503f5b9-4eae-467f-b83e-f6ca410310c0", "comment": "Malware payload (Mirai)", "value": "f3322468032da285f1906457446ec73b", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763551349, "uuid": "2ce7ab89-8306-4098-be52-29eebf817eb5", "comment": "Malware payload (Mirai)", "value": "adb29587593e95731ec9acef617a2efafe2b29ba38600c21c8a09c0e92d8bfcc", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763551349, "uuid": "8680bc88-3fc6-404d-a583-331a665743b3", "comment": "Malware payload (Mirai)", "value": "500033a3402719d6f23116577a2eb869dd0dea88", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763551349, "uuid": "ae2c00ae-6e7c-48c1-be9f-9c4800ec27e2", "comment": "Malware payload (Mirai)", "value": "9c198c0b69054d5645b70e0e8e8bab2e26ce281918b09c96a7f43748dacc550f1a165fab65125abc3b37241e690e2c3e", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763551349, "uuid": "d1ec5288-6bac-434c-98aa-c94bceea78da", "value": "T16401CCCD45516E55088DC94AF6934E2C100DCBCA6A8E5BC8FCEC986B96C0B59B404E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763551349, "uuid": "3be26110-04f2-4f38-9a3f-0d60b7f478da", "value": "12:KSs6wZsMesgNyHe06dsnesOMSYeJB8snEpIsEbsla9:KSKZ5I6N3eVEpaGa9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763551349, "uuid": "4e706ef7-e1e2-4ccb-8cbe-c9ed6ff637cf", "value": 814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763551349, "uuid": "47a7a220-b98e-43c7-810e-84747824cba8", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763551349, "uuid": "36d80138-8021-4f33-baab-832d8116dfec", "value": "awget.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e00c53d-c564-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763569531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569531, "uuid": "31d26ca2-0d78-4972-8642-30580bc0f89b", "comment": "Malware payload", "value": "a097ffdab7fddcef3523ad1008bd2b4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569531, "uuid": "a1e2dba8-dee6-4415-b6ae-c5ab1d8d8ce4", "comment": "Malware payload", "value": "ae89095b97719ff3ce49ac533b9b91fee0025d20e67c7ef2d50269328474f370", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569531, "uuid": "6fa459d0-89c8-4eee-a713-f52707de3142", "comment": "Malware payload", "value": "78294970412e88d98d2daf71cf72cf29910fcda0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569531, "uuid": "15bec5d5-3752-44e7-a789-2e84910f18d6", "comment": "Malware payload", "value": "abe832d9c08ea7a1a5ecbc24ab4553f0de1316d54d460bc9671de174a12387e7dca9aa567515aaa7b204be80e08b89a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569531, "uuid": "10c31146-b8db-42aa-9304-2bd2fd74318b", "value": "T1D0752319713A9D03D4AA4EF00961C2B567F16EDD9116D2CBAEDF2DEBB4E9F112200393", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569531, "uuid": "462e606b-0657-47cf-b40a-12bad48a5321", "value": "49152:nlC33vppZrL9jICRBa0ECA0uaaeylRMpi2/uH7urBT:lkvZrL9jIUaMOfTKi207ulT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763569531, "uuid": "d3d4d162-40b5-413b-83a8-8d570d4cbafe", "value": 1694720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763569531, "uuid": "83ce5359-f221-4a0a-a155-2fd9a70bc24c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569531, "uuid": "2d3665eb-0fde-41f0-be9a-7303c08752d9", "value": "SecuriteInfo.com.Win64.MalwareX-gen.77811414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43fd89bf-c4fd-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763525249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763525249, "uuid": "834d5790-3ecc-49db-80e8-8dbf529b3c5a", "comment": "Malware payload (Mirai)", "value": "71b34c3a967574d24c17e0dfec6ad9a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763525249, "uuid": "d8de1fb8-40b1-47f1-b1a1-c942748bf6e6", "comment": "Malware payload (Mirai)", "value": "b1b0520a8149a658b9fd44296c620792bcc9cf0b66c8a4654dd75abc6fa05791", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763525249, "uuid": "de4e41b7-c3b8-4e3f-b53d-1b6d053ca67d", "comment": "Malware payload (Mirai)", "value": "6eec5ec04cce4c6f9268446b5b0b7729c784a31b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763525249, "uuid": "ab44babb-e5b3-4dc5-94a0-54b4277cb4f3", "comment": "Malware payload (Mirai)", "value": "b6f13137b19a216073bc7a85ad0abda6247b3c75140a608f3791363ff8cc5e1c40f11cfa7b0f4f1a1613841980a884a7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763525249, "uuid": "3174f920-c0a4-4354-b121-f175c31e3998", "value": "T185833A56F9819B10D5C015BAFA1E518E332347BCD3EE72169E20AB3163CB66B0E7F506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763525249, "uuid": "8257e51b-5e47-47f3-b33b-bb179d773bb7", "value": "1536:RNn3mczLmyodnHINAtOTUwe7xTa9ZEk3+MDiJX7OcLF7ws5CYk+7em0:LDzLQHINk7xTa9OX7OcLFMs8o8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763525249, "uuid": "02c7046f-8366-44e2-898d-ccaa72ae475b", "value": 87248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763525249, "uuid": "4b40759a-5487-4930-8cb9-0774b5c7050b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763525249, "uuid": "3f131f38-8805-4bf5-a10b-9eaaf0ae194a", "value": "arm6.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a15011-c576-11f0-a129-42010a9c0007", "comment": "Malware payload (ConnectWise)", "timestamp": 1763577461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577461, "uuid": "ca0a1ad6-d765-4492-bec0-58fadc8670c9", "comment": "Malware payload (ConnectWise)", "value": "e432757a095eec5e1081c6c0929f1125", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577461, "uuid": "aa2b7dbe-c88b-4e14-96d9-0c4309bbc84b", "comment": "Malware payload (ConnectWise)", "value": "b23524c5ee1960293a4a82d607cc7eb34f079187a74ef95b3a4b4e83918e4d47", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577461, "uuid": "3992f8dc-1f4d-498a-8f5a-5df6cf6efbaa", "comment": "Malware payload (ConnectWise)", "value": "cb5f74985d19243ba5e002e649aedd1e561a291b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577461, "uuid": "eb5834d1-e989-48fd-8ad6-6964c46770d7", "comment": "Malware payload (ConnectWise)", "value": "3df47a392a9084b6f00d37e19f0b3d0ed6f0e13352785cd4a1e4391768a1dff741cf3fe1b40602f9127dc97c7259a898", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577461, "uuid": "c8a47eaf-9d56-4e83-a085-7c5dde2e3e0c", "value": "T1B7D623116BF89678F0F22A35E876A0B1A5377C525E22D12E2324791E2C75EC0C9B3777", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577461, "uuid": "818b35f8-d453-4b70-8268-788c3ab75c9b", "value": "196608:gHxcp9ym3nltDUJVPHxcp9ym3wHxcp9ym3QHxcp9ym35Hxcp9ym3HHxcp9ym3uHE:OGplpMGpeGp+GpLGpxGp8Gpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577461, "uuid": "d694cae2-5258-48c1-8075-8e34af1c654c", "value": 13488128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577461, "uuid": "3f185a22-ed00-4af7-912a-a5f93d404fb1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577461, "uuid": "81e6bae0-3e8d-4d39-9b73-898a62b87f3c", "value": "ScreenConnect.ClientSetup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69edec3b-c5a0-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763595321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763595321, "uuid": "e967a680-7013-4875-9813-ea2d2315f4dc", "comment": "Malware payload (Mirai)", "value": "95e063a53102c857a1aff0906c3f6bb1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763595321, "uuid": "d5ed42a2-cdc7-4b3c-8b8f-368e21ca665c", "comment": "Malware payload (Mirai)", "value": "b23e03f4d2c9a06d5bded9bddb679ff1a025fa6939c880bcaa9ff84ba2a47287", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763595321, "uuid": "9b68962e-af50-47ba-932b-4e4f2508ae11", "comment": "Malware payload (Mirai)", "value": "199c981ee9cebf4fa373436b48ce774901bfccc5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763595321, "uuid": "c46b4465-f29e-46bc-bb93-3bdea4c592e4", "comment": "Malware payload (Mirai)", "value": "5b26e5c784dc186a56b5ee6ca6192fcfcb8d3f3931ed57738ec97ef085779884b58a6bf6e0310a9e506991c86d8eba7c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763595321, "uuid": "dc31d45d-0142-43ea-ba6e-d1c1a827bbe5", "value": "T1DFF30956B8819F12D5C412BAFE1E128D33232B7CD2DE72129D246F247B8AD6F0E7B505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763595321, "uuid": "51dfca51-0c8b-479b-8d61-a965219aa625", "value": "3072:BNOU/wqxUhs34dXhOx3MidaxDQmnG1bzi2ZsNpyRygX:qUoSS9dXIpNaph4bzdmpyRvX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763595321, "uuid": "e34284df-9042-40bc-9c76-65e0800acede", "value": 165264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763595321, "uuid": "9d3c87e6-e2e7-4551-aa25-f94589b743e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763595321, "uuid": "ab64f2c9-a21c-466b-99cc-6b7463bb26ea", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc724b07-c56a-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763572374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763572374, "uuid": "b4cc0c3d-a9d5-4d29-ae0a-930d04f412a1", "comment": "Malware payload (Mirai)", "value": "cb0b71b5dd144c1cc608a631042fb643", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763572374, "uuid": "9025e3cd-2b38-45e7-abec-daa7bb2a21c6", "comment": "Malware payload (Mirai)", "value": "b2e9884cf3a5b323e77015a5363e2c028450024fe403cef1ec5552406497ae2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763572374, "uuid": "b40fbe2c-b4d9-4b27-8d1c-c41221341f9f", "comment": "Malware payload (Mirai)", "value": "714288c4fcdc0b089d2b1c5969996722e5250726", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763572374, "uuid": "a4da3445-7cfb-4445-8597-5f5c0b681374", "comment": "Malware payload (Mirai)", "value": "d07198269a90f0c847e816d7fddeaab83370d932d9c61d16567b523455d019d29ee906d727f4b6daad88b31b8dff5421", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763572374, "uuid": "b9fb1894-47d0-49f2-b747-c702087f86a4", "value": "T18204B719AB510FBBDCAFDD3702E90B0139CC955B22A93B363674D528F54E50B4AE3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763572374, "uuid": "4b277cda-5e88-406e-83cd-f55986f80b48", "value": "3072:nKpzG1eNkSfcQqmav8SqaRVlnYz65rVt:nKY1eNYQqmeqavlg65r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763572374, "uuid": "dc82f2b2-2782-47ef-b14a-bde9a25b4c60", "value": 177760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763572374, "uuid": "bfdf1144-822c-4a08-9ed9-a6148bd40f6d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763572374, "uuid": "35d0a7de-213a-4780-a0f5-003f1158d048", "value": "main_mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8590006b-c537-11f0-a129-42010a9c0007", "comment": "Malware payload (SalatStealer)", "timestamp": 1763550270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763550270, "uuid": "abf348f4-2620-4c27-8c7c-55c83ceb6c35", "comment": "Malware payload (SalatStealer)", "value": "7877b98eaaa294efedcb04d0f7f5d35d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763550270, "uuid": "d8218315-8adb-4423-a582-60cf0ff50e33", "comment": "Malware payload (SalatStealer)", "value": "b348f6b13bfb6333e2b136017c883b5e738a95a7ed91c84855818d5e42a4f209", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763550270, "uuid": "70d2d0e6-b6ed-41c4-ba38-6675ffa08562", "comment": "Malware payload (SalatStealer)", "value": "3606ae6f5fe5d1dbe6e43c30ed64144d4c26f2cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763550270, "uuid": "23901174-247a-41c9-89e5-9c3ed12b1ed2", "comment": "Malware payload (SalatStealer)", "value": "d2541ca473a90acdd9f7395ff3099bd65b6a0a0684d8b185e925107638d80238a77bad1ecd87dfe7caa0a01be426e7cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SalatStealer", "colour": "#7097A1", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763550270, "uuid": "89d98ec6-397f-4c9b-8600-1b4cf405906f", "value": "T12FC65B41FA8B54F6EA031832415BB23F63305D049B28DBDBEB547B6EFC77681193A609", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763550270, "uuid": "67b66fb0-1691-4bf6-9d2a-757e75e5bd19", "value": "4f2f006e2ecf7172ad368f8289dc96c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763550270, "uuid": "2ddbff7e-4bd5-4496-9fac-c28ed3e60e4a", "value": "49152:wfmnU+wVbz38Bc+sju2D/17ukLIItkqXmgDliCd+j4NVV81WSpZQts5yLz0+eyZW:OyUTVsc1KIfaZEP9cNdv/K5oUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763550270, "uuid": "6050c5fe-bbda-4b1d-9535-4c5566dc651e", "value": 11654656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763550270, "uuid": "631cdf32-df9d-4855-abeb-f48a9a2ccc22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763550270, "uuid": "811ac245-e236-465e-a169-1d9cacec871b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bcf12f8-c575-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763576936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576936, "uuid": "dec2b963-da29-4aaa-b99b-77ee83b495b9", "comment": "Malware payload (Formbook)", "value": "a417dc53df37746f0e20886e235c764a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576936, "uuid": "9f182830-5b48-4c44-be76-bbb297891e8b", "comment": "Malware payload (Formbook)", "value": "b51ceacaf3ee0b0d287df4e4e8eae92606a3a36670d50a36f3b7827df46a8a83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576936, "uuid": "4cf9b74b-ef3f-44ac-a47d-c7a8349f6169", "comment": "Malware payload (Formbook)", "value": "1207a13c881450c7d24cc91103069d101f7a64df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576936, "uuid": "82ac67f4-0ded-4d26-9d74-e14876cc2075", "comment": "Malware payload (Formbook)", "value": "b274f28b295e420b6acc233972b6f742b6cd70b435687b2cb6fd73f38136b8ffb3e15014c33ec11e66a1a06c646d2d17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576936, "uuid": "28ba341e-b43d-411c-a60d-87b1272ebc67", "value": "T166F4F15472A4C917CEB98BF20C21F6740BF91DE9A911D3C68EC9ADEB74E9F100E40A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576936, "uuid": "28b70d4a-43f1-4cc2-8704-f503c022ccff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576936, "uuid": "2dfea3e4-ea5f-45f6-b548-17a83bd55542", "value": "24576:DExWxeVzdyMxtr+p25CGBWrkAdMnKm4+x:QxWxSdyMxkm5gmTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763576936, "uuid": "e6599119-3692-4551-8c8c-f57ab0da22c1", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763576936, "uuid": "0ebca85e-c68d-4d48-82d6-d2a4a42a26af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576936, "uuid": "bbf425a0-fb15-4bb0-b499-32da60d4c52f", "value": "ZhRk7JgbClnNYcQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f487729-c57e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763580646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763580646, "uuid": "805ffa6f-67cd-4bbf-a17b-f052a95f823b", "comment": "Malware payload", "value": "f96f81718d9d414d39b336e195d68fb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763580646, "uuid": "07df5a9f-34e3-40ac-9522-18266020571e", "comment": "Malware payload", "value": "b63110466388ff1f36e0cf65adf425c50edfed04a503f9e44282cc5075f93ca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763580646, "uuid": "1c6ccc35-ab04-450d-8ce6-b0e541640b9c", "comment": "Malware payload", "value": "222fb94dbe6002dac487d62d898598d953fdcbb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763580646, "uuid": "c1391d88-e1c8-4475-92b7-739555b170c5", "comment": "Malware payload", "value": "c916318c7fcae3a48104b8524bc9e6031f42f034dfb678c5c314c320f6964bc9e365a5c9896f8d0b9833d183658be50f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763580646, "uuid": "6440303c-864f-4823-a609-64d2dc04d60b", "value": "T1AD451B1AF6A611F5E0B9D274D9632127FD7238958338A7DF47809A0A5F31BE4DA3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763580646, "uuid": "427f0262-6b9c-420e-9025-4874b53e58af", "value": "54e492bdd3d6051d9c6f63eaf6aac704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763580646, "uuid": "b43fecf9-da16-4936-bcab-372c3ce06bf9", "value": "12288:GRuZubyp0hXF5AT0e1YZenRVE33GiPY5ociR5miXhRILpaWnxV7m+gOOz:GRuu1h1KmERVE3nuociRWLpakMXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763580646, "uuid": "52696298-90d7-45b2-a068-cbf624e57ccf", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763580646, "uuid": "7d5085cd-b581-4767-a3f1-f5156e49fb66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763580646, "uuid": "5b6455f7-cae8-4b4a-913b-c0f196e904a3", "value": "SecuriteInfo.com.Trojan.MulDrop34.831.21523.12775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6032d39e-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594875, "uuid": "ccb1b0d1-bfc7-4bbd-b1ff-0933873249a2", "comment": "Malware payload (Mirai)", "value": "6f168a837b2419904555f1bcdcd5004f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594875, "uuid": "e62d3eed-d813-48f0-8179-dd15b0cad50f", "comment": "Malware payload (Mirai)", "value": "b65512c3c80aa583ae29cecdd5dbb25402b0dcb952d9c327c685c43f30d1bcae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594875, "uuid": "6522c892-33f9-4d1e-9eb2-ac81a4ea0a2e", "comment": "Malware payload (Mirai)", "value": "057b699d9dd59dfd5f330f5cb32311e9608e5216", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594875, "uuid": "7b69d5c9-6ea4-48f9-914a-12a2c19f0c86", "comment": "Malware payload (Mirai)", "value": "0451b29bba435d9801bc7efe86b0e7067f7539e5ee7334acc41c32823778ca42bfdde71200de89df099739c4f07cb7c7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594875, "uuid": "577101d5-8a9f-4fc2-9036-1b97d2087256", "value": "T1D133F16BE381E075CA5CAEB960DC5E124ED9A180235B2B8943209ADDC9CCFC3F449929", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594875, "uuid": "7b4a44f3-a2b1-40fa-a944-99297c93d1ac", "value": "768:FZtFqEBJ8r1XHfJZVXxhz+0W3bivlC3uzxNFWLKk9mxHYjSjpJWUp:1wyovJTz9W3F4bFn+6HYWjzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594875, "uuid": "86e94f22-5808-47c4-8326-cb98321525e3", "value": 50404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594875, "uuid": "0d7b4f43-a0a8-48f0-b6fa-443bb6548ebf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594875, "uuid": "a4eb6f06-037f-4d86-af57-61a8bf606ff9", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d2bb5b-c517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763536553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536553, "uuid": "17554ed2-9e9e-477c-9abd-43414badc84e", "comment": "Malware payload", "value": "8d5193b24352f3e1f11e9220fc4c1616", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536553, "uuid": "519a927a-bcfd-4f9c-b37e-e8735534f26c", "comment": "Malware payload", "value": "b72a4f4cd5571e3d545d8ff18e96d8fccd2ed2c7d02ac32ef20fa557fff02a11", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536553, "uuid": "2f35170c-03b5-4aef-8bf3-0406d3dd44f2", "comment": "Malware payload", "value": "a12e1683ee40d61a19cc8bd6e4cf52418703fabb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536553, "uuid": "dd60481b-8cf0-4aa8-9db5-946a99f7f558", "comment": "Malware payload", "value": "6fb09222f389610dc6336a28f721890ee17b0c57845615e0092d56b91445fdc65b5c9109cc48899fc5ea1df422578c2d", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536553, "uuid": "039408c6-deb2-49d7-a68d-eed0b3e5b398", "value": "T11585F142F7E5AC2FCEB784324FB90B7A01964D45C682D3178565B12C9DBBAC88E46FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536553, "uuid": "beaa9e03-2c81-4c59-ad41-5a87cf8b5307", "value": "49152:51ec+aeb2dFyK7xlvJ0vxxbhuadYma6hfFFDqWg2AH:51kaebsPHNf6hHqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763536553, "uuid": "7bf7f1e1-99b1-4058-9374-6528cf9c4449", "value": 1859798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763536553, "uuid": "ed59d4e1-1dcd-4054-9a89-bf80ab320966", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536553, "uuid": "7d9c34f4-038d-4f54-b525-cb1c72f1622e", "value": "cbr4d.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8cc02c-c500-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763526550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763526550, "uuid": "d7783bc6-2254-4076-bb7d-9ec3226e1ddc", "comment": "Malware payload (Mirai)", "value": "5a5463fb190a5dab82826727ce11d02f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763526550, "uuid": "eb593cde-f170-4905-b128-096d1b6e57bb", "comment": "Malware payload (Mirai)", "value": "b77d1577f842c3d59eff15180fe700767d78209f63cadbc4a4a4e7e6b5b223b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763526550, "uuid": "de08334e-baa9-487b-b2b2-c7eb816d2368", "comment": "Malware payload (Mirai)", "value": "af8f065d656b06cafca663e62c1a0c6981ebcd70", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763526550, "uuid": "b7291081-0679-4443-a8ad-2c8f74566b5e", "comment": "Malware payload (Mirai)", "value": "24806d98bf2bbecb03ef425f2342125572519a9b6a9b06486bd625c52f1620ade87c65e61371d05ab4aafe12cc65a59b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763526550, "uuid": "a78b4b10-db7c-454c-ab9a-a97433e19fe2", "value": "T170735D96BD42D613C6C065B7FB0E428D7B2703ACD2EA33039D265F2527CA55B0E7B642", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763526550, "uuid": "cba88a94-f0a5-47a2-850c-468da0dba861", "value": "1536:SAhIof2Z9+wRpjwMo1LqRPkyzPkqpfXem5:SAhIq2uIjwMo1+8y7kQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763526550, "uuid": "8112b650-0aa4-4d02-9054-1e4a6e6bb039", "value": 75764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763526550, "uuid": "e21bd924-c1a1-4cb6-9431-f8463dd776c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763526550, "uuid": "a744110f-446d-49a9-bd09-666447b19c2f", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c80d615f-c565-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763570138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570138, "uuid": "d467b367-a135-4797-a7b8-1cad4a538cd4", "comment": "Malware payload (Mirai)", "value": "af87492b6f6b4eac6a26653a6bc92453", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570138, "uuid": "558bd5c7-c6c7-489e-82ea-2b493d450f8a", "comment": "Malware payload (Mirai)", "value": "b7a7aebfdcdb27823b44fcdd76de61a9055493606ab384ca7a83876f58beb8ad", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570138, "uuid": "1d76f430-3f46-4320-8e13-c9e7b8864002", "comment": "Malware payload (Mirai)", "value": "23dde78ac8e522f874377e37259304eaf0dc5439", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763570138, "uuid": "8004b2dd-7517-4769-b410-70646c9b0695", "comment": "Malware payload (Mirai)", "value": "c21de76b2e42c8a72ce17358bdde53b9266014643fa68ee737f89ed1646bb1986619248ed327f424b0bdaa1a5fd2ed3b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570138, "uuid": "b430bc9e-4f97-4666-9a1a-7b6fb589c01a", "value": "T165833A56FD81C603C6C0657BFB0E428D772753A8D2EA33039E265F61638B96B0E7B241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570138, "uuid": "e4831e10-2c10-4dab-a9ec-0f7bdc0a51ff", "value": "1536:SW+mA9d2hvuonze3PFSS3B30If7qiLdgem7:SW+mA/2py3US3R7z0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763570138, "uuid": "00f9644d-4557-4e47-8e1e-20e4d64d707e", "value": 83156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763570138, "uuid": "b76b750c-073a-4a3b-ba49-eae38ce5b10f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763570138, "uuid": "1c9ccd46-c769-44db-9056-4111407936c3", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597d135f-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589710, "uuid": "588809b7-3f91-4926-882a-03b922aa2c99", "comment": "Malware payload (Mirai)", "value": "9ae1c3fecf8c6b1e8f90775af7a8f9c1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589710, "uuid": "52d4b906-de7d-468f-8b18-93012bb65a45", "comment": "Malware payload (Mirai)", "value": "b7bfaf45eef40e028b2ad7086d113547c7d7514b3f5e93ff4d6d9554a46bc6dc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589710, "uuid": "df9288a6-1a8c-4132-8978-5e51e27976d2", "comment": "Malware payload (Mirai)", "value": "4b928efa4a46236199f4e05bf873453b8874117f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589710, "uuid": "23861656-972a-49b8-a62b-03fa2cda3d7c", "comment": "Malware payload (Mirai)", "value": "a62a7e1d31d47a6fbb82b9b389afcac051932a133cf7e4019dc4ecd0be24e2a5b4208bd42976b8a482a6c5806bb676f4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589710, "uuid": "c1b52c3b-d3d8-49d4-ad2f-1b5c8f226ad8", "value": "T1945184BA014407706CE26BD7637E804C3191929749F6BF26A7ED28E88D8DFDCBC41667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589710, "uuid": "308d4408-546d-46c1-b8cb-558786383110", "value": "48:ioldGVsD+vRoUUPFyR8nJhL4VLAJPNGM/2uN6:ioldGVsD+vRoUUPFyR04VLiPNGMD6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589710, "uuid": "a9810828-414f-4e4b-bf4e-f1fe756b9f12", "value": 3164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589710, "uuid": "0b8e1dc3-1b42-4434-8986-b90b63ae6387", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589710, "uuid": "0e356213-4ee8-495b-b7b6-2897e0f5d587", "value": "1.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4162d22b-c55e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763566906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566906, "uuid": "3ddb4754-a2db-40db-adc8-8866e5b62310", "comment": "Malware payload (Mirai)", "value": "05625dd1bebe25872448674d01f30e7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566906, "uuid": "414073ba-3167-4c29-affe-993e613a0cd0", "comment": "Malware payload (Mirai)", "value": "ba13422bfa2fb6e20af398927160d07a7c0172b892095731f4c9f6559dc801fe", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566906, "uuid": "2187085e-8417-4304-bef0-111b40e67189", "comment": "Malware payload (Mirai)", "value": "f7126b4237b568f8e9b28013cb6278b0127433c8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566906, "uuid": "e052e86f-6688-4bfe-b02c-6664f85503cb", "comment": "Malware payload (Mirai)", "value": "01e9440ee62749a8e814863ed69e910067046c36af5569ee9bd2680692de35ca002608e253930f1e0de97cdcf48063fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566906, "uuid": "2b32212e-613a-4445-a040-538a155a056e", "value": "T133931956B8818B12D6D512BAFE1E118D331317BCE3DE73139D10AF247B8A92B0E7B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566906, "uuid": "993f9e76-8ca7-4ff5-8029-ec6691bf82e6", "value": "1536:WvBnJSIulL+EB9a3yzeq6hZHx8yqd6HFcHwc79aVo8P+JMbiyDRP0PB50Ycug7Rd:WzuR+33yzz6hZHxFqElawc79anDRP0Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763566906, "uuid": "299c55ac-c9bf-40ce-8339-18d0272141d2", "value": 91304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763566906, "uuid": "ba17387f-24ec-43a8-90e0-bbb74dcff849", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566906, "uuid": "d99368c8-2316-4cb0-860b-5ccfe7697902", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1cdd314-c53e-11f0-a129-42010a9c0007", "comment": "Malware payload (DarktrackRAT)", "timestamp": 1763553404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763553404, "uuid": "13efbd9a-e5dd-4104-ab84-83283827cdcf", "comment": "Malware payload (DarktrackRAT)", "value": "06d5fdfabf8ef1f61c1182318652509b", "object_relation": "md5", "Tag": [ { "name": "agensla", "colour": "#A85B66", "exportable": true, "hide_tag": false }, { "name": "DarktrackRAT", "colour": "#28C2F0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763553404, "uuid": "450b546b-5fbd-4b82-bf12-295e97745997", "comment": "Malware payload (DarktrackRAT)", "value": "bbbc2a56ba69aefa567dbffe1982e21c7317e305741f7027cd0975c4bf79f8df", "object_relation": "sha256", "Tag": [ { "name": "agensla", "colour": "#A85B66", "exportable": true, "hide_tag": false }, { "name": "DarktrackRAT", "colour": "#28C2F0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763553404, "uuid": "2b7bed58-8d03-4627-80c9-33efea229c46", "comment": "Malware payload (DarktrackRAT)", "value": "5e0cd038f6db10329b65af40790a491fc1d2ed7b", "object_relation": "sha1", "Tag": [ { "name": "agensla", "colour": "#A85B66", "exportable": true, "hide_tag": false }, { "name": "DarktrackRAT", "colour": "#28C2F0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763553404, "uuid": "677ecd5a-508a-4151-8cd3-2fab67922b64", "comment": "Malware payload (DarktrackRAT)", "value": "3b50f50a1d14262dcbb15eade9ad81b64af501e9d382938528538d25c72820b9a11c6092e8371f4a4bd697aecfe5dd88", "object_relation": "sha3-384", "Tag": [ { "name": "agensla", "colour": "#A85B66", "exportable": true, "hide_tag": false }, { "name": "DarktrackRAT", "colour": "#28C2F0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763553404, "uuid": "2acc8e27-a78c-423e-ae75-fb47636c906c", "value": "T141773343FC3EC660C7B80B92A9FDB458D88BB41B41A153A8D9CF1BA1AC65C45B79213D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763553404, "uuid": "52d4bb50-d28e-4444-9233-246f19650a54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763553404, "uuid": "78047d59-3946-4e8e-b631-6cd0bba34ce2", "value": "786432:6SJCtD5Bnz+PpSm6uLs0WBT5kNp9sOaH7BwlbviHb88hx5:6jDjnPaLs0oTEnabmvOb88hx5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763553404, "uuid": "6eff0429-318b-4ac5-8db6-6c012b486e88", "value": 34792840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763553404, "uuid": "48fdf738-9121-4b2b-908b-048dfab659eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763553404, "uuid": "7551ba0e-730e-49af-b9ee-13dd25a7fee9", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a004486d-c586-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763584244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584244, "uuid": "693d30dc-6b5e-4205-80be-ef1f4570219b", "comment": "Malware payload", "value": "910cb974a438ce8974995ebd4519ec5b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584244, "uuid": "29340dac-b63b-476e-8f01-a9e64babdf88", "comment": "Malware payload", "value": "bc1b0f943f66fcc1e903ec4d742185a22a0260807d057a6da43c2ef4d09bd32f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584244, "uuid": "dfd87480-febd-4f8d-9c24-8265b80bac8b", "comment": "Malware payload", "value": "063fc922fd5085144423714ee036813a7565e17c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584244, "uuid": "24be7062-e8ae-459c-96b8-627d401739b9", "comment": "Malware payload", "value": "e65c9bd0c33d72d1864fb3716d8f82e91af7174eb5c001d565709356caecb5c4a4ad0a3160237c9e34260cdd4811f7e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584244, "uuid": "694f679a-ac4a-45ec-bf9e-2e14f97eb6d7", "value": "T180D47D3AA490D543FA18C4B805E2972EE831753586726AFF05609263D95BAF08FC53FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584244, "uuid": "d297a855-76fb-4ce2-a67f-6f79169cb12a", "value": "79ddefae792645665e0f0b9eb9ec1da8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584244, "uuid": "141cf81e-073c-420e-bafb-8146e978f924", "value": "12288:xqDVdQPocqbvTzBVj69RvNxwDRsEzdG1uSQuOZea:afQZmv5x6vlxwDrtSGZea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763584244, "uuid": "1c36ddcc-0c89-4c12-99ac-7f61ca0b13c4", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763584244, "uuid": "f56fac3a-426c-4d27-8371-f8ac90d7f5a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584244, "uuid": "5ab9d638-19b3-4900-b406-52f71467e25e", "value": "SecuriteInfo.com.Win64.MalwareX-gen.84349145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2129f9c2-c543-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763555255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555255, "uuid": "27f87855-e61f-4478-96c6-901b33db4b4d", "comment": "Malware payload", "value": "4e7df9d7ac6c6f6f6f21e9b6ddcba9bc", "object_relation": "md5", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555255, "uuid": "e73c49ae-c45c-4bbd-ba85-5fbe9366a7d3", "comment": "Malware payload", "value": "bc36ecb1932eb0ef64d195f6b23d1be571e0e082be73aaacc62c70093511c2c7", "object_relation": "sha256", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555255, "uuid": "4a8c8db2-25d9-4b03-9f95-e3fe8bd682e0", "comment": "Malware payload", "value": "a42a570b8e89caf159ceb95fac3b94e1a4d8d4dc", "object_relation": "sha1", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555255, "uuid": "be1a1c83-984a-449f-b4e6-e3b7286964cc", "comment": "Malware payload", "value": "725f91f224de34050bd53cb3f68993066c746bd3f7f511135a1dddac5ccb261a628dc7e1982c8c37cd93996c7241e065", "object_relation": "sha3-384", "Tag": [ { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555255, "uuid": "f6249092-c884-4242-ac6b-9a005709c67d", "value": "T1F481F11862FBA42D027761EC2A1F85157125101331C9CE8C3E5C77B05F96E2ADEE6EAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555255, "uuid": "4e9817ed-8428-4684-8f5e-6460c3f3f605", "value": "96:7VNe8Twmn8KYPiQPX2iQ/YyVsjOtBMg2+xYDDIMFMiQa63sjDtCZgM:73hUmn8KYPiQPmiQtq6tBMmYDEMSiQaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763555255, "uuid": "dc0ab82a-7f79-4026-887f-7d67087980b6", "value": 4110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763555255, "uuid": "7c7d012d-9591-4d1e-b937-6aaca19e9442", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555255, "uuid": "7ab4862c-8924-44b9-9b83-4f3bb6923757", "value": "common.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94806d49-c55a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763565327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565327, "uuid": "4c0306db-1bac-4be9-be5e-50a6b34aa384", "comment": "Malware payload", "value": "6802451cf903ff62b9f0269056277584", "object_relation": "md5", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565327, "uuid": "94da2322-d127-44a4-abcf-8d4ff40b80b1", "comment": "Malware payload", "value": "be4edb50fb506c1967d8000d497454bf36a19004ebdbadfa873eb405ee345371", "object_relation": "sha256", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565327, "uuid": "3dfeadaf-7150-424f-9104-732b6f9151db", "comment": "Malware payload", "value": "8b9c3cdabf7e592196fd53d8b165d60af7e6028a", "object_relation": "sha1", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565327, "uuid": "292e3eab-1707-42ce-8f55-90464f14c1fd", "comment": "Malware payload", "value": "f675059e27295467a30ae330fcc5dac6f18ad0f67b2267af3d3256c19e09013e5952bffa02042f57a6a7258588ae18b4", "object_relation": "sha3-384", "Tag": [ { "name": "dex", "colour": "#FB5901", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565327, "uuid": "327ebcdc-f341-4b18-9b31-4a79182d3412", "value": "T197857C47D642CFB1C8AE933BA4B7C7943335A619B743470B2649E6F47E832D91B89384", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565327, "uuid": "ab522120-841e-4d41-9b37-0d0b67dee9d1", "value": "24576:HS80kAuWSf7gzo8pqG6owU2fqmS9AqK22mDJET6aAq:8aWSf7gzo8pxeU2x9YM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763565327, "uuid": "30bc8578-5031-4534-a55d-289235019615", "value": 1744440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763565327, "uuid": "4c4c64a5-bbb3-42fe-903d-60dd8ad8c324", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565327, "uuid": "8cbb881b-8fda-44a6-ae03-c29f3a58f33d", "value": "classes.dex", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ee250f6-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589772, "uuid": "79b58cef-67e5-48de-bd9f-57e048d29647", "comment": "Malware payload (Mirai)", "value": "80156a27b79316bfc14615364cf6678b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589772, "uuid": "48e0bb80-8f24-4cf1-9b0c-971a8a4736fb", "comment": "Malware payload (Mirai)", "value": "bff91e7290d66b6eb7b1319ee22f4dd3253d0ee1bf2b5dacc95b2d1eb7902b49", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589772, "uuid": "43f8f334-4c6c-4778-8d55-6e23938bd7a0", "comment": "Malware payload (Mirai)", "value": "f9a61e644adf9140dd4c25bac2c9a766be2da5e7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589772, "uuid": "8b63825a-bcf6-472a-ba83-66430f5eb5d2", "comment": "Malware payload (Mirai)", "value": "44aa2b0610882716c41c782d125fe73dd8d3225f335842193e543f5b6728a99528148728dbf7647a62f569339390c4cf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589772, "uuid": "8c1457b6-f4b2-4c68-91c5-8f660e8b4056", "value": "T18FB36DC9F643D0F5EC5701302276FB37AE72E9BE3228D993D3A89A327C11641D416A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589772, "uuid": "a37775ce-89a9-4986-8807-4917e7104b17", "value": "1536:wRJZkUKQXtAPADMY+D6DO8urAUsPxbkNT8u5jM8XSr82rh1bEzaF3SJV:ykUEooY+GDO8xUEaMOS42tREHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589772, "uuid": "63a5e838-6cfa-4dd9-9925-eebbcd81ba7a", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589772, "uuid": "7cbea1ca-2cf7-47af-8927-22a501845f09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589772, "uuid": "609e1320-53e1-4faa-bf54-985bfd601e1e", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c6c764-c593-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763589727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589727, "uuid": "7d023c76-0774-4a9c-b5b2-3545b9514eeb", "comment": "Malware payload", "value": "55697e8379b7ee48b23acdbc7b581a48", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589727, "uuid": "ae8997e3-82f6-4fff-a00e-1166fdffd21a", "comment": "Malware payload", "value": "c038bafa437c9d39c891ee4c468c86e9586e5b0a6cf1ff72f0ca741cc758eb88", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589727, "uuid": "89e0e795-3f22-49ff-b4bd-a213be0dbf40", "comment": "Malware payload", "value": "78ffedc329c8a39ad4d4ddcf2e9b9310ddf834ed", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589727, "uuid": "9a8d43f6-1070-4387-a984-5d34e11cb955", "comment": "Malware payload", "value": "8bba93c70738ea159dafea6ac288096174d3dce1bfd4a23b7ecacbf743c4ca59e8647ef1a8a35ded1f89d325c201e2d8", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589727, "uuid": "5f84bbf8-9f44-4ded-a049-df0e71cf8d55", "value": "T100014E6CD1EC9F5008F5C6C6B2F84248C491808751F467D5F34E09166F28EDE7C9320D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589727, "uuid": "b1ddeee5-8ed9-49fa-adf9-367e50dc13ae", "value": "12:FH8ioNJAC7ukxGWi2jU30+0K5+A+GDjInkC01lkC0F70/GrZhG+E6:FH8j/wWi2jzyXIkT1STR0/GB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589727, "uuid": "72aa9de7-04da-4bf3-889a-77dbee356bf4", "value": 724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589727, "uuid": "6dad561e-b063-4c1e-8a3b-235d59050fc8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589727, "uuid": "f84d6fd1-1ef5-4693-b223-6b186838181c", "value": "o.xml", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c6278e-c575-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763576971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576971, "uuid": "ba1ddaa3-b6a5-49c7-b4b1-932df1b84502", "comment": "Malware payload", "value": "b5eba281bd2721bd886b9971e58ddc8a", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576971, "uuid": "037a9b44-3e6b-44bb-ac6c-40106e2e0832", "comment": "Malware payload", "value": "c0bf35ac6fbf64791b2881a667fb913bac16d3c81cfe6d7e66102e626344401a", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576971, "uuid": "395d8ae9-c738-4fc7-a63b-b471c5a750cc", "comment": "Malware payload", "value": "6644df986a871f9432ef69b35f4d55b2f492c13e", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576971, "uuid": "ef77e9a9-fe3c-4fff-a786-872a409e7aaa", "comment": "Malware payload", "value": "797c0817aeb651d95f4678e3a32982d3e331e677a0708bb68a56b2e2a1a1d81741faaa6dfeebb9f3807caab1495b5459", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576971, "uuid": "216bfe67-bb10-40d2-a78b-b524dff294c3", "value": "T1975623B25664286707A10B19F00E3772AE6EDCE7854C91E99CCDD34E31DF6A7882F4B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576971, "uuid": "249075c7-c6cc-40d5-b72d-51d2c32addd6", "value": "49152:vUKK0SazABGNgKsn4cKuyE6mgGP32hiQ2O9jgoj9aix+J5wLJdOSHtyequ8DtcFX:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763576971, "uuid": "164ce1e6-aaa3-4529-be86-7f2566685726", "value": 6015001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763576971, "uuid": "2f3a192c-3763-4f58-9f1e-b95290fa1a65", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576971, "uuid": "41b8b9da-a8d0-4cef-a307-b081c7d51b4b", "value": "218367$ Mi-rar $54455436G1.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deead4f0-c595-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763590792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590792, "uuid": "336f0db5-6c4a-4433-90a5-1d6c14bf163e", "comment": "Malware payload (Mirai)", "value": "b37b1d609c972c746d3a595073e6284d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590792, "uuid": "62b07e99-69ad-4a9b-8381-673b4a9a14ec", "comment": "Malware payload (Mirai)", "value": "c1648fdf131de315ce3452491c2a9d9ae633a7b54c2ae4f9afe587489fec27d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590792, "uuid": "06508e04-ebbd-4e1a-a068-54d950a3303e", "comment": "Malware payload (Mirai)", "value": "b7c98b810e83d856a4fed795d7c223d639f4580c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590792, "uuid": "4cdbcf7d-7e2b-4dee-b571-ddce94317c9c", "comment": "Malware payload (Mirai)", "value": "907f2d7d62522fcebcbc4c6e2d3844a9581339dce508a0fb0e19acf031f98d4de97d31ac8cd868af96ddbf12fd427e02", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590792, "uuid": "dc8b6b49-de0c-45cb-8087-2f33dc3468a6", "value": "T117835D41730C0A43D1636EB03F3F23C6D3AAAEE111F4A688255FB64991B6E325656ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590792, "uuid": "48e09156-d3c4-44d0-97d1-94e2c1229025", "value": "1536:RCiWDhKKtL4PGD0/vLnJM1AnOkZ4wtJaCQWi/v+j4nIzem7O:Qnh1yPiynJcwH/JtQz21O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763590792, "uuid": "1a415d76-bb55-4386-b3c7-4b2242f8ebcf", "value": 87348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763590792, "uuid": "ceefad7d-bf27-4d4e-aea1-271336586c8a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590792, "uuid": "193ea29e-0596-4efb-9ddf-5f2c5be9f028", "value": "powerpc.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ff89908-c55a-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763565239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565239, "uuid": "9b8a9a99-b856-4938-a3d7-afed3d8703db", "comment": "Malware payload", "value": "91a675acc5099f4f549a451371a6a8ca", "object_relation": "md5", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ywskxh-com", "colour": "#9CF688", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565239, "uuid": "ae6ecc41-d8e0-4636-a600-19ce1e999495", "comment": "Malware payload", "value": "c1a60e4adff40834f1b57a280dc8bc97076cbdeafe22a0bfbbb7a3993b2a5553", "object_relation": "sha256", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ywskxh-com", "colour": "#9CF688", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565239, "uuid": "235a6fe7-d0c8-4747-90e4-7a463cb6c3ae", "comment": "Malware payload", "value": "89d0b51f966910076a9bc535aef0e3d103f1e9c8", "object_relation": "sha1", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ywskxh-com", "colour": "#9CF688", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565239, "uuid": "07afad28-6a87-438c-ae13-453cfed7b224", "comment": "Malware payload", "value": "726aa658c71ad6e1162fe152aa5bea0ca04890bdd5f6a455b27871b04ce158bc232aa3794ba22ecdbdff5ebe35b73f76", "object_relation": "sha3-384", "Tag": [ { "name": "CHN", "colour": "#A03B56", "exportable": true, "hide_tag": false }, { "name": "cn-teams-com", "colour": "#D93C22", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ywskxh-com", "colour": "#9CF688", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565239, "uuid": "93f91b26-bd4a-4e57-9d05-a880efb7b0bc", "value": "T1CE18338506868D17DACFC475E481737832A48FD887722BBC9F349BCF7661206A16D2F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565239, "uuid": "c94cab50-888e-41b2-ad5d-a60e65bed7b8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565239, "uuid": "1f56a160-a6da-4b4d-910d-fbc347e081c1", "value": "1572864:6GiTco0asUpf2HWc5lp94MUt5i3IolTK0P5ighA1NkpZAfgcBW+Xj:jQtppeF5/94f5GXxhvhA1CbA5B5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763565239, "uuid": "ee6e725a-f17b-44a8-accb-b1208104c270", "value": 87165549, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763565239, "uuid": "af60f10e-0d19-4b2b-a764-1d51c69fde64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565239, "uuid": "222116e0-77bb-4fad-a0d0-6bb83c199e53", "value": "MSTeamsSetup_wsxuhngh_unhgbfvcxs_wsxzanmb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb398cc8-c54b-11f0-a129-42010a9c0007", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1763559030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559030, "uuid": "f77263d1-d4e3-4c58-aede-9c029682f3a2", "comment": "Malware payload (Rhadamanthys)", "value": "fd85c61b8b79ba1c80080a929a148caf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559030, "uuid": "cfacd42e-b702-4376-976f-a63d679da1f9", "comment": "Malware payload (Rhadamanthys)", "value": "c1af190c3f1d7e19a0854b24ed71247dbeecba1e1e621dc74d19f51d1d746d52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559030, "uuid": "ad6d2c49-9458-4ffd-a142-891a4e678b50", "comment": "Malware payload (Rhadamanthys)", "value": "1e6d33eb900bcaf7da113cbcdc3715e3a819d155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763559030, "uuid": "7187ed7e-f9fc-4d6a-94a5-11f367213be5", "comment": "Malware payload (Rhadamanthys)", "value": "761a70e6fa3b9b8304185c5800b4e182f76b4a1dffba8c366d2f94dbfa97eccd1f5d844c58cbb7cf1991d6d0e12eb2f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559030, "uuid": "c1284981-0adc-4bbf-b44e-e668dd35ddc0", "value": "T129E6011AA3E900A8D867D678C6269333DAB178451734D6CF0694D65A2F33EF16F7B320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559030, "uuid": "28aecb05-a07a-4d42-9e60-4104e9cc1a02", "value": "13adb6a51da3463cea9acbbb6bf14da9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559030, "uuid": "8c15f20a-52b5-4672-94e8-a46fbca79f22", "value": "196608:VrqjHdQlDrSIqtCxPnNTcbbTeVzmYSb4DVcwEOGG5cISthyUB7:VrqjmDrqtCBN4bW5MgcfaUB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763559030, "uuid": "8f5be683-d828-4dec-8001-a3565e46c5a6", "value": 14081024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763559030, "uuid": "278ec105-9657-4964-93f2-3a49b0c05ce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763559030, "uuid": "07b6c9aa-e313-4251-8d6c-34475a79310f", "value": "i_luv_1220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d4dd95-c583-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763583102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583102, "uuid": "daaf335d-7dd3-4906-935b-bbc9ed08d8c2", "comment": "Malware payload", "value": "1c5beaa1a0c96a2d7ddbfb747d6e65ff", "object_relation": "md5", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "mono", "colour": "#382BD7", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583102, "uuid": "04a4f116-06fe-4ab6-a056-9cfbe8f10f7f", "comment": "Malware payload", "value": "c1c3abc6444ddfa7a7e20b1e88f5112023f9766edcae052eba0fda62a3eac4d6", "object_relation": "sha256", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "mono", "colour": "#382BD7", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583102, "uuid": "150884ee-1a59-4943-88f6-34ed4d03d7eb", "comment": "Malware payload", "value": "ecb1d24c33bd86f8a6561093bd53964639c48cc5", "object_relation": "sha1", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "mono", "colour": "#382BD7", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583102, "uuid": "3b758a98-a6c5-4845-9680-0c106d3afa43", "comment": "Malware payload", "value": "34e2be439f0e486d4c610eaa75070aadd4d47627683742dcbc90458d35ff6ae12e15ae09f8d6d7e4cd9897607b1cb5d3", "object_relation": "sha3-384", "Tag": [ { "name": "Dotnet", "colour": "#F90B9C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "mono", "colour": "#382BD7", "exportable": true, "hide_tag": false }, { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763583102, "uuid": "4a5339d4-238a-43d7-a8fa-70cfad043ee7", "value": "T1C8A3091293245BD7D48AB7B3F5F39064633268527FA177D2509F70380C9E388AB5AB92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763583102, "uuid": "b98fc35d-264f-4f58-a428-200a0b18ded3", "value": "280419b757032d8db6a17d651523b1b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763583102, "uuid": "8b0b006b-3b19-4662-a6b8-196378ee1df6", "value": "3072:TF/W4d6kTMrcZZiJ+0oJeVfKqL0VgtC0Sns/J3JS8KMnD9hRyJ/4WCJVUkJD33zw:5JpTkcZZiJ+0oJeVfKqL0VgtC0Sns/J8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763583102, "uuid": "32e0c7a5-10e9-4127-9bcf-af2d2b772bb3", "value": 99328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763583102, "uuid": "8157339a-ac57-4569-9fce-956cf6304456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763583102, "uuid": "ffe970e5-f50d-4d35-adf1-fea101f40425", "value": "c1c3abc6444ddfa7a7e20b1e88f5112023f9766edcae052eba0fda62a3eac4d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8366299c-c517-11f0-a129-42010a9c0007", "comment": "Malware payload (RustyStealer)", "timestamp": 1763536522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536522, "uuid": "db77e3b4-0846-4ca5-b4fc-08b5adade393", "comment": "Malware payload (RustyStealer)", "value": "a43835e5f89590e40873cbe758665168", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536522, "uuid": "c4158e98-6ce6-4b35-9163-726169162a23", "comment": "Malware payload (RustyStealer)", "value": "c349fe3a2ba5a498601ac45cdddbf8e451a75aa06068fa188512c18c4354d00b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536522, "uuid": "b65eedc2-ff63-421b-a288-1e4627bc1410", "comment": "Malware payload (RustyStealer)", "value": "e0b74ebc2833f28becbcbba9adb963d2ee424bb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536522, "uuid": "aa55bcfa-39e4-4573-9ae0-4b463473c43a", "comment": "Malware payload (RustyStealer)", "value": "d2c8c6f71941a2bb059c3f202c47fb28cc31ef1900d50552c52baa1677fc1a1037dbd5a4d809d1ca6379d973df83e215", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536522, "uuid": "f1fee8a2-8b64-41dc-84d2-16fbcfb3d1e5", "value": "T1DE867D03F29581FDC0AEC1B5835BA733FA32B88D4524B29F1BD44B222E66F505B5DB19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536522, "uuid": "58b4e5a3-6b5f-4b76-b77d-372032002045", "value": "8f28df8db8966c275af343757fb30c3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536522, "uuid": "33f87d11-8582-4b34-a1db-84886eb8edee", "value": "98304:Sfn27EKSIowdK/gmcWQ8ruZ+2a2cnpE+lutFLr6+gR+S+rT:F7zwgpWB2HOKLreRNE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763536522, "uuid": "df025a27-5a19-4e3e-94e2-3645c66141ba", "value": 8218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763536522, "uuid": "2c194a8f-b26e-40b4-99d2-3c31d31e1aef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536522, "uuid": "fe1c5a8f-b31e-41cb-99f8-b1d79b8de34c", "value": "adobe_reader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "862830b3-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589785, "uuid": "239aa932-876e-464c-b626-aa91b92748d2", "comment": "Malware payload (Mirai)", "value": "b2c48b6f145c09a79e732dcdfe7eee8a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589785, "uuid": "00132d58-46ef-4d69-aed6-a71d06efec7a", "comment": "Malware payload (Mirai)", "value": "c4abaf96663a9c63fae50eea7ea2add48508377ef4dd373cd5b7934bcab682fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589785, "uuid": "cc069dae-21cb-4373-8054-e5fb194be2fb", "comment": "Malware payload (Mirai)", "value": "d5f8a2af2808ce940b5e39ac99e57569bea57356", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589785, "uuid": "bd68ab75-be3f-400f-b86c-e7d552fa10db", "comment": "Malware payload (Mirai)", "value": "7a83bf559c77e419aa2d4d529e1a28292a432f89c801000d4d6188a1dac61ba808cf111e401107431568762558fcac8a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589785, "uuid": "aa772313-c0b5-4b84-8886-c2ecadd41154", "value": "T116A36DD6F283D8F5EC2241303176FB378E72E5BA2128DD83D7A49A72BC52942D406E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589785, "uuid": "27b03bf0-6e1b-4ca5-8954-822b632c1f8a", "value": "1536:dnJyYba2qd7fRRI7GEBOkfmuWwqUwRVMQLE46OBtlgALf5SZ+ZeiAVQ:3FbaViGs1fmBwq9RVMyjRtXD58iAVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589785, "uuid": "4487c924-2cfa-46d3-a51f-345c86e0b02b", "value": 100564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589785, "uuid": "3ca1d8eb-c1c9-4f09-995e-0a9246772b20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589785, "uuid": "a6edc925-189f-4e50-9d22-c11bcb390013", "value": "S3o.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d826e7-c577-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1763577617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577617, "uuid": "69cb2940-d0be-440c-9931-fd41ad6bc2b0", "comment": "Malware payload (GoToResolve)", "value": "9cc0e0adda00b2fc6deebb4e98e56127", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577617, "uuid": "a154b689-00a2-4f73-a452-f38b8d144736", "comment": "Malware payload (GoToResolve)", "value": "c6e409d2fd9974e6318a9bd9b708cb0fdb0647fc4f657a44e1f888824da501c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577617, "uuid": "b8e4612e-ffe6-494b-93f3-c8e7cc964dc8", "comment": "Malware payload (GoToResolve)", "value": "2a739c80097b76cac39525857ae6737e6528d51e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577617, "uuid": "46a8d9d2-94e0-4f4e-8346-3da3ba775071", "comment": "Malware payload (GoToResolve)", "value": "31d2fc3228bd2458bd8135de749fe79d63096d5b77d076c667f3974908624a2dde59bdf23da67aaa21a539f877944a5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577617, "uuid": "da21b495-a33a-44ca-b542-f68923263e0b", "value": "T11C37333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577617, "uuid": "94848f29-3431-43f1-b161-9f4761c38ecd", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577617, "uuid": "72ccf019-ceb8-4575-a34c-03b7cf0904de", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpy:q9WtLzgOTbjZvk/ekS/mcpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577617, "uuid": "095b2c2d-9946-4080-b92c-64e7acd3b345", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577617, "uuid": "c06d731e-90c6-4f8f-8889-4f67768ef7d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577617, "uuid": "b6a1cf43-45c2-43de-b79b-6f81b9e97733", "value": "RSVP_SPECIALINVITATION_2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5337122b-c547-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763557057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763557057, "uuid": "8f5289a4-0df0-42e7-80eb-67dba8f10475", "comment": "Malware payload", "value": "3e011d376211d051d39d7963b4cd41d2", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763557057, "uuid": "85c260e6-cf76-4e70-98b6-07cceeed200a", "comment": "Malware payload", "value": "c71ce8857ea3e8d41f55a15d1a0b84cb30b2ee05a179df911e888f675fafbc33", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763557057, "uuid": "a1f50c45-fddb-4898-9214-1e51a00f8f7a", "comment": "Malware payload", "value": "5bef87ed6ad416647236ae74a6974e76e16f85ea", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763557057, "uuid": "1a2a11cc-f5d3-4b2d-bd20-327e2032552e", "comment": "Malware payload", "value": "308a40fe8591d2a6a833b782ca60b58771168bcc0cef0e40df923f129ee1826a6ee3679e1433e7f838e9afaa929b4c60", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763557057, "uuid": "884f25d9-244c-4ba8-adda-4c51baf3a017", "value": "T172E0C238C243C04DEC623E3FACE0B521280CBE9268C7FB8814AAA80709C05D66040795", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763557057, "uuid": "b9da03d9-0cef-46e7-93f6-1dd676b43a0d", "value": "6:HRYFVmySHHEPfrkTmAiATq2h2xTQAisBBArSDxDXtcMT+ADyAInGE54vVG/4xHy:HRYFVmnHH+AaWTXh2nBBArSlXt/byANY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763557057, "uuid": "5e333037-dbd6-481b-a36e-b01b63e89855", "value": 305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763557057, "uuid": "f303c17f-121b-4ed3-9e04-5367149dd587", "value": "application/x-mswinurl", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763557057, "uuid": "dfb498c5-57e1-49e9-98e0-47bd0dfee2b5", "value": "Invoice46839.pdf.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92be597a-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594960, "uuid": "180c77e6-0bdb-44b7-b6b1-6393c6979404", "comment": "Malware payload (Mirai)", "value": "dddc6b1956fa5266c497b5d1cb2837c8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594960, "uuid": "2d0106a9-8e51-44ec-a526-3f60a4d96c01", "comment": "Malware payload (Mirai)", "value": "c761fc6e020e376e98815c8ed7f4588cc158931b5b6194075700c00453b246b5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594960, "uuid": "9a413acc-ef93-4ef0-ab64-1bbf3e9edf35", "comment": "Malware payload (Mirai)", "value": "e8fab1022e2445800d4450df51438311b19f0ead", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594960, "uuid": "8625dc4a-2421-4533-97d3-daae98568001", "comment": "Malware payload (Mirai)", "value": "2b29f2fef948480ff60b6c9eb4fc96dcc020c5bcefbba5f44eb0933cd0a1691478e554b7a70e25603d5578950dbd1ab6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594960, "uuid": "0cf91c86-32e7-4367-b717-ad5771984119", "value": "T1BDB34AC0F98B81F6C40B8C306166F63FCE71D5A94271CAADFF969F36DA77A019502249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594960, "uuid": "58af9897-7474-4ee9-bb23-e2f5f5f06acc", "value": "3072:XqyLpO5iL2SNPNmIrAzRzBXKtP1rGegptWsRCPN:z9OgL2mPNPA1BaJNPPN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594960, "uuid": "aaa9cd4b-7c81-48ed-bc0f-fda1c0cbff27", "value": 111892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594960, "uuid": "d8ae5492-45f4-40a6-9e51-32e98fd9acfa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594960, "uuid": "f02aee2b-f9b2-4611-a576-ef7f290cecc3", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6fbb8e4-c596-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763591182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591182, "uuid": "5ffb9150-3dc2-4aee-a4fe-d23915c1e619", "comment": "Malware payload (Mirai)", "value": "dbede439c139ad110a4e7846d10a343d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591182, "uuid": "2a36c285-99a6-4d26-8ab1-b4b50fec765c", "comment": "Malware payload (Mirai)", "value": "c8bdd38673aff456b1ba6ad0a7765d180157a8235ca7113ef04b32dad5cb80ea", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591182, "uuid": "890652bd-70fe-4822-8518-fb498b9703d4", "comment": "Malware payload (Mirai)", "value": "a9c0a0bc4f58b84db432fb45ee53bddfa818813c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591182, "uuid": "589a95c0-bb3c-4dae-8ae4-9731d649ddbf", "comment": "Malware payload (Mirai)", "value": "6939266fcc8c2e6edec5f83fdb7fc52deec4c724e00b0f3b1701de05618c4f250816c7b4c0519a87ccf37c47594b30aa", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591182, "uuid": "ef5127eb-584f-44e3-ab91-9ebda4828de8", "value": "T11543020E698527DEE92B79B40189131C27940EF9E1C32F8C3651BAEADE1907DF47D1CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591182, "uuid": "35049956-ab80-4321-b8d7-9ee6bfdf9c37", "value": "1536:gyC6yStWikKxzH7kYoWeI+q7CWR9YiVSS:gQp/xno1Ib3RNVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763591182, "uuid": "238bb330-76e0-49e3-bb0b-7c5329c49db5", "value": 60560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763591182, "uuid": "1b8026cf-1d76-4d68-9514-378daf5d8308", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591182, "uuid": "0c287fc3-f74e-4cfe-9dbd-e593f46cfe8b", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77503eeb-c584-11f0-a129-42010a9c0007", "comment": "Malware payload (GoToResolve)", "timestamp": 1763583317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583317, "uuid": "e7589e62-94dd-47cc-8320-7bbaa4504fe5", "comment": "Malware payload (GoToResolve)", "value": "5c95feb7f16778b2e08fe8b0f2051f29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583317, "uuid": "b6a0f73b-605f-4fcf-8d85-fa5312bd1f7b", "comment": "Malware payload (GoToResolve)", "value": "c91928e671ab28c485e5526af0a1ab51e75ca82b368d81c7445f7ce59a3aa74b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583317, "uuid": "3146fe8f-2d6f-454a-9b68-db7b576c2c0c", "comment": "Malware payload (GoToResolve)", "value": "38cdc4e2fdec25b2a1a9ac3e642f02c4afed8da7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763583317, "uuid": "da2f1033-649d-4a1c-9d97-7e1f6b7beda6", "comment": "Malware payload (GoToResolve)", "value": "01287fbed66b315f67e3d01bd60c49170e82b562cdc66f747b15afdafcbad819e3e25a6928ccf2d5a5c8e901118d95b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoToResolve", "colour": "#D940D9", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763583317, "uuid": "7e38bcfa-c528-4399-8606-80e7f2bfd97a", "value": "T16F37333132568471CC5211F1E929AFBBD66D6D248BB218D7B3EC5F2997601C33B32A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763583317, "uuid": "49950bba-8b67-47cb-91d8-b406c8dbf86e", "value": "f8e4a22bcb1b836585534b93f63c1414", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763583317, "uuid": "43196e8c-2166-4b24-b7b0-f9c8fd60d11f", "value": "393216:sIGdBtIDiCqWtLxXBi1/62Ocwf2o0b8MANHjLiB/ekS/mdVhReXpF:q9WtLzgOTbjZvk/ekS/mcpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763583317, "uuid": "0ad24c99-e649-4ecb-961d-52e803a4d5e1", "value": 24446944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763583317, "uuid": "62f428c2-98c5-4d93-b319-747ac1703f71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763583317, "uuid": "3b4f9429-e945-475a-9a54-91abd9e41380", "value": "Revised-Contract.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1af594f9-c570-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763574572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574572, "uuid": "2810375f-1261-409b-a131-3c02898315fb", "comment": "Malware payload (Mirai)", "value": "e3b4fd45e4ff8d11720c8967c6392761", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574572, "uuid": "6e1ee3d0-43be-4d42-8cf2-b8373051f064", "comment": "Malware payload (Mirai)", "value": "c9cd7556758e1fea7c02750b51d18f14896df5032c80f879775e0af5136a5b5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574572, "uuid": "f32bd449-5516-4595-a972-7d27666aea56", "comment": "Malware payload (Mirai)", "value": "03e8b24a447c295729155a723512c6175b8b401f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763574572, "uuid": "bdb6a30f-b560-411c-90bb-25c0daa6fee6", "comment": "Malware payload (Mirai)", "value": "4187b63353cd2f196eed8cf7884567353aa492409d3ff8e2f17dba2daab19ef762563fb662f1510db67a179f067ac2d1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574572, "uuid": "aa8d994e-0e1c-4878-a41a-e6205ed4f1be", "value": "T175834B56F981C613C6C0217BFB1E828D772753A8D2EF33039E265F61638A96B0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574572, "uuid": "44b18084-0c48-4a93-8ccd-50b3a82f6680", "value": "1536:FmaMulH2M5CWJLs6Mf99u7jl0kZzg9Wemp:FmaMu92hcshf9m0q+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763574572, "uuid": "fbbc5fa7-3468-4f98-aced-3a2055d4f684", "value": 83156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763574572, "uuid": "748c161c-860e-4910-b6c2-3fc5394b6c30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763574572, "uuid": "3057dec3-c1f5-4fa6-914b-4c3e22607954", "value": "arm5.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f64d9bba-c51f-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763540151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540151, "uuid": "b862242b-fec0-4f84-8194-3eeb061bd7b2", "comment": "Malware payload", "value": "84f5083907bec769f23eda596ad409d7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540151, "uuid": "96f46d72-ec4d-416a-92df-39880eddd210", "comment": "Malware payload", "value": "ca4aace60266cbc80f6a6949671600b0456f1dc7314c4f1f24d13a0c88fda972", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540151, "uuid": "3701f134-b5e3-4e16-b3c3-4b5c3803def5", "comment": "Malware payload", "value": "d7d7c99e18620d507cef37192c3dd89ae566d786", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540151, "uuid": "83c626e1-06de-4cd1-b4c6-8d0ec4e79568", "comment": "Malware payload", "value": "ca9120701e059c4e5eebb071e5a725f76d705f7350fd290026d42b2b6e691845adddc32795a8169c7d17fc4b753f0ccf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540151, "uuid": "6c6810cc-80b5-48d9-bceb-45aabd0e2ddd", "value": "T11D967D07FAA204ACC599C574875FD273EB25B4494221BA2F6BC49F313E26F205F1E762", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540151, "uuid": "35a4b29a-3e6c-4d41-85ac-96426ba4ab91", "value": "98304:jaaXNpuF3KCeVdb+3d+ZUwuJTYofyHgoKs3xw+Uwl+vZV0+/gP1hYMEP8eZs/XZI:PAVRY8pMd9mE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763540151, "uuid": "6ae97ce2-2c5c-42d0-984f-6dfad17200c6", "value": 8763360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763540151, "uuid": "664c7309-1d9d-42bb-9a56-157670f00d9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540151, "uuid": "00daf77e-1985-4419-9320-148c8dea6085", "value": "linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91ab80d5-c517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763536546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536546, "uuid": "c8863903-35e8-4063-916c-daa1bdb3605b", "comment": "Malware payload", "value": "49beccefe7c38cf4dfd451e2b1bf3226", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536546, "uuid": "cab86cab-e670-44e6-a85b-817ba33f66d4", "comment": "Malware payload", "value": "cbd21fbd00a6280b0dd477ff8755f583f121c84b170b58986823b545334f9aa8", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536546, "uuid": "e4f851b9-a96d-4775-82f5-9d4ccb5a8183", "comment": "Malware payload", "value": "59cbd0257c0b64bef7dcb88ccfe9eee3374034c3", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536546, "uuid": "e9f14877-aa5c-4907-acd0-e6d27f8a0040", "comment": "Malware payload", "value": "e5d9879d8a2d0c6c98f4660120e67d5cb5a753678339d02d00ea92f64708d79ffc6f4e18dc5a07962ab30fa1466e9cea", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536546, "uuid": "d1b59056-2976-4581-b80c-55be821735af", "value": "T16646E099B359A72EC87754334AF6523252874C478E829B43785C721C3BB76F80F5ABC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536546, "uuid": "fa77a9b4-aee7-477c-9cab-093ec8cb5734", "value": "98304:xR84Afd2ofrOhZn/IwepSRw3K+mkajr6IKYEBH0Mbul3jRU6JNjIIrBS9ro44:xG4l2EGK7raX+MA/jZr494", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763536546, "uuid": "249e14ea-5491-48b3-8088-1b94addf812e", "value": 5485034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763536546, "uuid": "1fc2e774-fb6d-4f02-981d-27907aa85109", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536546, "uuid": "b6c7dbcb-8526-41d6-afbc-80855f967617", "value": "bog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fbdcbe9-c501-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763526987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763526987, "uuid": "8d19b2dc-9fc6-4abc-b03f-84e58e7ec7dd", "comment": "Malware payload (Mirai)", "value": "deeb126ba8e8311284b304379596af71", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763526987, "uuid": "8660f5d5-ca27-42bd-ad67-58e79235faa4", "comment": "Malware payload (Mirai)", "value": "cca4ad0ff3c285c96eee002392c001a24b69828a19c2d1657a54ffd3f884d706", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763526987, "uuid": "6772cb16-0d0f-4bcd-859c-09aa8ad3646f", "comment": "Malware payload (Mirai)", "value": "26dd554776a345df6122244810fb2d63b9f72f4d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763526987, "uuid": "8ad2bf6e-90f9-48e6-8854-d0088561cf16", "comment": "Malware payload (Mirai)", "value": "1baeec8e882d47050ec15065fbc5066644729b0d538e85d8fd765323390b7eb349573b39b121dd2802db77c3369c2d7a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763526987, "uuid": "e99b689c-7313-4d3e-90d6-efbeb4c5db9f", "value": "T100635CC6D787D4B9FD6602786137A73B8632E6390029DF47CB24B93AAC22512F71635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763526987, "uuid": "a4547ad3-166c-46d1-953f-9b3740ac17e9", "value": "1536:VZ3OLHc7Dw+aGgSNSogboUvJAIffLdqgJVln0SIF6Qa:4cJJSououJAWzHlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763526987, "uuid": "3693243b-2aba-45af-b74b-a1eb63355e4e", "value": 70644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763526987, "uuid": "caf9a6c4-7de6-407f-9f50-6cd143e682b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763526987, "uuid": "222b1ec6-9fb3-45e6-9e65-63393b93704e", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6089fc42-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589721, "uuid": "91d9c024-4b05-4ffb-a03e-ab266d001503", "comment": "Malware payload (Mirai)", "value": "1b0b4dc0f24895eea20573231dfec3c6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589721, "uuid": "193470c7-61fd-4929-9ceb-0ac083ca1456", "comment": "Malware payload (Mirai)", "value": "cce677908eb66b3460c99b3815b208a059ecbd767fe7514a7a3be9663ceb935a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589721, "uuid": "664fbf1f-d9d3-410a-a879-2e7b55af3989", "comment": "Malware payload (Mirai)", "value": "cbf5f39a42c562fafd08fa15a3a2b49b7297c290", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589721, "uuid": "e2fccdc8-fe7a-4b12-9b47-683c67f079be", "comment": "Malware payload (Mirai)", "value": "933df2259287e13c5ccc5456bdb95466e4bec614bf792d7cb8b2adff0791b5c216ab89c84412f3e658afe0ec3e75eefe", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589721, "uuid": "a0e516dc-97c0-4996-8edf-f9714a7b4cde", "value": "T192D2E1254EA29EB1C20008BCB6D5D47A1C5316ECD5BEBB51D4A07B76F49C81F8A78B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589721, "uuid": "f2a181a6-ca6f-4de8-9e93-ac775407779e", "value": "768:SmJXP9ns/oNd4RFemXoyx7Xss8/s3Uozm9:SYPnnwFeMx/ZzW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589721, "uuid": "cc1be9fa-d327-4535-8a91-80e357162112", "value": 30948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589721, "uuid": "e02c259d-2ab1-4d84-ae66-35f06a2a6ad1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589721, "uuid": "7d54eca8-8617-4dc2-a295-7a62e33ea225", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "631c7888-c522-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1763541193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541193, "uuid": "4e3e2571-1c4d-4223-ab12-439ed9870202", "comment": "Malware payload (Joker)", "value": "f348471fd9c25b8f8ef054b619b65927", "object_relation": "md5", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541193, "uuid": "18ef1e0a-bca6-4eb2-a0e4-9f9de4baf1cd", "comment": "Malware payload (Joker)", "value": "ce559074acd3289792adc30295acdb0b2824aa3c3f6fec4df5652f15399e6b56", "object_relation": "sha256", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541193, "uuid": "dc026945-e8fa-438d-aae1-acab2c5d28d9", "comment": "Malware payload (Joker)", "value": "69b84fb83234108d62a4c736a8a3e1ff03338a15", "object_relation": "sha1", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763541193, "uuid": "bec102ff-f3fd-41d9-9ae9-e4de7d89b213", "comment": "Malware payload (Joker)", "value": "3120ec894a932c6d1db54dd575f85ebf9b5169b0abfa38754fa60b05954207fefabd3d666ef7e0c3995a9f6a23195272", "object_relation": "sha3-384", "Tag": [ { "name": "bill fraud", "colour": "#23C169", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541193, "uuid": "975f4a03-2e6b-415a-828c-37be11b6bf5b", "value": "T1D2D7230BE70DAC2BD8F3F5789C9A52617A612C84A31187E72A11F51C7FB36C48E1A7C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541193, "uuid": "0b210351-4dae-4af9-a7a2-de25f0fa944d", "value": "1572864:OtQzZAzOQjl8XBmyVIifUT8Yxq1EI/wMaCK/Kv4:tzGFl8X0y+icTTxqeWwMZgKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763541193, "uuid": "e625ad5d-edba-4f19-8e9a-b95c6860da79", "value": 61125867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763541193, "uuid": "b6f7f97e-e6d1-40b7-9039-6429d8395ba1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763541193, "uuid": "32062d12-8246-43e6-a9dc-c94afbfdc36b", "value": "Piano+Learn+Play_2.2.1.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc511f53-c592-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589446, "uuid": "1023cdea-ac7f-4f15-93ab-f91d1dfee287", "comment": "Malware payload (Mirai)", "value": "f4aa5bce9b94b6118acf8bbe2e0e6bfa", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589446, "uuid": "4a468694-cd08-4f5d-aee5-cc2bf3cccd92", "comment": "Malware payload (Mirai)", "value": "cefd01e33f93b0ba7d0fa8cf0420fe7390e067bfcc8bf837e5478e3651d2ac59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589446, "uuid": "158dde68-5dd0-406b-a594-27cfb8cfc6bf", "comment": "Malware payload (Mirai)", "value": "95f0ce5a7f3d58cd686f4eae70de3d4502e32cf9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589446, "uuid": "131e01ea-1c12-46b4-8813-85fc24743dda", "comment": "Malware payload (Mirai)", "value": "614bfddaf46372938fed6b50eb74d4cb637d219c538dc9b66a20857eb8d2ffecb6bc3025dc8b5e2cd454a62b970cf977", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589446, "uuid": "a06c96f6-034a-443a-be90-d7a7e5639a11", "value": "T164B37EC4E643D5F9E95706B11036B733CB72F43D102DEB93C7A9AE36A852950D60A3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589446, "uuid": "1fe8f58c-f7e8-4baf-9aaa-80bba6911353", "value": "3072:Qq3ebxQsggDTYIrOBmIFP6be0bKtGmhOgBpd8J8JLE3o52yAE83v:t3ebxQsggDTYIrOBmIFP6betGmhOd3K2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589446, "uuid": "7dc99814-4e17-4024-b3ca-fb51080eb2a2", "value": 112588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589446, "uuid": "5e5b7ccb-ccd7-4c98-88a8-6cbb4c57e233", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589446, "uuid": "e7fcc009-8e5e-45e4-af1c-3458f8696b5c", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfddcfa-c517-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763536510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536510, "uuid": "902e965f-5ab4-4fd0-8993-eb9aa0f3e78b", "comment": "Malware payload", "value": "099a5069c2f2086c901c7b9b16b0b712", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536510, "uuid": "e98bc20a-5c5b-4520-8eee-852cc62e8db2", "comment": "Malware payload", "value": "cf0f0fe9939cf486cd12dee0ab15f82513a56cd05efd2bf83621cfd789ff8ec0", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536510, "uuid": "abc7c2cb-5b09-4d78-a886-b6228ba6f333", "comment": "Malware payload", "value": "559765d9f52b24e87954fd93734069154a98d881", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536510, "uuid": "99ae323b-8982-4cbf-905f-0b849a280e83", "comment": "Malware payload", "value": "9f0bfd6fc9b4e8216cbcf5b27886cf7dddb77c74977ca0a3573ad1677043985a57746c13bedd422758e46a8265d1555f", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536510, "uuid": "b426e06a-c6e6-4877-bc90-c152823d2a5d", "value": "T1BDA6024BEE48C85AECF65239FE32032338235DA84703C47BA559FA3D3E775D28A91591", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536510, "uuid": "d01556f4-5fd2-44ac-be6d-2c4982c982f6", "value": "196608:TAcBZStMdhB++3ScxUnSbTuHl95SFiKvB0VzeSzfJAvqLyF8XPg3nQmq5EYQCn6:xSO7IAUnSXuHlvSFh00WGvF8XPg3Lq5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763536510, "uuid": "dea6c163-658f-4adc-932e-b2e95dbf2b99", "value": 10367803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763536510, "uuid": "daa97a86-7138-4b45-930b-22d292b9b4d5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536510, "uuid": "d18644ae-2e21-49fb-b799-e2aaca54b7f3", "value": "AvtoLab.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc8b77e-c543-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763555329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555329, "uuid": "bb239c22-53dd-4058-9e9c-1266da7a709c", "comment": "Malware payload", "value": "636614d70beeddeb0a2405f0cd98c60d", "object_relation": "md5", "Tag": [ { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555329, "uuid": "58878350-299d-4ca3-9094-2ce1fbe8c2ed", "comment": "Malware payload", "value": "cf2b79dd7af4ee4e1cf2b1968da74b1df2671466071670a87e1fbb5efd23c932", "object_relation": "sha256", "Tag": [ { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555329, "uuid": "7cfd4a02-5059-4cbd-bebe-99c95bd0802e", "comment": "Malware payload", "value": "576b5b60f41d57ae1a5549aed94a4d7b9465476b", "object_relation": "sha1", "Tag": [ { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763555329, "uuid": "10104592-86fb-4c7c-b1be-46e2d86cebb7", "comment": "Malware payload", "value": "e2d857172051a85bd4c6bceea80d93b7e3e8930fbaec2e4d54a3ab67920fe3d89ed5a69bdcffe5b95753b9dbd7898958", "object_relation": "sha3-384", "Tag": [ { "name": "FakeConvert", "colour": "#1178BF", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555329, "uuid": "b8006876-c6a9-433e-aeef-d3663b1163c5", "value": "T174D02201308059A32360324C48A3222828DB05B79EC0E14ABC9064031A729331DC1EA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555329, "uuid": "715e84cb-37a4-4231-b082-6b010a87c4d4", "value": "6:hJUxdht0gUtu2Emw/QQpNmq4XtMy1ihed:hWxV0gUlE/H4L1Bd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763555329, "uuid": "4e89c1cf-7b06-4325-adf9-8fa747d6a588", "value": 197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763555329, "uuid": "38393afc-7ebf-4890-80f7-17cbe48d6c31", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763555329, "uuid": "26b4f57b-e50e-452f-a11d-8c07ef9525dd", "value": "var.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fc50363-c514-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763535120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535120, "uuid": "18cf0da1-9b36-443a-8b72-3f3976866935", "comment": "Malware payload (Mirai)", "value": "a636d5ac6bebc9367f92d432e7b33ce2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535120, "uuid": "785af61b-3ec8-4693-9d41-cc7919b285b1", "comment": "Malware payload (Mirai)", "value": "d11f08ac68ab9a5f0a8c988b16242db61558e3dd6b9e36e60aef4922e8751c5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535120, "uuid": "75ec701f-8d8c-433a-a078-e70c0461a5f4", "comment": "Malware payload (Mirai)", "value": "783b16ed9aa84e8fcb6a95d6c7587371eb1b76fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535120, "uuid": "1a2566ba-d18a-4741-964f-7fcb757a1e28", "comment": "Malware payload (Mirai)", "value": "656e5a2d3ac784f4207ecdf737a9a25f69f1f99c09369b136c133372cbe74327f8b0eac0f8a0385a03845a993602a4bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535120, "uuid": "c21aeea0-1a5f-4e09-89c5-346cdb11d456", "value": "T15DD35C17B5C180FDC4DAC1744F9BF53AED32B1A91238B26B27D4AF222E49E205F1DA54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535120, "uuid": "5d8ca079-ef2a-43f9-8077-e2275657c366", "value": "3072:79eSuygEPjt6qkWqXdKmDnYMb0gBd/gQyVGsdqml6Paj:79eSuygEPjt6qkWq4eH2laPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535120, "uuid": "1af65a8a-0eb1-409f-9505-639b2aa5805a", "value": 139800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535120, "uuid": "b313fb1f-8169-437f-bd30-677cbda67815", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535120, "uuid": "69af3854-4b15-4a9f-9e89-b95941a1830d", "value": "main_x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc74718f-c558-11f0-a129-42010a9c0007", "comment": "Malware payload (Efimer)", "timestamp": 1763564643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564643, "uuid": "1dfed43d-0ffa-4e8e-a558-6342525579c1", "comment": "Malware payload (Efimer)", "value": "6004689475f489f66a6f75fdd64c8b33", "object_relation": "md5", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564643, "uuid": "e2225640-3e59-41b0-8640-66790a7f494e", "comment": "Malware payload (Efimer)", "value": "d247b3923c621bdbef663c33ff3cf57072da3e207562ef4823d71aa99d976b6c", "object_relation": "sha256", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564643, "uuid": "df0936fd-1349-4ee4-b018-d9909a533430", "comment": "Malware payload (Efimer)", "value": "1887ba256da9261835e011c5696cdf46b1eff294", "object_relation": "sha1", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564643, "uuid": "3e469f03-39df-4bdf-b8a7-fd17b1b1ca2f", "comment": "Malware payload (Efimer)", "value": "05936fabd2fef189b58ca16286e27df292103bae6e4882b886ac3a318f88cb19f08ce65afb8870fd513ac6d637518983", "object_relation": "sha3-384", "Tag": [ { "name": "Efimer", "colour": "#7835F8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564643, "uuid": "7883ee53-53aa-4826-8251-454c0db41021", "value": "T1EBD6335859D042EAEE73407CAED13224E6B8F8B61735CA9F87B90352AE571D00C3E75B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564643, "uuid": "52f82cc0-a715-4e16-aa69-29aa28e611e8", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564643, "uuid": "879ac759-e7fa-4a7f-8a97-197ab02794a3", "value": "393216:qJgThuPwPuGJ87trh+TgrMWXMCHWUj+NcuI3/PjuUwO:qJnUq71h+T+XMb8+6H/rAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763564643, "uuid": "b985b388-5cf7-48a5-9308-3d48c653c543", "value": 12616094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763564643, "uuid": "01bf9b96-b85e-406f-b624-f0dc9d3cf197", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564643, "uuid": "f6e8f794-1d3d-43da-9dec-a4dbc82df4b0", "value": "\ud835\udc4e\ud835\udc1d\ud835\udc28\ud835\udc1b\ud835\udc1e_\ud835\udc29\ud835\udc28\ud835\udc5f\ud835\udc61a\ud835\udc1b\ud835\udc59\ud835\udc1e_\ud835\udc63\ud835\udfdf35\ud835\udfde_\ud835\udc4f\ud835\udc32r_x3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4501b188-c4f8-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763523103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763523103, "uuid": "1e58a9a4-cc73-44df-9466-7504e0d4560d", "comment": "Malware payload", "value": "f62ea7a5a342f1746a93c131edaed5ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763523103, "uuid": "1d392981-0470-4f21-8740-fb11d0f94210", "comment": "Malware payload", "value": "d291ea78cb8a925d6ed51d90117c4a481e3b088dbb201c35b9fc002764261546", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763523103, "uuid": "6314b711-e698-4f4b-ae46-c8a8ba139b8b", "comment": "Malware payload", "value": "91285d70aa2ef92578e2399fb9eb7dde3fb30c38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763523103, "uuid": "d53c6696-5b3f-44f4-9e98-bf57be1cfe9d", "comment": "Malware payload", "value": "f3bf6bb4cf1bb0c0fb0d3c21be8f794ed1de51e94945f880ac75d9613f66d2eba33584c6bfba9bb0e59ea02adb6ec215", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763523103, "uuid": "42fe8e93-de73-4b06-8b02-873553d988c6", "value": "T15B930996F9A38B56C4C557B7FB0EC756372307A5E3DF36138A184E34268B50E8E39A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763523103, "uuid": "8219d9d9-f0bf-4132-88ff-98fae9b48c93", "value": "1536:t4+LOuhe7k82x6+/zDE/KrMnqZ9OjFz60C1W2KD8mZLlXxYl48VoByDMC6csFPrX:9LOuh02xHCKQnqZ9YfMXKgyLlBZSyPT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763523103, "uuid": "6eb2b81f-39d3-4638-8950-2c437ed1e131", "value": 92934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763523103, "uuid": "84090a0c-9a4a-4a10-bb73-537417d24e5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763523103, "uuid": "11df9dc8-c6b2-4d34-bb7d-2f4736d3daaa", "value": "tftp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "662d70b6-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594885, "uuid": "c3988057-497e-4b06-9aae-69c5c8f89e41", "comment": "Malware payload (Mirai)", "value": "627c0b4715196e52ce8ab48a6e79d334", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594885, "uuid": "d25c3310-90fc-4296-8e69-539a2a26c592", "comment": "Malware payload (Mirai)", "value": "d2c0f603539c5d48a662a8979d9cc6156dbc12bade96b8511ef122b7b0d212eb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594885, "uuid": "7083b501-8b66-4c14-84ea-8b3e56f6107b", "comment": "Malware payload (Mirai)", "value": "84a3962876d5700054c7f5c1f69be6ed01e65813", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594885, "uuid": "bcf6aa77-fb22-47a1-8c47-2d58fa60bd05", "comment": "Malware payload (Mirai)", "value": "7d38147ccb938688fb26f406c606d46e3262a5d111405dfbd325d0505ff1e11e44c2bdcdcc6b3b06235dc5a64b56ba09", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594885, "uuid": "461d655b-32c6-4734-a469-9e93ceeae22d", "value": "T197A3CF33C82A1DD4C09405B8B9EA9E351B63F5C112472EF726EAC6665087EE8F506FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594885, "uuid": "b68fdfcd-c179-4e06-b218-77d0aabc5446", "value": "1536:Q/Taalfz2XXBKUHfhzCyHYf6CKCLhA7QRrLfCG8NUzxcN0E:QbaaNgDHffHO6lC2orLfGCFcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594885, "uuid": "77331655-6915-42be-9d67-0d3be62160d5", "value": 103972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594885, "uuid": "0fffa789-56af-4bcd-8933-2bd9aac23d6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594885, "uuid": "bec9a949-a195-4a66-803f-fce7e7cf8cb3", "value": "S3o.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a015b67-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594918, "uuid": "304c1ed1-a2e9-4198-a307-611600643b68", "comment": "Malware payload (Mirai)", "value": "c17c3b3af129223518213007c0432ec0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594918, "uuid": "28b9748d-5d4d-406f-a70f-8ab9493a0bac", "comment": "Malware payload (Mirai)", "value": "d3ec6b618fe02b1839ef62cd673bae122d282be44933f4bbf03a9ce55ee9114c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594918, "uuid": "3cc547fc-dc8a-4adf-9021-741f98f38a99", "comment": "Malware payload (Mirai)", "value": "9545d1b19dc465b52905848cf6d1ee5867858522", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594918, "uuid": "c3acdea7-b014-4629-adb9-ae8199b00fab", "comment": "Malware payload (Mirai)", "value": "de08886c146b18ffa1de3aaa40694f694cc3e6fbce03a7d2f485601ff5c2b03f54f43027df316ac78ac919fa20e09131", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594918, "uuid": "c60d1561-cbea-4e88-9357-0b6614772b74", "value": "T1AB831882F8828B2AC6D017BAE6AF658E3361B3E5D2DF7117DD204B12378510F1D67E91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594918, "uuid": "3f2dc5d0-a075-4b8f-87e3-1513ba32b6bd", "value": "1536:7jx+0qyV2Y73aC80nExbngqXmI7pOYfAWKYd3Z25BQEhAL:7jg0qyV2i3atccGmZ2PAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594918, "uuid": "03f86b6a-8d55-4dc9-a39a-b61f77bfc025", "value": 83396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594918, "uuid": "f3fba00b-6d4c-4356-aec3-0a966004c79e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594918, "uuid": "639ed331-2cc5-4c59-b84f-513d2e4ac6af", "value": "S3o.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db45fd7-c4df-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763512300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763512300, "uuid": "04eb832b-21bb-4464-bb99-6ccf92efea68", "comment": "Malware payload (Mirai)", "value": "7cfd730c94a816b84dcfd249b623a5ee", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763512300, "uuid": "ad746a7c-1bf2-4379-945e-3f496a2ace21", "comment": "Malware payload (Mirai)", "value": "d51d75d43542ad31203192fcf45f548dd79891608d2ed274d3d4381c1ff08f4b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763512300, "uuid": "006d6d70-9c4a-4b9c-bcec-db08d3db87c0", "comment": "Malware payload (Mirai)", "value": "e2d2105a95b23ed16ef25b62ccb108aac3af1826", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763512300, "uuid": "8dc40dd9-e45c-4b32-9ded-6ab757a5c24c", "comment": "Malware payload (Mirai)", "value": "78d04931c4c682a550c28c17ac1df10209d080490dd9964482a7e4e8704179e2eeb037f04ed02ff532d61f4d6ecec751", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763512300, "uuid": "5c913549-d5f8-4004-8ab5-7db4ece7b419", "value": "T1C62136EE31A712746DA1AE63607F841031B2E6D754D0EF1968CC7CF590CEF247411A93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763512300, "uuid": "62d162af-603f-46b9-921d-d39ced1a8ccf", "value": "12:q0FtbH0FtJu0Ft7h0FtJYL0FtUY20Ft9NIl5sL0FtO0LKF0FtISM0FtI+OU0Ftyt:vNcPrRCx+YjfNI7sYHKuqKTk4DytVK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763512300, "uuid": "a341abad-9efa-42cc-bd02-75771fb342e3", "value": 1189, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763512300, "uuid": "416a4ad9-c1c2-49b3-aadc-fd4c8bb14008", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763512300, "uuid": "09b6f97a-cfe4-4f7c-8f7c-4d9e06b2ed78", "value": "dvr.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a14d4b-c532-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763548305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763548305, "uuid": "c3f022d3-3fd7-49c2-9826-bda9c4d29b17", "comment": "Malware payload (RedLineStealer)", "value": "9ba7c9e860481ba43b16382d1395b996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763548305, "uuid": "c26d9b58-d29c-4a7c-ad08-048742d33acd", "comment": "Malware payload (RedLineStealer)", "value": "d5438215003956acd984ea603931d620cb5370bc041ac7c4f2cadcf05ed44e44", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763548305, "uuid": "06ebcfd7-46f9-4429-aaf4-5693aa13917d", "comment": "Malware payload (RedLineStealer)", "value": "41dfe4051642019024b4df1d9a9ae7231a1a586e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763548305, "uuid": "d25be203-96b8-4934-81e7-b259c93e1ea6", "comment": "Malware payload (RedLineStealer)", "value": "9ba9f93a5e412c84a7f209dc160d6652a7ffd26433bf640824d64b7fa3b4f89960cda29c7e4e993e937e9e267beb0811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763548305, "uuid": "ee22a0d3-8c6c-4a5a-b357-69d9770c45f6", "value": "T1AA75E11263DD8361C3B25273BA26B741BE7F7C2506A5F56B2FD8093DE920122521EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763548305, "uuid": "3fe496ae-abd4-4e94-a274-981ec617a4d8", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763548305, "uuid": "5844e500-b8a0-40ad-a1a3-3d8e93926711", "value": "49152:7Vg5tQ7alsSTzF+0niC6Mcu/9L8h/IZ5:Rg56FSHo0niC6Mp/9QZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763548305, "uuid": "a907f7a0-18d3-4660-bf78-9a4a4f0caf19", "value": 1625088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763548305, "uuid": "128cb27e-32e1-4745-9c0e-ca752b391822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763548305, "uuid": "86f75fbb-679e-4a62-bf4a-a564275ecde0", "value": "CBC Group Inc. Purchase Order 418186.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b71430-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594933, "uuid": "3705b3fd-1a65-4b18-b1b5-41f6c92c335e", "comment": "Malware payload (Mirai)", "value": "5df57c3732a137b9d60e1db0373937c0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594933, "uuid": "1e50166b-24db-4b6e-bb50-2f0f7c563c8c", "comment": "Malware payload (Mirai)", "value": "d59a20691e62e80b9d334bac7a9ea0a5e4950b736833e4b9863a30f3c4bcdb25", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594933, "uuid": "1acce986-349d-4186-b8ee-cf13d6972951", "comment": "Malware payload (Mirai)", "value": "d59d7cbb1ea82d3c63f7dfe341b0f8f61fc221d0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594933, "uuid": "4618a5c6-88a6-41d0-889d-7e05547e9954", "comment": "Malware payload (Mirai)", "value": "106337dc6cc85310ba708909bd3d247781c16062874ae9e5674c826fb22314b2d9178e96598a402deba56f8a5c0455bd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594933, "uuid": "dfc56880-5b23-4d2f-8d1d-07d00ef73378", "value": "T162E3E71E7E618F3DFBA9C23447B78E26965933C637E1C585D1ACDA001E6024E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594933, "uuid": "a7a22729-3601-45f0-854e-940afb8de008", "value": "3072:ZkF+6uk9hckUGXZy9q/uleW0AJsPQDAFwLH6EDq0Rp6+P+po5C5DB1LPXyJjovfE:uF+6uk9hckUGXZy9q/uleW0AJsPQDJHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594933, "uuid": "e2d2b0e4-cf62-47be-823d-40f2639088d2", "value": 144696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594933, "uuid": "02c6400e-bfa5-4821-835f-dd127d3a6d67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594933, "uuid": "cc47768c-6c45-43e8-a961-dc147e97ad86", "value": "S3o.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78aa6cab-c55e-11f0-a129-42010a9c0007", "comment": "Malware payload (Stealc)", "timestamp": 1763566999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566999, "uuid": "af3fd663-3a16-4f95-995f-23e24df39b46", "comment": "Malware payload (Stealc)", "value": "8d8be810611aaac7cba2d1b29eb6fdc1", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8714", "colour": "#C86D45", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566999, "uuid": "0a8d125b-8ea1-4dbc-9dd3-2a99d4fbf33b", "comment": "Malware payload (Stealc)", "value": "d5c72359e365ae0f4306fa0097ea72f9d9a917e9a642bfbb25ac681e9086098c", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8714", "colour": "#C86D45", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566999, "uuid": "a9135b37-7eb0-4962-a920-00cd835d17f3", "comment": "Malware payload (Stealc)", "value": "f095d1071f5cf5a422f15e45c2339e7a6ca1a1b1", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8714", "colour": "#C86D45", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566999, "uuid": "d0df4a9c-f7bc-4490-aa40-ce72f422c5c6", "comment": "Malware payload (Stealc)", "value": "01b56a113969f8826bfb9e2bacb8ac7989b98bf76897eccd7da28b3783e169a803e90a9710c7dda2db152201f6190d5a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "80-97-160-107", "colour": "#F124B5", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-8714", "colour": "#C86D45", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566999, "uuid": "57e5e3d2-61fb-4723-8625-95321700f23f", "value": "T1DFF533071F59EE7C282E84816563C5278B073BD82E664CF8049DB2FDC6EB0651D5D2EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566999, "uuid": "a552c3d2-c32f-4fcf-8d31-cc0b12bbc6f1", "value": "98304:ig7ibAmM5MHyvg4p85N7xCSoc0iANT2Dcz:1GbAmVS5p+Nlac0fqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763566999, "uuid": "9b9de41f-c944-4805-8dfa-54deed862c51", "value": 3529731, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763566999, "uuid": "2df8d003-68d4-4310-b189-95839db6ff57", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566999, "uuid": "5239ff4a-1a57-410e-bf02-2e3980002a3a", "value": "file.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7ee765-c558-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763564507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564507, "uuid": "2cee77d1-936e-46c9-a712-99f464d39a7d", "comment": "Malware payload (ACRStealer)", "value": "64c4f2ca807eacbdc60b0ccc446e79bd", "object_relation": "md5", "Tag": [ { "name": "65-109-1-228", "colour": "#9354F6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564507, "uuid": "f7f774ed-9b04-4e70-817c-995a0300c4ba", "comment": "Malware payload (ACRStealer)", "value": "d5e3356ace034ad3b30bcaf4a1986ffe4297907b11bbbed3bab893aa0dde9cca", "object_relation": "sha256", "Tag": [ { "name": "65-109-1-228", "colour": "#9354F6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564507, "uuid": "6eb6880c-2b3e-401a-a341-1224f3696843", "comment": "Malware payload (ACRStealer)", "value": "5efc11f1836c4c412d1acbc40bdee2149ac3e3ce", "object_relation": "sha1", "Tag": [ { "name": "65-109-1-228", "colour": "#9354F6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564507, "uuid": "9b5ef48f-57ad-4b76-ab74-5cd8be124f33", "comment": "Malware payload (ACRStealer)", "value": "dfed6ac6499ef5f47755149d271b335f9369b196b24531a52514101822494d2efb2bb89188bc7a17e127db72c85a9c31", "object_relation": "sha3-384", "Tag": [ { "name": "65-109-1-228", "colour": "#9354F6", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "AutoIT", "colour": "#C5D2EC", "exportable": true, "hide_tag": false }, { "name": "CypherIT", "colour": "#566C31", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564507, "uuid": "336a3160-7704-4ae3-a1bd-1c94728d6ebd", "value": "T1A635225657E436A6D8B85731C8F2022396327C650B7A97FF0389697E0E333C19632B1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564507, "uuid": "b18843a4-77f0-4e54-a663-4bc6bd22911b", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564507, "uuid": "fa89c979-0f95-48b2-8e34-60167bfc32d6", "value": "24576:yj9yq6gF7s8nvlmYxRbvmb/ROiJ/E+DZVPBzymYDjz:yjYq6YZgYx5m9DEWTzymYb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763564507, "uuid": "b1b368e0-cd0e-4842-9906-9c6b3f87c4ba", "value": 1130928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763564507, "uuid": "356ba3f2-8a93-463e-ae90-eed163422dcb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564507, "uuid": "9689e8cd-f205-4800-9325-81dde36413a5", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6140c976-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589723, "uuid": "38169fbe-f403-4b5b-81d5-5e38cced1fbe", "comment": "Malware payload (Mirai)", "value": "a858b599c519829131098d134f35db5a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589723, "uuid": "cbb80f98-ead6-477c-ab2b-d34d8e728615", "comment": "Malware payload (Mirai)", "value": "dadbe7b48b5f1fe29e819d1acc513bf893ba9419131116c5e4a2ed1184746e1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589723, "uuid": "4a8702fa-6698-4443-b48e-7db333ecafa2", "comment": "Malware payload (Mirai)", "value": "f475cbe7c57724ab722a606e2b51bd23d0ff874f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589723, "uuid": "2edf18aa-d5ed-4147-aa46-19e21953e85a", "comment": "Malware payload (Mirai)", "value": "7ecf018187f4b616ecae97d14b0521b149737141d586b97fbece9c7c6122863e11b3e374e6bc4863ac08a2b0d280b6a8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589723, "uuid": "771156eb-e4c4-46f3-8bf0-454d095fb684", "value": "T13BC33CCAB402DD7DF90FD9B644734D0AB935A3A156830F26639BFD93AC321A4BC12D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589723, "uuid": "0fece874-4d04-4393-bd90-a1e52120a026", "value": "3072:HtnTmbI2gC+qD1Axn0OT/xXNNsJ0H1F/+p:RmbI2gC+zZbx9Nr1F/+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589723, "uuid": "6624e73b-fb91-49c8-b0fd-abd662d1ad00", "value": 118736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589723, "uuid": "8f2e171b-5eb9-4f6c-a925-03d529b10bb8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589723, "uuid": "be5bec1d-b320-4916-b930-5ba6ca689d2d", "value": "S3o.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2d86d0-c4f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763522179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522179, "uuid": "efdb9511-cbdd-4469-9c69-2d8254032222", "comment": "Malware payload (Mirai)", "value": "2b82b5aef51221b10bd6b672b86c41e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522179, "uuid": "ac95ab91-6ee1-4923-9ea1-2a21d63827d1", "comment": "Malware payload (Mirai)", "value": "db7cfbb18a1a69ff644686a996e27adb580dac016f1e378cb553961782bd8ca7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522179, "uuid": "41c00fb3-533f-4960-b003-5b84b08ba8f2", "comment": "Malware payload (Mirai)", "value": "ecf4a6c4dc26359edaf42257e0f2dc4f418a9d0d", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522179, "uuid": "912cb0f7-8566-40fb-b5ef-196ff497cd36", "comment": "Malware payload (Mirai)", "value": "0fa8f8fe435d72f843dcf9569d958a93101235193569d2662d017df275019bf2319913e4ef4b26c31798aab00d412295", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522179, "uuid": "b1a943e6-ef6a-4182-bacc-8ac9a839ed04", "value": "T12892D1C0FAAA09BAD810D0397A2B98541138ADF47F1F931AFA58CD5D4153ADDF43F924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522179, "uuid": "476d7b9f-10eb-42e0-821c-9bfb45c906c3", "value": "384:MjxPMoYe3rgfOJaUV9HIWMMfPDUGTY6CAPTAddOgHEIv1R1O:+UoYe7kOIUH2MfPQGMdAPMIA1O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763522179, "uuid": "fe828486-dd16-41cf-9f6a-d9b7ee86a921", "value": 20480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763522179, "uuid": "51afdc45-928b-4eff-b35b-368c297269ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522179, "uuid": "e690e06b-d439-46ae-b2f3-e0a7feb7f1b5", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7de8fe1f-c517-11f0-a129-42010a9c0007", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1763536513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536513, "uuid": "a97174c5-545c-4606-9a6f-6bcddde36523", "comment": "Malware payload (Gh0stRAT)", "value": "0bb8ded9ac89db2900b99e113bc70911", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536513, "uuid": "360585bd-9e39-4803-8f41-aef7505011ce", "comment": "Malware payload (Gh0stRAT)", "value": "dbec5c181f37023366ae5072af464ba8a84e32448421279a3d2277cda72b8d6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536513, "uuid": "c84d2cc2-fe53-4b9a-bea5-47c6c3010206", "comment": "Malware payload (Gh0stRAT)", "value": "b82beb95155e9c81da9c22f0c2adf5189559a2e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763536513, "uuid": "84853ab4-99ee-4bfb-92a4-039fdd698db4", "comment": "Malware payload (Gh0stRAT)", "value": "8deb80c0e2fd5c098ceb0f5a0a61a6cee9021bd2e858e8ebebe84675417fe8c99a3d292d32673ba5103f841a6e7048e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536513, "uuid": "cdb3b315-791d-41ed-8ff4-6e55e4ff32a2", "value": "T143A5CF23F2CBA13FF06A4A364977D212943BBA6169128C6697EC385CCF261D11D3F647", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536513, "uuid": "c8a440c0-fc7e-48c8-9c8e-42373c4af23e", "value": "efd455830ba918de67076b7c65d86586", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536513, "uuid": "16724a0e-75eb-4b40-8e3f-6ccb42f7f545", "value": "49152:OxXXm66OSB6nO5S+gLg9iKhbWS1ilCiYsCSqNledqp:OxHXSB6nOrgLyySKGsCl0qp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763536513, "uuid": "89f7c88c-849b-4902-850a-34d70da68727", "value": 2091806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763536513, "uuid": "1a0e05fa-689a-4cd0-87e5-057cbfb40db0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763536513, "uuid": "53296a66-d3b6-41d7-b066-fd1afad234da", "value": "Rekaku.Tool.v1.0.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe99db8-c54f-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763560749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560749, "uuid": "6ca317fd-ad02-45a9-ba9b-0e8fbb60f6c8", "comment": "Malware payload (RemcosRAT)", "value": "bcdf8a9094fbe66f09aada90ec324c7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560749, "uuid": "44f11edf-2fd4-42d7-833c-f72c012e4fa5", "comment": "Malware payload (RemcosRAT)", "value": "dc5a6f8239b80e720e92ebd7622383dfb5ca15e4c1101659fd6bbfc10823dd92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560749, "uuid": "d8bbc48d-a8b2-4d7e-ab6d-ca8518a40c47", "comment": "Malware payload (RemcosRAT)", "value": "5bac053815d890ebdec583c08f4640c7221b995d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560749, "uuid": "b0278028-1267-4042-b322-fc122baad914", "comment": "Malware payload (RemcosRAT)", "value": "b9868b05ec112783d478c46d01fcb816b116cb70c54e95038822175bc2002c2e41677edc57bc6611846a98b605f62127", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560749, "uuid": "cb4c444f-5651-4f2c-a06b-714a12ab9d2d", "value": "T17131000DBE0AC3538BF19A6A8A40C81FDD58813B1312C15C7D55FC187F38268D9809DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560749, "uuid": "e27abeaa-1b61-4d75-836f-fce6dcda37cd", "value": "24:ImSXu5CATCzlUm1AdWttroIH9M6chNRAFcMVBjXTVTn0PBMrupEBPNsPDMr1bAhS:lSXnj1AdWvkZNOFNXZ+w1ZAhS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763560749, "uuid": "8159c873-af44-4e48-967a-8e30f6c3eb7a", "value": 1546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763560749, "uuid": "b3213433-d2c7-4b2a-b8b9-cab49e4016f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560749, "uuid": "28f8f4f5-3e51-4c5c-85fc-8ca59d527fc7", "value": "Signed_PO#2025.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b18c51d-c57d-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763580183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763580183, "uuid": "50c4a3ca-2c92-4efc-b823-f7eec0e619f3", "comment": "Malware payload", "value": "261fff9a189f8c67aa612cfea22845d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763580183, "uuid": "58bd38cb-f6f6-44b1-b2f9-e977c25773da", "comment": "Malware payload", "value": "dd2aa1556e882b63666b680a4768056773719fdb847cc7a525c3a9bd9a915fb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763580183, "uuid": "722b32f1-75cc-419b-872a-f49281bfc273", "comment": "Malware payload", "value": "7e33c38f0d3877cf17f0269fbf7661279a641fb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763580183, "uuid": "f00f120a-20c6-4f5b-ad44-11cb7c6da4af", "comment": "Malware payload", "value": "70dd8d63e364569915aecee256b4dc625dcfdde096f070acf419be59d24c5c24e69ba8c454d42a72f83a5eb675b29851", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RUS", "colour": "#4A9A50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763580183, "uuid": "d80fa2d8-ce21-4c29-8640-8048023fe823", "value": "T1527733B633B71155EA85827A58B1A90BC7D07C9A1BA6C54BF3EC36133CF70E5D628243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763580183, "uuid": "a2563e7a-bc2e-48a8-bdb3-3eadafd7821a", "value": "dcaf48c1f10b0efa0a4472200f3850ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763580183, "uuid": "0b888491-fab9-4829-aaea-ed1279072919", "value": "786432:pWSOiaKCFtW8MewXMb8oLLsKMMo5ovsVuNwZHjPrRQ766zTkWur5SZEF/PG7rT4M:MScKOtW9fcMoeSqjPwEro4/AX4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763580183, "uuid": "dd13ebfc-cd0d-4461-895e-cf0e7fbacff4", "value": 33390609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763580183, "uuid": "89be0f32-85b3-42b5-ac7d-e20865335034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763580183, "uuid": "68c84ebd-6cfa-45af-bcd5-d8973b8ce072", "value": "GoogleUpdate.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229441cd-c57a-11f0-a129-42010a9c0007", "comment": "Malware payload (OffLoader)", "timestamp": 1763578880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763578880, "uuid": "1288b854-b036-445b-a1a1-06b48d92d625", "comment": "Malware payload (OffLoader)", "value": "c55bd85a5a28fe5e5a5fa6c15aa4628e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763578880, "uuid": "bec47088-303e-4cae-92f0-ff744cbc99dc", "comment": "Malware payload (OffLoader)", "value": "dd965b80b962f0e1c8e95eac6060ce5aca5951c0e5b1f6b38afe4ee27884d9a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763578880, "uuid": "2f7dd3ed-003c-43a3-badd-59ffc8a74e31", "comment": "Malware payload (OffLoader)", "value": "36c1ba73d620fa3908e812c9313a37e05d473895", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763578880, "uuid": "8af3e2d9-d41d-4082-ad70-a951df794e56", "comment": "Malware payload (OffLoader)", "value": "e9ef94a8de427b1046341fc22882b49d843c80e22ecda86d1581d7576f82b34652db2851db32ebd3b79e94e6ce0b4285", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OffLoader", "colour": "#89C7C0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763578880, "uuid": "282ed9d4-bfb2-4011-b3bf-c13bdc441a6f", "value": "T13895CF33F28AA73EE06A1A3759F292505D3B7A21641E8C4296EC3C4CCF791601E7F657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763578880, "uuid": "8fb8d1a6-e126-4e29-b8af-b3e3d7294256", "value": "ac4ded70f85ef621e5f8917b250855be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763578880, "uuid": "7b4e4b7e-a55a-454b-88d8-8dc64eb8166a", "value": "24576:cX6N6JCGN33/T15ZWi7Knsz+6f+GqWU/Wr0VUw9jzy3+nILajv12fJO6xxvZSABa:/N61T1me7qWUWr0VZ9vFnIL4kOSxhpVi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763578880, "uuid": "ed43ac11-0bac-4c86-a760-663d26b5b647", "value": 2048678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763578880, "uuid": "9ad97754-a7ea-4935-8b75-64212c061997", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763578880, "uuid": "f956bd14-fda9-465a-b4c0-0a7aae7ec665", "value": "UPDATEDSuperiorityRustHackv2580NON-Steam.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64df16d-c52e-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763546567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763546567, "uuid": "8990cbf3-987e-42ef-9c1e-2c90b1267539", "comment": "Malware payload (Mirai)", "value": "ead18f96b474b94e0879d38c55a3dc59", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763546567, "uuid": "a59fff4f-08bb-4a1a-a5cb-4f58cfdf04fc", "comment": "Malware payload (Mirai)", "value": "dd98fa91a6f8638fba531acf7f667fc9c92dc06304cc580f8a50b930aeafcea3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763546567, "uuid": "0892f9e3-285e-4d76-a0e6-dcf902e93a9e", "comment": "Malware payload (Mirai)", "value": "6ff217469976bdfe6df9e8f57ed909f06812704c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763546567, "uuid": "9c176eb4-6f02-4877-bfdd-969ffaf46740", "comment": "Malware payload (Mirai)", "value": "0b9c6f9764d769477260b1b7ad00e13fea6becd777cd7802d3a2084b50a8c71ace6d00aa710c18d2743b54fe76a8a321", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763546567, "uuid": "e68cefe7-a72c-4ea0-b9fa-2ed6abff2716", "value": "T12BA3D70E7E229FADF668873047B38F31A759338627E1D585E2ACD2141E7024D192FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763546567, "uuid": "ed76ad71-8fc9-43c3-8c3c-a4aee8e4a02d", "value": "1536:n0Kt8ieTjyh94+Eojsc86cLoHuhy32o2ZeY/wq4oTemDeC:ndvWQ4wsc86cLNhy32og4OV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763546567, "uuid": "67178d6d-97dd-4f78-8057-f69138ba75fc", "value": 99876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763546567, "uuid": "41e6bd36-4b16-4d26-8477-34188deafe48", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763546567, "uuid": "f1b27f13-0be0-4222-8256-802b5fcb97d2", "value": "mips.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22cffaa-c52b-11f0-a129-42010a9c0007", "comment": "Malware payload (RedLineStealer)", "timestamp": 1763545298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763545298, "uuid": "5e2270e8-bcf4-4caa-b605-333d52eaa6b7", "comment": "Malware payload (RedLineStealer)", "value": "c651803dd68acdc81a6fb18bc6c97eac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763545298, "uuid": "f6f39a80-1014-4b8c-9211-7e78e68e19d9", "comment": "Malware payload (RedLineStealer)", "value": "deeae0070809a7e636f8c88dadfb9661e0260e0aaa03efd1d1a36ee4775e0ed3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763545298, "uuid": "6b390c47-5963-4b76-8ff9-0e7c11ff08e2", "comment": "Malware payload (RedLineStealer)", "value": "ff166189028e635404227f1be326436fcc4a8a5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763545298, "uuid": "62189b7c-d33d-42d1-bfcf-c17bab7aebf3", "comment": "Malware payload (RedLineStealer)", "value": "a7e3f3b5bd5b479a82e5b4313b8fe52dcca0b55e68b81bff1fd5e7064961757c1d876bce1a31bed3286a366912a9d4cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763545298, "uuid": "b16c2a00-6565-4c94-980e-4d40454995ad", "value": "T1C135CF1363DD8361C3B25273BA667701BEBF782506A5F96B2FD4093DE820162521EB73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763545298, "uuid": "00bfcd9b-3c4c-4596-9e03-a5614d00eae4", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763545298, "uuid": "c3d77e61-e579-4aac-9ab4-bdc7c963a701", "value": "24576:7tb20pkaCqT5TBWgNQ7aUMw73NjzDVuMO6I6A:4Vg5tQ7aUMwxjHV3A5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763545298, "uuid": "f4e0b52a-3a7c-43b6-a0f8-f67a2fb2e07a", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763545298, "uuid": "e91009e6-d109-4847-ad1a-cee7382018a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763545298, "uuid": "cb27bc41-3d2c-40c5-af38-d5a1fb1ac061", "value": "RFQ-PO-ADM693-PR# 133614- IRR-RMS001-2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d60a77ad-c546-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763556847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763556847, "uuid": "405748e1-6212-4588-a4f7-12258d9541e4", "comment": "Malware payload (Formbook)", "value": "7d052ca7a249c475adb32ccf261db5ab", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763556847, "uuid": "aa378c6b-b3ac-45f5-bdd7-c4cae791d962", "comment": "Malware payload (Formbook)", "value": "def48598d686df0e5b07906a4331ef9931e79d2390894824b03a9a0da7683c89", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763556847, "uuid": "b6135d32-8f75-44d1-8b43-f9eddb8e2884", "comment": "Malware payload (Formbook)", "value": "a21659abddd747e574a590e369b6d0666a8d6de8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763556847, "uuid": "66f51600-9b94-4cde-ae15-279dce20ccbd", "comment": "Malware payload (Formbook)", "value": "d87b2781942d4efe808abb357babd3b89034996f63bc064110f053ca414e00af83fb497f8458d657ea93f7e9e48d141c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763556847, "uuid": "b94ff38a-d1d8-4d9f-b0bb-9153bc1b7cb9", "value": "T1B5D423287CCB365102CBF4F54616FC8DBA396B8E59045DEEC012261B7DB8E2F351AA91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763556847, "uuid": "4b007218-81ef-404c-b859-bc676388fb2b", "value": "12288:w6qDqgLuIqftUzgt1rB+ySmgyVYPyaMdjpv3ddvuIAz7uhsj:7ENLuIE7t1rgySyoyaGv3dlAzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763556847, "uuid": "8b009fcd-ad4f-4c25-b74d-150bf654a3d2", "value": 656710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763556847, "uuid": "58bfdd47-dbcb-40ba-9f77-e08f9256b65a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763556847, "uuid": "1f9368cb-3ca7-4d9a-9962-bcc837332ca2", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "398662c7-c598-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763591803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591803, "uuid": "a9a8065f-b908-49cb-a9b3-094babfb01a8", "comment": "Malware payload (Mirai)", "value": "f0b88e279a5fd2c18a084e88c76838c7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591803, "uuid": "f635acd5-08e6-4b00-9dcf-76414f922edd", "comment": "Malware payload (Mirai)", "value": "dfd25a607524daec552d520132f233d4ef2dfe4ac520f05bd88c29f42f608525", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591803, "uuid": "9ccfd94f-8b79-46e6-8acd-5dcb521df19a", "comment": "Malware payload (Mirai)", "value": "8501969278988e6d8f45d24ebf508ee1504e0dcd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591803, "uuid": "2d6f2122-c70a-4a8e-b61f-cf9d519830cb", "comment": "Malware payload (Mirai)", "value": "10356155430bf77f474eff0e0a9d16abfca0b8fd2c513abce13e2780857259259cb56322971d08a65493e25b816a6080", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591803, "uuid": "27dd9ce2-aa36-4d93-9066-e41e610941c6", "value": "T188A2E155BF1886CFC832293455DAEAD21256FC72F2EDDC096940C16FB4B33A95434F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591803, "uuid": "35c14fda-eeee-4a18-98f9-111df83cbde1", "value": "384:Mg9Lpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAK8:798o08kxofBE+ZkXaqGbp2F2TWul0c5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763591803, "uuid": "57501b01-0031-49aa-b6b9-62b578c73e0c", "value": 21500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763591803, "uuid": "b3896baa-e301-41aa-b6a5-359f8cd5801f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591803, "uuid": "4c520193-19ce-45d7-9a01-452726d1da7f", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93cec55d-c513-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763534832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534832, "uuid": "f834daef-77d1-4d1a-8519-12144f685ed8", "comment": "Malware payload (Mirai)", "value": "56468a1bf43777ee5cf7f119e2b9618f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534832, "uuid": "22252cc8-e6bc-4f9c-a133-029b8f7ceed4", "comment": "Malware payload (Mirai)", "value": "dffa63e861fba54c86569d144841e6bdffdd094e4eaa8bae26e3222ab5deb96b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534832, "uuid": "14f852f2-3d53-4964-9f5a-25364572b8f1", "comment": "Malware payload (Mirai)", "value": "f27147765e78caaa1746e4c7f062ff801bd9e284", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534832, "uuid": "975df6e4-c85f-4586-abfd-813935ad5844", "comment": "Malware payload (Mirai)", "value": "721b94d276eef472b035039aa9ff4df46cc16f277e12db9470ad9f122b7d30f6dfd7b2f91541353f4895d425b037da0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534832, "uuid": "7d448401-03ff-4203-823b-14ea9b97808c", "value": "T1CE631292E8B7E460EAF1A43F947C1CC2BB521EB8D5FC96C05114879C4D728E92B7711B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534832, "uuid": "bc7c8d7d-802f-41dd-aaab-97db942efcc0", "value": "1536:wMcy965wB57klq7+mZ11Bgz5b3cRZzbkkZkfhc4AKRLnWif8VrwEv6RS75l0:3G347l105b3g1bkzHRLEwcqS75l0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763534832, "uuid": "dfab5e5d-eb36-4e76-bbff-53016db75538", "value": 71916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763534832, "uuid": "852b29a5-eb21-4d5c-9656-5a1faef51d84", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534832, "uuid": "9d59308d-8900-4139-81fb-b701365c5575", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e76a3db-c593-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763589718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589718, "uuid": "39bf6b59-e039-4991-b122-f7d37a39267e", "comment": "Malware payload", "value": "048abc2e885a20ecd21570ef0dcae668", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589718, "uuid": "1b377f07-6dc3-4481-adfd-1cbcc18962f5", "comment": "Malware payload", "value": "e011e366a071eedc3182865d528cd3b3bffdd12d4f66a11a6f3c2389c28b6715", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589718, "uuid": "9368ae0f-c50a-45a6-9582-6fa8a1104d31", "comment": "Malware payload", "value": "e292ecb36f290793620822276fa9726b4dcb828a", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589718, "uuid": "8468623b-94d5-4f70-9707-8dce803da0ac", "comment": "Malware payload", "value": "a6f1ebb303efd2e8f7d3b3d2d45ba1b0a2c6e96a1c759809eb782c1a7ba66b87e29d61fdb6fd37116790115633310d21", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589718, "uuid": "3f3a4093-52f0-457c-b5ca-f7b17282a1b9", "value": "T1A26185BA014407716CE26BD7637D404C7092929748F6BF22A7ED28E88D8DFDCBC41667", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589718, "uuid": "1fa85487-d21e-408d-80b9-a853f77c2f88", "value": "48:/oldGVVkDw+oUUPFy+8nJh+JRmHQqL1/2uNQ:/oldGVVkDw+oUUPFy+DJRmHQqL1DQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589718, "uuid": "f2e319ba-d5e5-468a-8511-79fecbddce21", "value": 3180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589718, "uuid": "aa6588d8-9784-4e59-ac22-01a1c105f5ac", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589718, "uuid": "b3b45235-8774-4a80-8eed-79dcbab2eaa2", "value": "2.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebf7858-c557-11f0-a129-42010a9c0007", "comment": "Malware payload (ACRStealer)", "timestamp": 1763564083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564083, "uuid": "c7320057-015c-4cae-8c3d-f3e37a930271", "comment": "Malware payload (ACRStealer)", "value": "3a9c16bd4471b0915e82805fbcf6174c", "object_relation": "md5", "Tag": [ { "name": "157-180-84-234", "colour": "#2E0F4D", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-9818", "colour": "#AA8C13", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564083, "uuid": "ee920802-5e07-43d8-a664-fe770e33c585", "comment": "Malware payload (ACRStealer)", "value": "e0710280e53dab0b8246be43523925f0fb68db5e745c12e804baf58ad8502b32", "object_relation": "sha256", "Tag": [ { "name": "157-180-84-234", "colour": "#2E0F4D", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-9818", "colour": "#AA8C13", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564083, "uuid": "e1d4be4d-14dd-4ee1-8548-c1991a494d4a", "comment": "Malware payload (ACRStealer)", "value": "5cfdba680e1aa8425e04d67d6924db182c481ff4", "object_relation": "sha1", "Tag": [ { "name": "157-180-84-234", "colour": "#2E0F4D", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-9818", "colour": "#AA8C13", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564083, "uuid": "0ac07f6e-5c40-4eb8-9073-f995d47a845d", "comment": "Malware payload (ACRStealer)", "value": "38a3c65b363aba9ef91b79e756964deb436fbeb572538804116626229001f50d14ab9c825cc9230a693382907473c9ff", "object_relation": "sha3-384", "Tag": [ { "name": "157-180-84-234", "colour": "#2E0F4D", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "ACRStealer", "colour": "#281442", "exportable": true, "hide_tag": false }, { "name": "HIjackLoader", "colour": "#19300F", "exportable": true, "hide_tag": false }, { "name": "IDATLoader", "colour": "#936922", "exportable": true, "hide_tag": false }, { "name": "pw-9818", "colour": "#AA8C13", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564083, "uuid": "50019639-f4ca-4db3-b05a-70432a5db051", "value": "T1ABE6334517D59AFA9247A49287387E4748FBAF481D8B6F321EFA3C9C65C33006CEA5C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564083, "uuid": "5771e5a7-92af-401e-b7c2-3d0893a8873b", "value": "393216:FQ7DeiU5u/JvCa6MEtpZ6PJ+0lC3WSlprEjxdi:F5iUsdCaUtpk404WSlSjxdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763564083, "uuid": "d8ce4e55-f5cd-4caf-8182-2fac7d2a4de4", "value": 15237258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763564083, "uuid": "8bae1113-273b-430e-8fc6-1a97adf265de", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564083, "uuid": "9f7e6fae-944f-43b4-9ecb-b3cee74c093a", "value": "\u00ab\ud835\ude88\ud835\ude9e\ud835\ude9b\ud835\ude9c\ud835\ude75\ud835\ude92\ud835\ude95\ud835\ude8e\ud835\ude81\ud835\ude8e\ud835\ude8a\ud835\ude8d\ud835\udea2_\ud835\ude73\ud835\ude98\ud835\ude86\ud835\ude97\ud835\ude95\u00d6\ud835\ude9b\ud835\ude8d\ud835\ude78\u015c__\u00ab\u00ab9818\u00bb\u00bb__\u00bb.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d4eadc-c59f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763594886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594886, "uuid": "d62a6f20-2138-4d45-bcfc-25e8643e919f", "comment": "Malware payload (Mirai)", "value": "9f41cdefe5653ab37cec2ab1df548478", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594886, "uuid": "3b4a5c98-0277-46de-8541-ffaeff1670c1", "comment": "Malware payload (Mirai)", "value": "e1fd997ece10897459dd55a25525af9418b2a9a22241a1823a24fe6284a261f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594886, "uuid": "898d96d3-5480-4690-a5b2-75ea6118bab5", "comment": "Malware payload (Mirai)", "value": "189c2b81c68b6427317b2f34506a4858192639f7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763594886, "uuid": "52fb404f-1722-4462-b164-cca86fe9676d", "comment": "Malware payload (Mirai)", "value": "7677f17f4f320ec5077c7bd37d9ca4381d66fb3685a8cf5d08573f65b5b81ab05a089053fb5049ec73c96a155993819f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594886, "uuid": "b0f7cdb6-6259-4486-80d0-05f1f32077a5", "value": "T1EF23F24340AE9785D49BE0BA5E6CA689413DD50C919083B3DF99961FC24FF31570EB8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594886, "uuid": "6c70ddc3-c581-4aef-bdd2-c424ac959ba0", "value": "768:eMxa+Kqs+LOBSx4rVzFHqZD8VPIOqBxtRQ7AbG6WXzBEbdBqDXcYI5jTNevy+nbr:va1qsBXrNFGyPvGRQ7AS6++bdHYERYnn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763594886, "uuid": "13fc1177-2eb7-49d2-af83-886fda6fe82c", "value": 46920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763594886, "uuid": "24a22b61-fdd5-4afe-88e5-b9531c769698", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763594886, "uuid": "2747b2c8-491c-4195-9d80-7195bf4517de", "value": "S3o.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b086b84f-c540-11f0-a129-42010a9c0007", "comment": "Malware payload (AsyncRAT)", "timestamp": 1763554207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763554207, "uuid": "96c3d822-45dc-4048-95ca-9816a5c23671", "comment": "Malware payload (AsyncRAT)", "value": "1c52636b023f4011e9e59d398f72fbeb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763554207, "uuid": "74d4bed7-3999-4b8f-b81c-73fa91950f67", "comment": "Malware payload (AsyncRAT)", "value": "e4e12e716ba30fc51634078f9cacbff754b3b7081b8b2f2d6b1ae4043a8a00f3", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763554207, "uuid": "b52feab0-91e9-428e-a08a-71d574a46f37", "comment": "Malware payload (AsyncRAT)", "value": "9a503460cb929475a6c82652f36606671d4c2257", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763554207, "uuid": "f25044d9-7b9c-420f-a072-d0cac992d035", "comment": "Malware payload (AsyncRAT)", "value": "ad667acc717f6f93f0f8c4635e9b3026daec079da97868215831c74e695b5be10ccd63d4c53bdcc5af11974a81e6f85c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763554207, "uuid": "99f4312f-d843-4633-8131-5bc570e8ab69", "value": "T1036363883FCBB27122167477385B709AF17F8E64718C4881D67B58AAF65C348E57AC2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763554207, "uuid": "d5807060-f391-4d2b-8e54-ebd101c4bf2a", "value": "768:uyjLT1ZdzkVFATCNmFci3hJf4nu4/1ditdWoAsSBUlZiqTSsi6NN8hOcUmulpE:r1DgFAvFR3kmA1aQs1r8QcUmKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763554207, "uuid": "284ec32c-0a68-4649-8b29-1b9001a4513d", "value": 72523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763554207, "uuid": "f8e3ca87-82dc-4d88-9805-9ffc00996a4d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763554207, "uuid": "69204091-1992-4f80-8317-31513d35aa4e", "value": "New offer.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84c299f-c520-11f0-a129-42010a9c0007", "comment": "Malware payload (Joker)", "timestamp": 1763540503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540503, "uuid": "cc38d281-00f6-4767-a2db-1e95f1912055", "comment": "Malware payload (Joker)", "value": "2bee219d4e0e626ea99d3b0e8b4ead63", "object_relation": "md5", "Tag": [ { "name": "Bill fruad", "colour": "#F95B7A", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540503, "uuid": "e71c84d5-b1aa-45b7-952d-0d1151985d9e", "comment": "Malware payload (Joker)", "value": "e55e4d34bcc03b45c54fe35760dbea412bece7da63242f976a32f3a42f41a5b1", "object_relation": "sha256", "Tag": [ { "name": "Bill fruad", "colour": "#F95B7A", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540503, "uuid": "ccaaed92-690a-4eed-98a3-3359efdab18e", "comment": "Malware payload (Joker)", "value": "7f4373b1432b2ee78c7e2d2af2ddc7ac47ec65e6", "object_relation": "sha1", "Tag": [ { "name": "Bill fruad", "colour": "#F95B7A", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763540503, "uuid": "fa6c18d7-b488-4848-a1f2-05234560ac7e", "comment": "Malware payload (Joker)", "value": "edd55a35c78afc27a7c4f6413999fb68ff61ab793a8e84ffc357d199675487baf264c8eb9892674571d2df48675edfb9", "object_relation": "sha3-384", "Tag": [ { "name": "Bill fruad", "colour": "#F95B7A", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "malware", "colour": "#90B709", "exportable": true, "hide_tag": false }, { "name": "xapk", "colour": "#BBBE35", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540503, "uuid": "97882a28-790c-4953-a1b9-d6d39a9888d6", "value": "T1DFB6018EFB58DA2EC4365033CA5A5273326B8D256A4397B3752C730D24B35D88F45BCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540503, "uuid": "dca9e7e2-ae9c-4cc7-b806-605e43cba1db", "value": "196608:mrjd0+ShhCjOuBI1uPbT5QcAJRCWeWk1z:mrp0xhC7B1PX5SJed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763540503, "uuid": "7475ae3e-63ad-44f8-a7e3-42fd1a438d90", "value": 10432322, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763540503, "uuid": "41bd8a16-f9a4-4f5d-9238-0043d53e842a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763540503, "uuid": "1d2cfd07-e1fb-46b2-964f-76d2cba78557", "value": "Noise+Find+Phone_1.9.7.xapk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd2b65f-c58f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763588136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588136, "uuid": "2eee7451-7024-4021-8a62-bd05f9b42a21", "comment": "Malware payload (Mirai)", "value": "534abf8e5474b6f9e984b61a28113f3b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588136, "uuid": "afe01e92-0d5e-4bd5-b610-a95bd4660e89", "comment": "Malware payload (Mirai)", "value": "e56a9095fe67451db3e0d2392f798f0f9e2bd78e7b13326a16a91d2d5b2c397b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588136, "uuid": "41d1ac78-f463-4e41-a97c-64e8139557f8", "comment": "Malware payload (Mirai)", "value": "423833231336c5e7de40c63239accef083da58aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588136, "uuid": "a0866f7c-88b6-4ddc-afe5-feec1b3acbbb", "comment": "Malware payload (Mirai)", "value": "b2816ddb1415c8b473d5330e6989c8f4a90517cc4040a70e28282b043a75f8466291f994b78c559b1dbc00a143f3140b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588136, "uuid": "00ac1c82-9abb-4b96-a97c-b5ce5e3cebea", "value": "T1A44302FFD4D894C3891EAD7D808D73D81D4647C0E2DE5F4CD21B0EE8BA64A56348DA68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588136, "uuid": "241e9df7-9078-4e8d-a52e-1db5943e55c5", "value": "768:6yE648y+PkD7pBH2+t3HO7hAK44ZuJ/XiRBdix7m5tUD3GISzxVTkNxO7MYWkpWv:e8y+Mrpt3H6b4LJaHdPPUpSzgNSMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763588136, "uuid": "362a771e-4e76-43ba-af46-77e36ab9b36f", "value": 58608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763588136, "uuid": "639f700b-f5d8-47db-953f-83c9a9a1f6cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588136, "uuid": "17c64dc6-c603-4e81-80f9-fba4d62002f7", "value": "boatnet.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23eb946b-c51f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763539798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539798, "uuid": "70bd188d-af9e-43e4-aeb2-62d11d1f4986", "comment": "Malware payload (Mirai)", "value": "99fd25260e2b8e2e6d28c25d3cdb866d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539798, "uuid": "e1abeb2b-bb20-43ea-a631-c8148755dd9e", "comment": "Malware payload (Mirai)", "value": "e5dbc1fff2ab50275f19fd3436ad0c7c641727d47e735335e89e6d6d621a0b3e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539798, "uuid": "73b749b2-3e0f-4b7b-b470-ad389d74a4f5", "comment": "Malware payload (Mirai)", "value": "75e28ae7913e4c9b2672ff6ef99c6e0f03f5e4a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539798, "uuid": "b1c30948-ed36-45ee-a762-6db44c47f7de", "comment": "Malware payload (Mirai)", "value": "db964db23f7bd2070ae12353fbe89c986efd0574b4b08fcdfa596124a4e340d95ec24bdcb7539d7ed6cea5ad9b5a1902", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539798, "uuid": "b775c4bb-f05e-4860-8c80-0693f6441b61", "value": "T118635CC6E787D4B5FD6602786137A73B8632E6390029DF47CB24B93AAC22512F71635C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539798, "uuid": "309c9cec-449b-4950-b864-74a59d14b13e", "value": "1536:FZ3OLHc7Dw+0dWmQD3AYhboUvJAIffLdqgJVln0SIF6Qa:IcLmQ3AYBouJAWzHlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763539798, "uuid": "e00fda93-9bf3-49b1-983f-4736ae047fea", "value": 70644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763539798, "uuid": "0ae5be0e-b000-436d-bdcb-09b0e3249d7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539798, "uuid": "c6cd27eb-3553-443f-b56f-bd438852b11e", "value": "x86_32.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76311dbf-c563-11f0-a129-42010a9c0007", "comment": "Malware payload (PureLogsStealer)", "timestamp": 1763569142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569142, "uuid": "2e9ae028-4725-4076-879b-846f926c09b1", "comment": "Malware payload (PureLogsStealer)", "value": "5e3a14c15c3f19441573607dc804dea9", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569142, "uuid": "d168df93-421d-4f96-be1f-8d7f3a42e116", "comment": "Malware payload (PureLogsStealer)", "value": "e68cbefe7e20a42d764b2e6c4fb1a343d6dae85c9caac0e5788830b2afd1909d", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569142, "uuid": "4a16539d-3a61-47e4-9703-22c7394f43c6", "comment": "Malware payload (PureLogsStealer)", "value": "33f8be954dd8117f1a7eebaa2bd02492472fb4ec", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763569142, "uuid": "8fb1868d-9298-429e-aacd-2c18e6230c1a", "comment": "Malware payload (PureLogsStealer)", "value": "f51d8c1a148d3c2e7420c6167b0fc13dad95970a39e4d1799e209130502c5e098afce87a999264e7bb3e33118f1fb13d", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "PureLogsStealer", "colour": "#7DC8B0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569142, "uuid": "ea618d04-65db-4ae2-bdb1-32676d2ac218", "value": "T1EFC423193B39C63AC1AF113BCE93617272F5D01C5963937C7EA6D300180776EB562BA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569142, "uuid": "40292631-694f-4ad3-b1e0-90527b9912b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569142, "uuid": "e34f0ffc-ad43-42e6-b14f-33db7cf76e40", "value": "12288:3GcsdgtrE0aPQ15EnVBYjkLpBbJynE1yfJIx+IezCL7Qi:2csU/WOEnTCkNB1yBm+I42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763569142, "uuid": "4daedc94-8cbb-45be-8afe-5a575b728eb1", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763569142, "uuid": "870d437c-325c-443d-912b-2ec44ed125e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763569142, "uuid": "cfc79a1b-d9c4-4148-8838-23c603c9eefb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc9d0cb-c562-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763568722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568722, "uuid": "9a5d12ad-1cac-476e-b01f-4556eef89e23", "comment": "Malware payload", "value": "adcee39cba7bede688d7ad8ebc8fb29b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568722, "uuid": "8107e8db-2c28-478e-aaf0-ab13d03eb77e", "comment": "Malware payload", "value": "e771128ae927eae4c2806fdfcb137fc7e19538a2f8d75c0797ce6e4366057824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568722, "uuid": "14b91d05-88c6-49d8-97b9-66a3999f5a59", "comment": "Malware payload", "value": "ab185c0737228247c9307887e171d3ed3b63fcf2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568722, "uuid": "117954a9-e5c4-470c-8f0f-5829325735b7", "comment": "Malware payload", "value": "57d451945a2c6e6a604aa67538d04cabecdc4ce979fb3b15a731d2a4f7a50677ae18b7d80ae3f8bc0877f5a815a1efd7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "unknown", "colour": "#D1F4B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568722, "uuid": "9af3447f-235e-4942-b246-5ddd9b0afc1e", "value": "T1FFA35B5772E900BBE1B78679C9670E49E3B6F81107619BEF03A0425A2F237D14D3AF61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568722, "uuid": "7fc3cdef-9293-4031-8e9d-dde8b004461f", "value": "d0336ef010e6ac0d03368f170d3f02ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568722, "uuid": "dffc15ac-729d-4bfa-8e2d-f784f86bc2b9", "value": "3072:rD2Pfv8FsCwWt2bqIoHns9N10cZImIwZgn:fGH6UO2bqpHo0Hn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763568722, "uuid": "faedebf4-3bcb-4581-887f-bca8b492c9b3", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763568722, "uuid": "7d0d3e8e-a76c-4769-9724-e18aae0a2d92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568722, "uuid": "21084bc2-1134-4624-9d8b-0d50248d1de3", "value": "MyWrapper.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a327ec5e-c513-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763534858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534858, "uuid": "051d417d-d75c-4da5-8b4f-3193b9081e4c", "comment": "Malware payload (Mirai)", "value": "acf8c5d394e08d8c990808b54deb37af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534858, "uuid": "3b865fce-ba8b-4f3b-bcf4-4d6011bea7e2", "comment": "Malware payload (Mirai)", "value": "e7834d671b4ad807ba7bef2fa36863302023e0202a0b228ee75640936fae5dc5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534858, "uuid": "dbb6a22c-f647-4780-a2ee-f66bbc431508", "comment": "Malware payload (Mirai)", "value": "bbdbee9aba681ba6f88aef97c1db2b15149a2b67", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534858, "uuid": "607b76ef-761a-44fc-b607-32c71b566bcc", "comment": "Malware payload (Mirai)", "value": "b58f06955c3f65fcceb17a036e2cce11f5773d88aa8ce73c08d610989de74f37e0a5a50eb8512f852bb43b153ba1f090", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534858, "uuid": "602c35fd-f47b-4271-aaee-dbd329b16555", "value": "T110937DD1F683D4F1E857007121B7F73B5A36F2BB1029DE43EBA89A22AC52A4095177DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534858, "uuid": "ffbf6632-9ea6-44fb-b0f6-d4ed01f633c6", "value": "1536:UXabUXxKBHeSP+jRQn/GSYnEwx2CiqCWyBSqnpuAA4E1J2/u3YAYz0e:FBHeSuRQ/GSerx2ZhWIn9ABn2/3Ie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763534858, "uuid": "7fca7065-0fe4-4637-b9ff-598438aa81f6", "value": 89876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763534858, "uuid": "f1c67f94-ebfd-4a9a-a403-0c19bfbb3734", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534858, "uuid": "83bce4e7-28c4-449e-8d9e-fe398f77be2a", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81dd5115-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589777, "uuid": "99e71322-97ea-465c-8dea-e2ef198acbbe", "comment": "Malware payload (Mirai)", "value": "d465c09d119e8b4afaf8632ef3087a41", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589777, "uuid": "2aeb98d3-ba4c-44ab-a4f8-092ce657f4db", "comment": "Malware payload (Mirai)", "value": "e832159022295b596d98a6c399d989677a1c82d434bb5d6a9242fa8565ac9404", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589777, "uuid": "cccf5281-f854-4126-96bb-2bda467efc34", "comment": "Malware payload (Mirai)", "value": "3af4bf8626362f6730198d247d0c64971d04e16c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589777, "uuid": "5d03a15b-01ea-4a2f-b984-c3cfea51ac87", "comment": "Malware payload (Mirai)", "value": "fee55e920e41ab358f8fe1c3700b24e116d1c09a4c1aa387652a017872adf54b84521c53d720154b43452bf8aacd7a2b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589777, "uuid": "658a772e-a74a-455b-98a7-5401d7a85ce0", "value": "T1ACE3F709BF610FF7E89FCC3705E91B0528CD556732A93B36B634D918B64B24B26E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589777, "uuid": "509d943a-82d6-452d-9ceb-c7bf6b3db2fe", "value": "3072:G/V6WWosd4Bi3u7KGzJtcMaeeGeVlJSnudoyJi6ts1uYak:G/IWWosd4Bi3u7KGzJtcMae10lJiudbq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589777, "uuid": "45b5f17d-844b-4d1e-8572-e3f95ce12c8e", "value": 148792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589777, "uuid": "5377cb20-a8a1-426b-a7ae-8d2a3d398812", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589777, "uuid": "d94f26e0-71d4-4323-8821-852d0de5c5dd", "value": "S3o.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696a7f5f-c590-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763588448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588448, "uuid": "d5d622ea-2be8-4a6c-8643-de66d5e58f16", "comment": "Malware payload (Mirai)", "value": "9b6bed1c920459caa57d86523ab57081", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588448, "uuid": "c4674bca-7877-4252-99c2-74ec04296f92", "comment": "Malware payload (Mirai)", "value": "e836ce0416323c6651d9d15def518983f0c04300282ae77fa335ec009a6adcdd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588448, "uuid": "9d31f3f3-68d8-4282-818d-5240563777a2", "comment": "Malware payload (Mirai)", "value": "7cb4e4d37a5ae2f8049ff5f24baeb36d48423fa0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588448, "uuid": "74ff9a2e-f505-4106-8f91-7303e0553be2", "comment": "Malware payload (Mirai)", "value": "f9f8cac0a4fdb0b4cd924d91f2cb082faf9041989453295da711b97e78cccd73ff6b66984091f9d742bf6c3038d7d3cd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588448, "uuid": "315a2c08-bf0d-4b92-ae73-1a84499316c3", "value": "T1BEB3F70AEF510FFBE86FCD3706A9074921CC691A12B87B763974C52CF25E14B4AE3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588448, "uuid": "89c23357-01ed-4e2a-b8e9-52cb44bd3956", "value": "3072:8afEVA1QBrUWeabY6jM3Co9m6Nvu4w+V+:89VA1QBrUWeaOd9m6Bx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763588448, "uuid": "284235b8-0dac-4086-9904-e200140ae55e", "value": 110492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763588448, "uuid": "2170ef22-8036-40ee-a2d6-51c3e189a003", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588448, "uuid": "f509e7dd-151d-4c1e-b43b-0c89ef5c9754", "value": "mipsel.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40998746-c514-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763535122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535122, "uuid": "576ce378-7d03-43e6-8f8c-ef4ae091372b", "comment": "Malware payload (Mirai)", "value": "6c8575a5571f3a53ca34958e43fb83e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535122, "uuid": "dac077b2-a26d-4257-8429-0689d2f1605d", "comment": "Malware payload (Mirai)", "value": "e934bd4eee249b0648ff4544ef25df8f51bb5e68a71d088d5537bb67705ef2c2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535122, "uuid": "b9c3a6f7-56fe-4704-93be-c5fddc8d4986", "comment": "Malware payload (Mirai)", "value": "8501b01e6cba26420da42a8baf322d2ee3528e0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535122, "uuid": "2c23c2e0-0250-4b48-ad26-1cfcb8393c67", "comment": "Malware payload (Mirai)", "value": "f8fc2de4fdee45c40840946325f7c580d407c64968a50179549914e7af25ac9669e5c199b1becf66f0ff0daf9baeace9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535122, "uuid": "d1dd843b-55aa-4cda-83b9-7ce1b7ebe1de", "value": "T10413025CE1015E83FFDBA9B90C51FB94DFE29BC7221A74D1B1D2AB00256B8421F55EC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535122, "uuid": "5cb50957-3121-4478-9ace-df9f72cf7215", "value": "768:ibEJZAIxfEuDVFpE3xOH5MUyyAXwt/ExaJC196ywLmnGn4uVcqgw09AM:ibEJZ9xfEuDfS3CSUydXwtsxL6ywh4us", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535122, "uuid": "44f08c32-fb78-492c-befb-fc795c5ca180", "value": 45124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535122, "uuid": "b16bbcb2-2b95-45d0-a6f4-db50ba667597", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535122, "uuid": "dada2a58-d821-407d-b6cc-caa068d4667a", "value": "ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e289712-c576-11f0-a129-42010a9c0007", "comment": "Malware payload (XWorm)", "timestamp": 1763577235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577235, "uuid": "d2c23390-28e8-47a6-be67-7b4b3eb38695", "comment": "Malware payload (XWorm)", "value": "67e601580f4a95d475ccbb074a4be865", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577235, "uuid": "1f01ca52-405a-4c4e-b43d-15cef3f398bd", "comment": "Malware payload (XWorm)", "value": "ea4d0f1152384a151faadbb9cc8f5d0b0fbdb539f8fd0535bf2e238d3f132b39", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577235, "uuid": "227998e9-ee1f-4163-8e99-0748cfc27bfc", "comment": "Malware payload (XWorm)", "value": "08b211eb46202341490991ca6743a7799bbdb668", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763577235, "uuid": "0fc875f5-1e27-4037-8c85-c5cf9a233ce2", "comment": "Malware payload (XWorm)", "value": "b0d8e3883ea5b2bfaee848b74ab10767bc233c021a63ea99d05f6e38bcb9ab4fb6f6cbbbd947b2299ca0452b2b64940e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577235, "uuid": "d24c96aa-9d63-44d4-951c-825d28f2daf1", "value": "T15E673331A6D601E4D8E1F4BC4EA6E916C433B14B07F50AEB27C18D5E0BA37B815BB785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577235, "uuid": "9b902c02-15e7-492f-aa8e-64268f4f4c81", "value": "69cf93465332da8596732792693b9ed4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577235, "uuid": "27b5ecd8-1aa3-4a3e-b8d2-66fc28558652", "value": "393216:WhX09DIIrdyxMIkDbMmB5SKNElUotBItXCcDm0SF4squtQfbKm/u38/8MMaZfvw:eXwDLq8Xc7Uot6tD324squtQTMYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763577235, "uuid": "14b250ec-1ff6-44e7-a798-b990612072b5", "value": 32468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763577235, "uuid": "9aec5fb5-dd69-45cd-b3a7-f97b2aff8232", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763577235, "uuid": "1552c6c9-0250-4e16-b2b3-f9c7fffe416b", "value": "libcef.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75241e7c-c515-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763535639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535639, "uuid": "4cc2be5b-1b2b-400e-8f94-02b90b6c8c71", "comment": "Malware payload", "value": "c76be874725f8b47908b617097e69694", "object_relation": "md5", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535639, "uuid": "34bbf545-1df7-44ce-89c3-29866a2d3f20", "comment": "Malware payload", "value": "ea616668e49c375ce476a0d12848b6b464387cc7557c2e3c5c652ed07faf4b70", "object_relation": "sha256", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535639, "uuid": "fea38585-1316-43c9-a9b4-ee714d229283", "comment": "Malware payload", "value": "2bf9e5c36f5a49e7fdb20edbc312e26ec5893362", "object_relation": "sha1", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535639, "uuid": "b17bd0e9-cc6c-43e0-8974-97b241734eff", "comment": "Malware payload", "value": "0e1a5c293bbb4fba66663eb0ffcc5b24a920217526f4042b50b4a96555022d7e9bc275a2dbf31db28327fda792dc3bd5", "object_relation": "sha3-384", "Tag": [ { "name": "9a8fe7", "colour": "#F187D7", "exportable": true, "hide_tag": false }, { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535639, "uuid": "a0d771b9-4883-4e1f-a5a4-8bd1d742c655", "value": "T1E1451B1AF6A611F5E0B9D274D9632127FD7238958338A7DF47809A0A5F31BE4DA3E700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535639, "uuid": "155fe33b-1966-47fe-9150-932d3aa355b6", "value": "54e492bdd3d6051d9c6f63eaf6aac704", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535639, "uuid": "8b2cc8ce-2980-4224-b2ed-84f482994b68", "value": "12288:WRuXwbypisn+xgTUnwn5enHTE33GiPY5o4iR5miXhRILpaWHMVEm+kOOzy:WRQw7uWVokHTE3nuo4iRWLpaFVXz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535639, "uuid": "2003cf4e-5650-48d6-bc57-1f46657b400a", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535639, "uuid": "317f6db9-226a-4b67-8c60-810f01f4a866", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535639, "uuid": "6828d0dd-0207-44f1-8de6-f69b8ae98744", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4e4d86-c513-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763534848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534848, "uuid": "4e5ab9b9-3616-4e6c-8790-a2e9a313814a", "comment": "Malware payload (Mirai)", "value": "efaa9f4769ec1900e411439a01634078", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534848, "uuid": "fecd3395-0918-4011-b6c9-ec57aa549762", "comment": "Malware payload (Mirai)", "value": "ea780d6a58acd74cff3df3ad07aa918634da1e28e8981afb219c5802b62e5076", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534848, "uuid": "cbf149e2-f48b-437b-864f-9521107f72cf", "comment": "Malware payload (Mirai)", "value": "ba224c8115f874c99ab9a2e6bac89a40e17f5842", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763534848, "uuid": "15264864-3b28-4a68-a1d9-d2e96997abb8", "comment": "Malware payload (Mirai)", "value": "ef730707b179565abd9b9d504629d2c10a204d4853093b49ada4f11d003827792d5f851a03ca56e37b499882d1e7aaf9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534848, "uuid": "e8b281b4-a8c2-4f75-94ab-16d25ee73e6d", "value": "T1A0B33A56BC818B21C5D612BAFA2D118E331317B8E3DE72139D105F243B8796B0E7BE56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534848, "uuid": "16ba5ef9-01f8-4249-b703-f14a6c5b6f0e", "value": "3072:L2ERXBOiP6XKYKSASaHwMWHI0Ph24WJyg:V9oIMKxSLaYDPhkJyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763534848, "uuid": "29823dcc-d2ce-42a5-94d0-6014903d409a", "value": 113612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763534848, "uuid": "29ec0ff9-26d2-413b-b4f0-23a57ebc730f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763534848, "uuid": "64ad3147-7040-4dd6-870d-6102db77cf54", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed84db1-c514-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763535119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535119, "uuid": "c3d70fff-676c-4246-acd8-004ce782c2d9", "comment": "Malware payload (Mirai)", "value": "8a57217c5087c802cffacebae31aea66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535119, "uuid": "0a62be53-d0c7-4f06-9740-c4030565f7d6", "comment": "Malware payload (Mirai)", "value": "eb234b773474fe81f4a1efd13e42b9e8bdff78d96313e67fba003ad30098dd42", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535119, "uuid": "9d0be0a7-b2de-463a-b9a6-b70350531797", "comment": "Malware payload (Mirai)", "value": "d31710e96211a899f0b1e8536156a05cd2060502", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535119, "uuid": "2075ebca-bc15-4d6a-996e-59b1b40e7e70", "comment": "Malware payload (Mirai)", "value": "40b1388ee7a0f9d5d3c97a33a2fb24eb5a2134e125ee39f608cf39af28a4bef4c3579d78301d30f014802c8d0cfb94c3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535119, "uuid": "62212912-86fe-47c1-bb68-07d60a2141a2", "value": "T19893AE36E8162D20C095457074F29FB41FB3A28182931DFB6AF586A958CBD8DF905FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535119, "uuid": "f2710068-3df0-4a50-8fcf-32a316684435", "value": "1536:cqjea0QNhMJQ4OuL14G9I8guaAKry3bj7aYn6SC2t/dY/l5DF:cTaCW4OuLmt8ghHruLn6SfqN5Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535119, "uuid": "026720db-fa8a-4701-8fd8-3bfef7eb6295", "value": 96696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535119, "uuid": "3d4db479-69b0-4c3d-8946-4b63c2462340", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535119, "uuid": "2344f240-0f4a-4740-93c8-c423348670f8", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c5b9d6-c58d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763587234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763587234, "uuid": "ed6031ac-0f94-4412-bd97-4805e81299d9", "comment": "Malware payload (Mirai)", "value": "69bf5f3aad3c46976b94caf315a50ea6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763587234, "uuid": "ca38ed05-28c6-477a-8d7b-2a459dc1acb7", "comment": "Malware payload (Mirai)", "value": "eb2d87be251b4b7373ffd5d57fb3951949130e85b8447c64b9fe633405c95ca2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763587234, "uuid": "109b94a8-3dde-49e2-b5fe-8b3ebaeb8b7d", "comment": "Malware payload (Mirai)", "value": "b2a0d5f8b3657068c5ca0739f2e1467f4625d813", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763587234, "uuid": "22503ade-0cfe-471f-8902-8f7a10e2b252", "comment": "Malware payload (Mirai)", "value": "9e00f154d7d3b85170870fa433cdb0d3e1c1aa26566997a3bbbfdd0418721342d6803fd11dd4bc1de05441be2b1f9af9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763587234, "uuid": "128b3367-f29b-4b3b-8b8a-cbca57a2fe37", "value": "T1C30302B7F1E3EB61D43F6233392FD3053574D94BDA914DB61AC4B40E8881B2AB355492", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763587234, "uuid": "849394d5-2731-4761-944f-9032d2bfa96f", "value": "768:NMWh8qRG+jW4jVWGR/4PflZ/DAZl+8OcjCHfyO4wt1LkqklJnbcuyD7UoQRjYG:N3eq4wWBjr4/rCH6O4wdklJnouy8oyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763587234, "uuid": "727ef626-921c-4733-b989-fb262c48b343", "value": 39964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763587234, "uuid": "9b01b260-1e8e-49e5-aedd-5ba4125fd48a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763587234, "uuid": "2df964ab-d366-4e10-8375-16efd35d77e6", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a160ee94-c50b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763531419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763531419, "uuid": "f3b71547-b89e-4bb1-b2f8-5c10636fc23f", "comment": "Malware payload (Mirai)", "value": "1084cf1227a5363f8feeabeda89b37b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763531419, "uuid": "8026c5a3-c79a-4c2e-9508-92e6ca00b049", "comment": "Malware payload (Mirai)", "value": "eb41faf206648350705a69ae7a85878e3f9d0a611da4713ea4fddb4a2c9ec41d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763531419, "uuid": "d2e9732c-6f77-4b3b-a69d-31fa07c742b8", "comment": "Malware payload (Mirai)", "value": "cd90b5f1759c3c06ef85740feda060c48ae64d78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763531419, "uuid": "a2a4d775-3fa7-4d88-8aec-960e915e87cb", "comment": "Malware payload (Mirai)", "value": "8d3f9e71f0026c3ae984fa1170002d02ebcaec5807a49eb12f78e082bc02cef3824054f10687fd12c50ec3cbf7330288", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763531419, "uuid": "e198e000-da42-4b94-8340-25792d921942", "value": "T17183F74AFD819B15D9D822BAFE1E028D3353577CE3EE72039D115F246B8A91B0E7B901", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763531419, "uuid": "43fbcc4b-5b8d-4372-9f24-24fce623fe74", "value": "1536:59nuSSA46nolj56mmqNVVidvMFhKfCip78VMiM9l3SiUXpQbFD7ug7R:9SJ6i56m7NVVidv44fCip78V4QXpQF7r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763531419, "uuid": "130cefc4-d50e-42b1-af33-144f67f43c4f", "value": 86356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763531419, "uuid": "8134f976-436f-4758-bfdf-46348c77188f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763531419, "uuid": "8fa6c79e-8c87-4ef9-8977-c33bf40f0050", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5fe28ea-c55b-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763565786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565786, "uuid": "1b643fd0-4c0c-443f-baad-aada1047edd1", "comment": "Malware payload (Mirai)", "value": "4e69f436f79724b1f10c7617793f10d5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565786, "uuid": "71e7fec3-0181-4b1d-99b9-bfdce9ba110f", "comment": "Malware payload (Mirai)", "value": "eb6cfe1ebb350358ea29f2fde3d71112a45323621d07a0800a6784b3cb192c44", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565786, "uuid": "13eab20b-7bc2-43aa-971f-1b044ac85692", "comment": "Malware payload (Mirai)", "value": "a9acdd85558eaeaa936df20264068130bccb49f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565786, "uuid": "53a621da-9576-419c-99f6-b78810ac2a78", "comment": "Malware payload (Mirai)", "value": "f0ec51a2eee42b6340a6c45884d11c20f6b13c6fb3f2dbf38fdd421c072affee52d7d849bc631f15d417aa4c368696ef", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565786, "uuid": "fa990e6e-3ea8-4bca-81b6-76cb70b7e250", "value": "T134833942B9819A17C6D452BBFF1E42CC332653A8D3EE3203DD156F25378A92B0E7B651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565786, "uuid": "1b2d9aa3-c837-4c9e-b006-bb3543619868", "value": "1536:N91CAm7ZKnMEYGCkQY87PywyeluVJq9jm7nGzGv9ug7Rck:N91C4NNQY0ywyeluVWUL9ugKk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763565786, "uuid": "d3b84e48-0e42-46fe-8fe5-72a019f6df4e", "value": 83108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763565786, "uuid": "80ae29ca-6a64-4cbe-9ecd-adb73c94dab7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565786, "uuid": "c9c0c2dc-aa70-49af-aa0e-e14c337f9feb", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f38f8d5f-c587-11f0-a129-42010a9c0007", "comment": "Malware payload (MassLogger)", "timestamp": 1763584814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584814, "uuid": "4664a74b-77a7-4531-8c20-8e3fd4eb57b5", "comment": "Malware payload (MassLogger)", "value": "51bf7edff7bc07be8ce3a0da6d6f6b8b", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584814, "uuid": "25be9123-6eb3-499d-bb07-fc72f0c84c02", "comment": "Malware payload (MassLogger)", "value": "eba40ba1697dda977da954e111df0bec1e3a80d0d207cb5c165f7415e7b83903", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584814, "uuid": "4eae2059-d55d-4faa-b270-d0e584c1dd5b", "comment": "Malware payload (MassLogger)", "value": "5a512563686eed6d2bcffdfee15ca44562184b85", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763584814, "uuid": "6a515356-1fc6-486e-b726-4c2000432e58", "comment": "Malware payload (MassLogger)", "value": "92bcfa8c97705fd7988361b790c913d32a27b7cf34803ba9e479ae39155cf1dae880e6bb9370c0f44d33c260685c174c", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "MassLogger", "colour": "#D898C8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584814, "uuid": "5c868305-7b60-40c7-851c-c511af273a10", "value": "T15F46338CC14950CFE3E96A332D1A7A972726451B94B922CCD56E5400EE7E26EDF2FDC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584814, "uuid": "3b6b534f-8f82-43b6-af00-e8328e79134d", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584814, "uuid": "3697722f-1e8c-4717-896c-7b788e796b1f", "value": "98304:583b33he29zc52IoJB7/yi5nhljfMzYvOIo4fjit1sk+euJ/u+42eT:5YHdzkmJBzx/UrIlfjitak7m42w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763584814, "uuid": "03342cb7-ec0a-44b7-b70d-c213fec7f40e", "value": 5757440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763584814, "uuid": "7f3d7b67-8d3d-4f15-a486-155c0b73ec67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763584814, "uuid": "4e8463d1-d7fb-44ab-9a53-dc52b841fb6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a783d8-c572-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763575637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763575637, "uuid": "ed29a9e1-322f-4141-905e-d223cac90789", "comment": "Malware payload (Mirai)", "value": "e61efbdecbd3731ffb3ff8c196eb3d10", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763575637, "uuid": "8b36a2b9-8a9c-489b-b059-fbf7e73745db", "comment": "Malware payload (Mirai)", "value": "ebfd963cd7ec7d3bbcef53a8e3733220626a380015859ce785643b76fee643b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763575637, "uuid": "4365fe1d-1d5e-4a06-88ff-1384d41aa80b", "comment": "Malware payload (Mirai)", "value": "405dde222a6be261d01d36c4c0ee15cfe1de54df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763575637, "uuid": "3c968bb7-d86e-4999-81c1-a50eed51d7ce", "comment": "Malware payload (Mirai)", "value": "125a9ef8e5fba78a8436ac936468fdc216247c7607bb37bcd461402b4d88f61f16168f2462615b66152b617bf279ead0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763575637, "uuid": "009fee40-4c39-420d-a329-09e9972a1edb", "value": "T114835B22793A6D17C4C4A47B21F34724F2F1574A21A8CA1F7E724E8EFF24A502257BB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763575637, "uuid": "1d01688d-fd46-42f0-b1f9-5f3fbe829bcd", "value": "1536:s4oSozNG7KgPqd+8ZeLc9tqNHThTIFJ/tx1Y65Vtgq6eQchMT:Ftf5m+EYc9EltILD1YK8q6eQjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763575637, "uuid": "bcfa2109-cb89-44d8-8bb1-b5feea266101", "value": 84560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763575637, "uuid": "52b5d531-9936-463c-a98d-685919a8e9d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763575637, "uuid": "16d67b5b-07a3-4937-bb7a-543d9852a9bf", "value": "spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070fc45b-c4db-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763510544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763510544, "uuid": "b95776cf-357d-4c58-a079-d7ceb499cf9c", "comment": "Malware payload (Mirai)", "value": "3dfd11e7586037c8a5013e5db006bdb7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763510544, "uuid": "fcde51e0-d2a9-4787-91fc-d73652505c26", "comment": "Malware payload (Mirai)", "value": "f02ce710874cd773c3c32730dc2536d14f4e419bf828d4a27664a24af5d4484f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763510544, "uuid": "303bfffd-d44c-43b3-9f7d-dec3e21c303a", "comment": "Malware payload (Mirai)", "value": "df1de2c951ac3ca433fcc461ea4302e1f684dcfc", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763510544, "uuid": "fd2bce35-e25d-4070-9704-59910dc8650e", "comment": "Malware payload (Mirai)", "value": "c494988e8133f6abfc3a8435f87e9047443da03b5adb5f7d456d6dad5aefad4ddaf9afea20cebc43c45a86dd0655bc5a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763510544, "uuid": "fea4ca26-7ef9-40bd-a564-5352d29464ca", "value": "T185045C02731C0907D1672EF0363F67E193EFD9A124E8FB45650FAA8A9176E32154AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763510544, "uuid": "36dfbd38-de67-4fb3-92db-f253c7ef1e53", "value": "3072:MOgMiipkdaxZhRW1FvCpp0b/ARxwP5FO0XExRk8OLH:xgIiyxUFO0XsRZOLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763510544, "uuid": "c6da3ead-639a-4af1-acf2-8527b188b658", "value": 176956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763510544, "uuid": "8f27c302-49eb-47cb-8f12-7a64fa2382a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763510544, "uuid": "e491df90-9b29-4d35-a45a-c6f20003fb20", "value": "Polar.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05c8986d-c598-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763591717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591717, "uuid": "cdee8f5f-18b8-4b9a-96eb-d7eb3216a724", "comment": "Malware payload", "value": "9e524d1228d162d76e8cdafec44a5761", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591717, "uuid": "bf39edac-3401-47fd-958f-1418c701e272", "comment": "Malware payload", "value": "f0a9cbd8743d6cfcbf9801ec38307355944cc74e5bab69ff386fc451d80490ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591717, "uuid": "a27252dc-6f50-40ef-864e-294d8f4b8a6e", "comment": "Malware payload", "value": "dba29f413e54e59c9ecd4102a15a93abbc53e5d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591717, "uuid": "1a121790-797f-4c8b-be36-58dd61d7764d", "comment": "Malware payload", "value": "825ab2d3a325f274f7c235410b3d6cab69798160e31a3fa01306721fde241cc2c5a849e7b64ed356be76adee87cbedfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591717, "uuid": "3479b173-366a-45ec-9c32-93d5cec7b2de", "value": "T17A66BE1993E901B5E42BDB38CA25C333DAB0BD929635C14F095DF6062F739628F2F625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591717, "uuid": "ecf39314-1705-4aba-90ae-233b98a6db7d", "value": "db81660b49cb9fc688fc410f62e94d7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591717, "uuid": "93221edb-197e-4c4d-a023-112c40ccef7b", "value": "98304:Jmkty2WnXOHG8Jpr+ZOgtdgpXuY65SRhd4v:JvtPWnemcprqOGdg5u35SRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763591717, "uuid": "e96b2bd5-c138-4c60-ba39-4d286cde80b3", "value": 7024640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763591717, "uuid": "ea6f6ffb-94b1-493a-add1-34bda77aecca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591717, "uuid": "af63ac63-60e2-4d8b-9588-76cdd655dd88", "value": "ENQ DB9002M ORDER M24093 2025.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7890499-c58c-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763586941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586941, "uuid": "fcb5766a-4fac-48f8-ba0f-7c7ffaa40437", "comment": "Malware payload (Mirai)", "value": "eeb3faecfc5aad5267df3f83a65af929", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586941, "uuid": "1c1dadeb-e9f1-45be-b24b-cca66e3297ef", "comment": "Malware payload (Mirai)", "value": "f0cda14738b3e5c08f7086f9b3f2eaffaa9104e214b7bd4983a75fb8ca3c04f2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586941, "uuid": "34a2bcd6-98a2-4131-9895-5e1c1143efe2", "comment": "Malware payload (Mirai)", "value": "576d9c15e92257d12bfd9c6d33dc05de07d1f5d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763586941, "uuid": "4e8f303b-e42f-4969-b8f0-1343f2d3dccd", "comment": "Malware payload (Mirai)", "value": "4c405460a1bce723dcb48cafcc41336ad46bbd93d6f906dbba7a38eb1bbbb148ef37def5919419016f02bb6acb8f019c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763586941, "uuid": "545b2596-d134-49c2-b1a0-78629ab7f81e", "value": "T123B37DC9E643D0F5EC4701302276FB37AE72E9BE3228D993D3A89A327C11641D456B9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763586941, "uuid": "0cfc0fa7-784d-4a1b-93a3-75e20e60493a", "value": "1536:wRJZkUKQXtAPADMY+D6DO8urAUsPLbRdmzjM8XSr82rh1bEzaF3SV1:ykUEooY+GDO8xU+IMOS42tRET1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763586941, "uuid": "c4577f31-fec2-4b3a-a988-345355d562da", "value": 107796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763586941, "uuid": "29abcd89-3dc0-496e-825e-3cc1c1753238", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763586941, "uuid": "397b4702-132b-493a-a048-f1c89c3d38e4", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ebbafe-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589724, "uuid": "92471fd8-329f-4076-8f8f-642c20b0d1d8", "comment": "Malware payload (Mirai)", "value": "a718a9fefd97e0cbae7524c0b1c67667", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589724, "uuid": "47977c5c-675b-4676-bdb5-692f4d314400", "comment": "Malware payload (Mirai)", "value": "f1e6fa418e385868543ab24275555cec3a9dad61de3126acb0373a784d6172b3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589724, "uuid": "b30df30a-7d8e-4de1-bcdb-0272637b6cd9", "comment": "Malware payload (Mirai)", "value": "64aadfbaab516e778d1d3e2cac450b3b4ebd8248", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589724, "uuid": "4686a37a-627e-4040-990a-61a97e0bb29f", "comment": "Malware payload (Mirai)", "value": "69948cf413bfa759055e9562d9977a05fbc886097cc66c2eea40cfd6897687bd6093b1d7f2aee97067d649c517294d0a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589724, "uuid": "eb812a38-ac1d-4479-877e-371f7109d2b9", "value": "T10EB36C22B8391E27C4E0947B22F74766F1F557D924A8CA0F7E720E8EFF255502607AB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589724, "uuid": "4128ca91-0329-44af-8934-39fb47f3eaa3", "value": "1536:5DEE6oLRjgjAa/T3iA7PDNxo9iZhmCr4MnxoL2CKu+raq6BHtDEYm5w4cNJKtD0+:FScepoCr4ZWu+K9FEYOdl0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589724, "uuid": "f381adab-ab78-4607-9a3c-a56df92ead6a", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589724, "uuid": "d36a5548-3796-4a35-97b6-571a0fec6bd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589724, "uuid": "47b34392-e71d-4799-b4b5-ba4c6dcf187d", "value": "S3o.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba0aa253-c54e-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763560236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560236, "uuid": "f80a2bec-0d86-4d74-9386-69e7dbd90d47", "comment": "Malware payload", "value": "502a7861687e109005c4463762db552c", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560236, "uuid": "c4d5492e-a70d-45a0-8361-9f2bc2398fc5", "comment": "Malware payload", "value": "f2190261a7b1b38c738fb58b30dfe7a1934c4a43132b2758d821a1233002ad98", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560236, "uuid": "93041a97-4c2a-40e7-8ceb-9f9d807c1a84", "comment": "Malware payload", "value": "b1c754ee8cc187925304af22945004dd290cb421", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560236, "uuid": "d810d5ca-93a7-45da-b1cc-7d05e1d2d600", "comment": "Malware payload", "value": "5964ed5d67127e26538ba1addba6106a8fb2467f85f629ba4966e5483000363b89106fbdf12447cde78f02e58d254565", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560236, "uuid": "1c530e42-e6e0-4adc-935e-acde465401af", "value": "T12E128C04C175851106AFBB31EE104F089229F79F67729EB87F6ED443A1E51AACB711F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560236, "uuid": "ed70ac57-f264-4b4c-837a-9b0d1eb8490b", "value": "96:2ItVZQ0o8twQbY38ELS8zBlN3havX28qjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj9:2IFQsc8azqgNRglJw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763560236, "uuid": "68e210e3-6181-4b2c-94bb-adab697b6b6c", "value": 9324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763560236, "uuid": "0e8e343f-2f2b-4663-aab1-9f1e8fea434d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560236, "uuid": "fa57a8fa-6401-470f-b76d-a3e847fb6e8f", "value": "Invoice.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e77f1a08-c52a-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763544851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544851, "uuid": "5ae7a99e-09e5-465d-9b43-bd7c2b89edce", "comment": "Malware payload (Formbook)", "value": "40e5eec2a926f39e67e6fa4b3d5915a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544851, "uuid": "287cc619-62d9-420a-92bc-3357f58c325d", "comment": "Malware payload (Formbook)", "value": "f231f3ace931fcc753eb4dddc25b63541df30f33cf3cb840dab6629a4a0ad2a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544851, "uuid": "e3e58ba5-9f9e-4670-9b15-4df7ed359041", "comment": "Malware payload (Formbook)", "value": "9cdfa034dae02f3b82a0138bc5fcdf46474e562c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763544851, "uuid": "385d52a5-523e-4300-916c-29e3d09f90ee", "comment": "Malware payload (Formbook)", "value": "a4f9c3faa619b5c72851e468bdc3e6adf162cf2b3cb9dd828d8f248089deb89d310c7a990c04d23c7cbb5f7717c69faf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544851, "uuid": "1423c4b8-c015-45fd-a042-1d74e1a0f632", "value": "T11EF402142146DF03C4931FB419B1E2B0677AAEDD9522D3178EEA3DDFF86AB452A40393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544851, "uuid": "a4ec8176-2673-48b5-aeb6-8feab7b43faa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544851, "uuid": "b115944a-46f7-44ec-8094-4bc5537cd8a0", "value": "12288:vRg0fRec0YJrDHAEWDXxMFQq0fTUeN4FQis4fR2JgT9zs3TipnpUNfViQzJJCUPC:FptDxK3F4FQocJG9Q3Tipnp6fViQzJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763544851, "uuid": "74e7a011-9bbd-4395-9468-9deb3bbc3a0b", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763544851, "uuid": "e423c31b-0c70-4a80-a846-b3341bf167f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763544851, "uuid": "9330ae72-1fad-4501-9cc1-73cf12aac09f", "value": "PO-0839380292.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55a80de-c575-11f0-a129-42010a9c0007", "comment": "Malware payload (FleetDeck)", "timestamp": 1763576952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576952, "uuid": "7b435ad8-af9c-43e9-882d-7efa5f2a67cb", "comment": "Malware payload (FleetDeck)", "value": "6769ea1a7bddf69c50db9191e2ba4fa6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576952, "uuid": "0bbbdd8b-2f05-4ec7-8988-cc86d80f93b6", "comment": "Malware payload (FleetDeck)", "value": "f26b71bb441c255e53013d93e60d0ee0ecd98c32a4a3c6c94ed21efbfc51cf1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576952, "uuid": "f118787b-db15-4f00-9f44-276999be4298", "comment": "Malware payload (FleetDeck)", "value": "77979c25243f4306f9dbe8dc8353853015c28913", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576952, "uuid": "af345a4f-6f30-45df-8462-f44e13d361ae", "comment": "Malware payload (FleetDeck)", "value": "74d44942d5d061d85aa7fdeac0bba24c08842c2ed4d5649eb3ac42dac0e1c60b8c5dae8513bd072703b18e415681e106", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FleetDeck", "colour": "#B10F3D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576952, "uuid": "058e0f4e-565f-406e-9e99-50532eddb165", "value": "T17116CE50FCDB14B5E603193158AB62BF2735AD094F35CAC7D6407BAEEC73AE10936229", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576952, "uuid": "cb912984-7822-4e27-9f77-7d529e1f4c48", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576952, "uuid": "a334fa12-20fe-4c9f-aa70-ce88449e75c5", "value": "49152:HP0dfmVfyr+CU8D1cuwaH6ylh1XzKxGD2sC/d3aUVJiuX7c+PzbMDpIJLKo7snU4:HPtZAl3XzKnaIcDgRjOlr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763576952, "uuid": "59154f35-2e70-4c9a-9540-8ba748b741af", "value": 4398512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763576952, "uuid": "bca61e76-2068-4694-9c1e-e5272086277f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576952, "uuid": "ca91f734-2b96-4dae-bfc0-a353f686664a", "value": "fla (1).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8690ce58-c58f-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763588067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588067, "uuid": "a8c1c2dc-d18f-452e-95f1-5c6c5d0dcd4c", "comment": "Malware payload (Mirai)", "value": "0b4d98a68128689a4544fc5a95991c53", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588067, "uuid": "e1302106-5354-4b6b-ba84-197885d34f81", "comment": "Malware payload (Mirai)", "value": "f26d839518208cec62e6655e5ce7a3b858bec1f06bb83940064fbfc8015a5dd9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588067, "uuid": "73846cbc-1a93-4549-a38a-0addd44190a4", "comment": "Malware payload (Mirai)", "value": "bbc45b3a1c8b60d28b990a5c002e99db3f3c96c0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588067, "uuid": "c9fb427b-cf94-4e51-885e-28cdd59ecca5", "comment": "Malware payload (Mirai)", "value": "35517a659a54d72a1c71ab75cd8516e144bbff1141effe5f8d4116d2dcf2d89b02cc958ad05b412ce3765a09487d8e9f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588067, "uuid": "2cbe41b2-3f87-4383-b3dc-06ab8b2d3b49", "value": "T1EEE30946F8819F11D5C211BAFE1E124E37131BB8E3DE72139D246B647B8A87B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588067, "uuid": "5e7a4436-fe85-4b33-9603-1667891f987d", "value": "3072:gxkd1pIMVSeFXORF68oF6HCug5qSa9cTb:gxkd1pVVDXUroFj5qSam3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763588067, "uuid": "99dec04b-4e95-4a71-a985-947dd7ecfb4f", "value": 154448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763588067, "uuid": "542d01f8-2749-44b4-8201-b81ae922a555", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588067, "uuid": "33a58fc9-6f84-45e8-9bda-651439a6b45c", "value": "boatnet.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a52dfa-c595-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763590485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590485, "uuid": "7441a408-d47c-43b3-965b-20429fd56667", "comment": "Malware payload (Mirai)", "value": "804b746d149bee3230efbe1b0e0ee630", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590485, "uuid": "bd7a9488-b829-4371-b3e6-ad7a7657a88e", "comment": "Malware payload (Mirai)", "value": "f3f6b0ceeabc8327379bccf1b771582d3def5a31b8fced83981863e4b54d3232", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590485, "uuid": "47bca2fd-2737-4309-9396-00dabd3154f6", "comment": "Malware payload (Mirai)", "value": "4dc3cfcd84f3b24cfefa9e64f50959cdaae5d188", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763590485, "uuid": "5865a3e1-b97b-44bd-a8f1-de6ebd2b90be", "comment": "Malware payload (Mirai)", "value": "a3f6b9697d8294e1d3505d07b44dc81104b4cd90498a55caade36695a616a9dbcbb1c4bface058585af34a84fd780ba8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590485, "uuid": "86eed357-d411-4a29-a481-b33c2a5c8a85", "value": "T18F3302532B84A4B9C4F478BAC93945710AD11E48ED7F204E0594C37A73E7DAE66FF288", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590485, "uuid": "bf4bbd31-582b-4d85-a4df-518e1c2a3812", "value": "768:bDCyEIaPXIDwy4OwDvtjc8g8nlS9i+AcUyiuCqMaMPpbT8k40r3UUK3UWB:bDlBOXIDd6DFg87lmi+AbzaMj3UVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763590485, "uuid": "1cd2b1d6-7a91-4ef7-9204-a951588c7841", "value": 54140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763590485, "uuid": "fa9ff2a2-4af9-49c0-8290-028defc26458", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763590485, "uuid": "1ab8569c-f17e-4e80-a4a9-a312ae6c7e83", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e996261a-c596-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763591240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591240, "uuid": "3c5b1ee1-3916-4c9f-a161-622ea90bc2bb", "comment": "Malware payload (Mirai)", "value": "b4cb4d0b2c6db56e15e5e84c7a61d13e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591240, "uuid": "9052bc06-8442-4d94-af79-b79abadd185c", "comment": "Malware payload (Mirai)", "value": "f4b98ae33b05968a5b336a658ef5a771b5143d2178906c240916baedb9e16952", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591240, "uuid": "b38cd861-b2d4-4f10-a8ff-b27a1cde9573", "comment": "Malware payload (Mirai)", "value": "19cabb3eb297786ba554281b4593201f3799a182", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763591240, "uuid": "89f89e1b-d628-48fd-82e8-4244e265361c", "comment": "Malware payload (Mirai)", "value": "517189017a98e301134f8031ee439d96bdf29f237b126648fd4df01e88e03aad2ce0cebae8c17d874e9e7ecdbbc9cff6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591240, "uuid": "8a0a6fec-71d2-4dd5-adb9-b26fc69bca58", "value": "T13814A81E6F228F7DF6A8873057F78D21976C33D626E1D685D1ACC2101E6029E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591240, "uuid": "bb0615c4-fd16-4705-937c-ae8a3ccf8215", "value": "3072:U6W9P5rprBprrnlZk3UvAQheyqVEIV5KauuSz:aP5rprBdZZkkB9q2IOaujz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763591240, "uuid": "33228dbb-e1d5-4b01-a03d-79237608e444", "value": 201900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763591240, "uuid": "3b85f28d-90c7-4618-88e2-2d96a0d8b387", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763591240, "uuid": "be6a0496-543a-42da-9d58-39cbcf97af13", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74f4b28-c575-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763576955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576955, "uuid": "bf42b8e6-7f6d-4dfa-ad2e-467f90fdaf6d", "comment": "Malware payload (Formbook)", "value": "70f977371b031b70f713add12b95068c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576955, "uuid": "d17523bf-d03a-4fce-9c47-cb7d47ec2c2b", "comment": "Malware payload (Formbook)", "value": "f5f204abd013df53417dc0c0a9e3ca0b4fabaf855d09278ae77a5312921cb8d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576955, "uuid": "a95ba344-0339-492e-a8c5-eb554167fb79", "comment": "Malware payload (Formbook)", "value": "83b3f75b6c06a15f0bc37329901ef2453279d830", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763576955, "uuid": "6f70eb12-ac74-4620-a5f7-036b6f70bdba", "comment": "Malware payload (Formbook)", "value": "62d86751258aaf4bf8d70e29689d351ee74ba612926599e9d93cde61cc9c5b544d326ecad2917c1f0221ddadfd17b330", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576955, "uuid": "c0a30a29-4d30-49f5-98ac-487778e68848", "value": "T17BF4230DB769FEBADB1D4BB68112502442FA9406A43FF21B19DA74E10D2D7C8C44EEE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576955, "uuid": "5a2804b5-0be1-4a97-bcdb-954c6befc959", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576955, "uuid": "16520c9b-98be-4758-8bd9-d3ea03b5e550", "value": "12288:eSbKwM2TER9MdVNBqE3Q3luT6qtPxpcueU94pZV2XQxqv4K62ncckO6Px6CBpYG:7LBAR9yVaE3KcTjt3cun4piYWLn6xVB/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763576955, "uuid": "1dbe7d72-5de0-4a01-911f-16826f6e9886", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763576955, "uuid": "850d3105-9377-4f7c-abca-62591e43df59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763576955, "uuid": "b1a3b109-6983-45f1-8630-734b7c86bbb5", "value": "xrt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9faf29-c561-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763568190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568190, "uuid": "6ad17862-4f92-4a26-8f8f-008e376314c9", "comment": "Malware payload", "value": "00c16952d9fe3bc9db7ab03ce734765f", "object_relation": "md5", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568190, "uuid": "89221355-f440-44fe-a0ab-d5efaaab0bdd", "comment": "Malware payload", "value": "f8a21f5a7a57b4e75d5ecee747787cb8b7c514f4bcb2cb829778c0ed1afc80be", "object_relation": "sha256", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568190, "uuid": "23a74cca-50fa-405c-a394-cf4aeb8e1cc1", "comment": "Malware payload", "value": "a7c439454d8285e4aa618586e6bfc8f285cc4b3e", "object_relation": "sha1", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763568190, "uuid": "b05fbcf7-ab88-42ac-9fb9-be7e11fbda6d", "comment": "Malware payload", "value": "afebe94025b758e3737e28d834b94eec695a317bda0dc481997221c0493e59bb0e08a464a6741d2d8f071dbd2f04a8cd", "object_relation": "sha3-384", "Tag": [ { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568190, "uuid": "76d04ef3-d429-49d1-87ca-16bf38d664fe", "value": "T1AD01DB8C82505A53A34CCD5FB793446E022EF7C9741E1BD0F6D9EE6C8680BCD9019AB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568190, "uuid": "a5d70995-ee2b-4440-bfd8-0f2786546f27", "value": "24:KOQyS1bbzBZ1npLOf8liA4zqlsoJoa1bycr:K82hZ9pPiA4Ajr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763568190, "uuid": "a441390e-797a-49c7-b14b-090dbe24ce14", "value": 782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763568190, "uuid": "9e094410-240e-4a8a-8118-3788423fc384", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763568190, "uuid": "9d356d06-c9bd-45f1-bbb5-423f20b69b2f", "value": "curl.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7bcccdc-c557-11f0-a129-42010a9c0007", "comment": "Malware payload (PureCrypter)", "timestamp": 1763564178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564178, "uuid": "a72090bc-0a2e-4287-ba3c-260d2b06b59b", "comment": "Malware payload (PureCrypter)", "value": "0d484816fd43280c0c72d56453fcedb5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564178, "uuid": "fcb55db6-10cd-43a5-bc37-aa7066ef09b4", "comment": "Malware payload (PureCrypter)", "value": "f9a6fa310bd121a3c0764b15c0fd14c10eaef637a440d92c8078490e24d45cac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564178, "uuid": "66fd4431-2939-4d70-8105-0c3a97cd4927", "comment": "Malware payload (PureCrypter)", "value": "02e9d3c3f2c31538eae874eed1bd8b49cd35fb43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564178, "uuid": "cd383155-4c1f-46e0-9c00-9c430fbf6e26", "comment": "Malware payload (PureCrypter)", "value": "5882c504c2ae4023c610932e723963ba94fd49473de4c66437c913e2fdb5e68efe1e7712ef90befc913e434239f51729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "PureHVNC", "colour": "#6FB7E5", "exportable": true, "hide_tag": false }, { "name": "winautordr-hopto-org", "colour": "#8C2239", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564178, "uuid": "c99c7227-10b8-4e09-ab6c-0acff6e7c1bb", "value": "T172A63378FDF3B48AEC2DACB10966E18BD3456EE694789301744A6B7C0771EC7E35A180", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564178, "uuid": "dff8c28d-015f-47c1-94c3-cdb0da3cedff", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564178, "uuid": "225dfe08-7e94-476f-b659-4f40b7fa9163", "value": "196608:yIvrnND00rt/EmLrNtSc16yqrLNuTC1d6MQj+A/yOB+DGSbU6G6b1ASL8KbA:yIvB7rt/EmLxtSFyqHNpCXjtKVxbXb1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763564178, "uuid": "fad2f9c9-027e-4668-90f2-1974d6031822", "value": 10334720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763564178, "uuid": "73f1e554-e9b4-4bbf-ba2b-5a3b2fa845cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564178, "uuid": "3ddb9b53-c402-4710-b890-1bcbb8aa9f2a", "value": "Installer_v3726_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59f6ff51-c550-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763560934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560934, "uuid": "90b65b1b-c03d-44ae-a66e-5e633591eaf6", "comment": "Malware payload (Formbook)", "value": "82296a95f204903b8541c6d8352696e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560934, "uuid": "45e2653e-9735-4db6-8d3b-bb4982b3d50c", "comment": "Malware payload (Formbook)", "value": "fa1419f1889b4a2f1d65cda0595ceef6a720af1edbdcdbce09f660b453e7b3d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560934, "uuid": "76a78853-0454-4b3a-a1e5-ef8d7d030521", "comment": "Malware payload (Formbook)", "value": "ebb6e9a7b0f74520bcbf4e2ea5afc788aa57d8aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560934, "uuid": "2faff4c2-c6bb-49ce-920e-54c72e6c34c1", "comment": "Malware payload (Formbook)", "value": "ca6bf3636b0d4b8e4fadd13d97e3fd67ba7edbbf7e13ae6d5d92a2d42e5c31cfd67085ba1c6a657b167c6119f8103181", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560934, "uuid": "42047841-14db-43d7-80aa-48aa9205807f", "value": "T19C45CF1363DEC361C7B25273BA15B741AEBF782506B5F96B2FD8093DE820121521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560934, "uuid": "9590a451-7ba0-453f-aaca-89034a601194", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560934, "uuid": "945188e8-8b3b-4b38-a789-70da7f0077fc", "value": "24576:Atb20pkaCqT5TBWgNQ7a3C7kXpBTykzzp9aNZ6A:JVg5tQ7a3C7kDTNVo/5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763560934, "uuid": "e0d752fd-4e1f-4802-8eb6-4d00074d4de8", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763560934, "uuid": "8503f0b1-220e-4c65-a1b0-408d57051ec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560934, "uuid": "e561505b-d047-48b1-a9d6-94cfb71f783c", "value": "AL-25-913152.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5812ef4e-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589707, "uuid": "7dbac2ef-09de-479c-a9e7-364be2a9949c", "comment": "Malware payload (Mirai)", "value": "db787067aea331fdc13b09f41437876d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589707, "uuid": "99be4585-5c40-4802-b5ca-edf24186e2fb", "comment": "Malware payload (Mirai)", "value": "fa18e6594fb0d483be81063eba7ec3a49a9e92c56596b7bc5c2d23ad9b144df1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589707, "uuid": "37746be1-25ef-4f70-b83a-0aeb0ccb1092", "comment": "Malware payload (Mirai)", "value": "9d7148902e9d68690d7d4ba1d83ae7cae6026f3c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589707, "uuid": "36b07d23-bc7e-4253-9ab7-d2f50e5744e6", "comment": "Malware payload (Mirai)", "value": "e60e5acd981c302e8624a325c31547dcf8413bafe5137d63c5dce7affa62a0b6150b9d4ba32753db81b4fae45bcba50b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589707, "uuid": "4bbcf7ee-862a-44fa-bfac-8109db1aa8f8", "value": "T15713F15F81D65DF4EAFAAE215622C3D873B48BCC36E0496B10E99E03B53B43C7149D86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589707, "uuid": "f6e5db4d-88ed-4b83-8044-b0e780cbd457", "value": "768:Qprc+3BhJMKA5DwuY67v7qsMHx0A0TjudceX/NGgeO1Z+PWECApG4uVcqgw09bh:DWze55DwuY67v7wguyeX/neO1Ze3rpG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589707, "uuid": "b92f68ed-715f-494c-8106-9ab05df6d178", "value": 45252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589707, "uuid": "dd684070-3d87-4a02-bf2f-d40f6dd7b197", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589707, "uuid": "ca74d679-4611-4fb6-a934-4f2c0a615935", "value": "S3o.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bda1474-c55d-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763566548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566548, "uuid": "13e2db85-417d-4459-ba0e-7dfb938b57d8", "comment": "Malware payload (Mirai)", "value": "d66e7c4347feb03776eee448408a2314", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566548, "uuid": "fd426a94-212b-4bb2-b17e-190c6f3a7172", "comment": "Malware payload (Mirai)", "value": "fa528d0f2539a015d40b180431dbabc385653cb9c65a2537a6ec7d3c6288732b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566548, "uuid": "78dd8641-735b-4cd1-bbbb-d34e4f6c9a26", "comment": "Malware payload (Mirai)", "value": "11b26ef57121dd893c1b97edac56ad0d2445f770", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763566548, "uuid": "ee92993c-bc0a-415d-aa0e-aa41bfeb3793", "comment": "Malware payload (Mirai)", "value": "afef221db339c6f2ca0a7eebab38b4339eacf419801091cc8545af6e66c261407206518703903c71341241fabc56b835", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566548, "uuid": "c77a7b82-9589-4ffd-86ff-9c82fdc23c8b", "value": "T19F833BD6F400DD7DF80FD6BB84574916F631A3500BA20F3A7396F9A36D72198892AEC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566548, "uuid": "1f1a924a-666e-4670-a4fd-2874680be814", "value": "1536:ea21FSxHJwN8Xbu3umurM76lHf7Jy+dlGm8iIW5NJ1cYJc5qaLQdWG9byPZB6:ex1FkJwN8Xbu3umurMWljJy+dl2O1cmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763566548, "uuid": "f8ecb0a1-1fa1-447c-afa9-272220d9a9cd", "value": 83816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763566548, "uuid": "f94ce287-667b-45ff-858b-93a8b23d7ec9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763566548, "uuid": "69b25300-f421-40ed-a6a4-ea9fd1177151", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae9ec5d-c593-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763589712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589712, "uuid": "f08bddf8-b4e8-458a-bd70-a7ec27099fa2", "comment": "Malware payload (Mirai)", "value": "6b5a9d8c63e68df249d54dc19851ebea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589712, "uuid": "654625bc-7dfc-4d29-8b06-410ffdc70929", "comment": "Malware payload (Mirai)", "value": "fa55f188f0026bd182b35fbadcf2153271ba1eb218a9805241886c0704df4719", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589712, "uuid": "2918651d-5683-4456-8a85-36af3ca1a78e", "comment": "Malware payload (Mirai)", "value": "83f452c67c5e912d4348d41c61e37f8e057e468a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763589712, "uuid": "15099fdc-1ad6-47b0-8592-f0ee616ac367", "comment": "Malware payload (Mirai)", "value": "1a32a9b38c00ccc08845df6253bbf3d411f7e555516fdbb0d7fcd6feda9520b93216f62334b6a59d0c839df70fbf58ec", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589712, "uuid": "b804daf0-137c-4351-bde5-e98b575d5d0c", "value": "T12523F10B767D4256C9EC41B91C79F00E9A48A50C728CDC8639C0BA3BF43A66DBF65F54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589712, "uuid": "61e674fc-607e-4dde-9a37-496126b1ffe0", "value": "768:ow3P4UIZ19U7OORuvne3BrrbkMLmpnp84oLejlPnbcuyD7UHQRj/:oW/R73Q2RrrVwnp8deNnouy8Hyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763589712, "uuid": "66f1fcd1-f4d4-4d90-9a16-d5fe7b1f3c57", "value": 48060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763589712, "uuid": "6f41b1f1-8ae9-412c-8d34-ae831192348c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763589712, "uuid": "0acd7328-9e12-4ac2-af0a-4e725b25c076", "value": "debug", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb6787c-c4f6-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763522182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522182, "uuid": "899408f8-0e92-40fc-bec7-8ff4dd1e647f", "comment": "Malware payload (Mirai)", "value": "5b553e3475fa864def6c56c440b090a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522182, "uuid": "07d91d29-02f5-4859-b239-614b14692a0b", "comment": "Malware payload (Mirai)", "value": "fbfe556c69e1aa5011126241d906a8bc18fd5d69ce69e9a3efcf12c8288d47fb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522182, "uuid": "c131293b-da13-40e8-8613-4e9d9ebdd718", "comment": "Malware payload (Mirai)", "value": "df9b8a7188d5ce4266eb66aab0ceef66e10045d3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763522182, "uuid": "298a0549-bfb2-4168-a927-13533a577a32", "comment": "Malware payload (Mirai)", "value": "fdb20daaa2b5e98ce996d9431fc8f1079d6b971e5145219ed70d106c1f58e9762ce89b3de9a25294bed077eb256fcf5e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522182, "uuid": "22c11c7e-b674-4d39-8056-c2704ab20c2e", "value": "T130B38D9BF6474260C8624AF00BCB5BED3E2323815F27C4E76C6D657968791CF8906F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522182, "uuid": "338de544-0882-421e-97a6-a14766b96675", "value": "1536:1VEmLyA70aHSK2EVgwByLe7jiMiSwWC5gA/LWy:13yArSK7dymiMiSwWggAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763522182, "uuid": "09481c7c-daee-4dc4-92ea-660d69f8efc0", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763522182, "uuid": "2ce8433f-1ba3-45af-959c-d6087d216f78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763522182, "uuid": "83fa8394-f8a2-43a4-b160-41093b5e4202", "value": "boatnet.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a509044-c546-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763556720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763556720, "uuid": "4aaa93f6-160e-4031-8768-c0e5ef9a54e0", "comment": "Malware payload", "value": "0d75d757b83936faf6ab473dfe9a9f11", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763556720, "uuid": "695d4415-b4b7-46ac-adf8-d924aeb35040", "comment": "Malware payload", "value": "fc43a14febd1b12578c8cd36e457da1aa25d0e6bba29fc2da84fbda63380fc2a", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763556720, "uuid": "653d482b-0433-4179-9aca-526c882f1516", "comment": "Malware payload", "value": "1fcbf0e78b3665e1adf08fab43c8533100fa87e2", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763556720, "uuid": "9e52b4b1-3b09-492f-af87-cd59d0fd738d", "comment": "Malware payload", "value": "f388a700101775f20e4bca0aa99983d67c83844ebad4c270ea845c04ef44e8a27455a67148e2933d4c45b3b442065566", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763556720, "uuid": "c66dbc08-092f-417d-bc87-017232e57062", "value": "T17FE0C2378DD2393AEC239175A911F609920D00C9D7B0AB477117127D3E831B9DE839BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763556720, "uuid": "e4717691-b2c4-432f-9478-1b633d425406", "value": "6:5jVMsAL6efluIYN9Pim0WkSGQoo/yYkdAbxVMeiAkt+l/X:5jVeLXkIYNENYn74ibbkta/X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763556720, "uuid": "992fe8a3-ae4e-476e-950e-7219ce13ddc2", "value": 319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763556720, "uuid": "aef206f3-8e56-4e1a-8a50-13497c499cac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763556720, "uuid": "214dddbf-81fd-4eda-8389-46e93e164cfe", "value": "Invoice.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a03b01-c55b-11f0-a129-42010a9c0007", "comment": "Malware payload (Vidar)", "timestamp": 1763565926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565926, "uuid": "98c072a3-1bbc-4610-97f6-82cf1dea6d87", "comment": "Malware payload (Vidar)", "value": "090c01efedada175ff42474313e941dc", "object_relation": "md5", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565926, "uuid": "f07c46d7-9276-4f1e-8d3a-e0083e83981b", "comment": "Malware payload (Vidar)", "value": "fd3db327aa1db045d650c8b48ef3717e78f520dc6fedfec67d8808f963d6f35f", "object_relation": "sha256", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565926, "uuid": "722aeed7-c9ba-43fe-95c2-a2f87bdd4270", "comment": "Malware payload (Vidar)", "value": "799cfd926a1d1863fcc00113852b9c8436f13164", "object_relation": "sha1", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763565926, "uuid": "4087de27-9aa7-4c1c-80e1-d264a77d3bef", "comment": "Malware payload (Vidar)", "value": "454f5a8ff963e6e7b54bc83cddc362bb55b7c7aec91ac56ccd7f4f0c75c872bb5c9a38181a0990dca45551dbff08009e", "object_relation": "sha3-384", "Tag": [ { "name": "dropped-by-amadey", "colour": "#F2C079", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fbf543", "colour": "#54A111", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565926, "uuid": "a3ebfca0-dd65-4af1-82ea-16c15deffcf6", "value": "T17F5423E78A45161DE224CEFC3BD9575F629CF0C8320EDBDAA07974E15B426BAA480394", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565926, "uuid": "af521c31-4efe-4346-8a96-c997cb0f4547", "value": "31e06ec6723bcc3b75c69a4521e4b8f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565926, "uuid": "e57802bf-da0c-4358-aca1-28c5bc328537", "value": "3072:hsSOahzK+ynHlh4posLvxAzIff1J4ZeQKYx+KIsNYuyP2et+BRHjIEd9wukDz3Z0:xM+ynDg1LoIf9JAeCIZtm70Ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763565926, "uuid": "2966cd7a-71af-4199-ba0d-a1daf1bd2d50", "value": 290816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763565926, "uuid": "af3aa7f9-2b73-4dbd-8173-1d076e4174f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763565926, "uuid": "b55a691b-4cd7-4314-a2eb-d6af0318eff8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef2ea4f-c51d-11f0-a129-42010a9c0007", "comment": "Malware payload (Formbook)", "timestamp": 1763539145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539145, "uuid": "16232dc5-8832-42d8-8745-63c5fcf163fe", "comment": "Malware payload (Formbook)", "value": "ea25d1c0581afa40258068864e32b8f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539145, "uuid": "cae3090b-5274-4193-a336-9b442752641f", "comment": "Malware payload (Formbook)", "value": "fe8049873c033ec5753ed474e1a8f4960f894e7badef3a1e0938bcad44d5b2dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539145, "uuid": "8216bf13-b369-43ef-8130-69b784c648d5", "comment": "Malware payload (Formbook)", "value": "b2e48e97f1e78a9d30a75ee6e52ae0a97eabcc5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763539145, "uuid": "6b58da03-c1ef-4e13-9205-1d650747f1be", "comment": "Malware payload (Formbook)", "value": "55feffd1e8a0516b09b12d09c5d349bdbbc362a90f0a6c5804c7a9b40f94854aa24cd8154255b47c8641359882234cd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539145, "uuid": "d369c52a-1430-421e-a11b-271926ebdc9c", "value": "T1B8F412102196EE03C8A30FB40560E2B417B9ADED5916D3175FEA2DCFF8BAF444A15397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539145, "uuid": "52e91a1d-b3e3-4382-93bf-64a973194958", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539145, "uuid": "a6823d15-a95c-4804-ae83-a1981e532e7d", "value": "12288:ERYkfRec0YWHik7Cn7MapQu7Cze2/Ryh0/BIXV40guT+PDWRB/nFnXMzuRnMyZG3:cpcy1pbWz3o5XxgS+cB/hMzulMyZF7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763539145, "uuid": "53a23641-1986-4203-86c7-23dfd3d15f3b", "value": 789504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763539145, "uuid": "d8abd16a-0d05-4ea4-9c3c-e92bc30ce2db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763539145, "uuid": "873adc8a-1a1a-4212-ace2-b09c6f20c418", "value": "QUOTE-065.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "106fb7e4-c591-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763588728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588728, "uuid": "c21e422d-5fb9-4594-9f86-fbabb697a1b7", "comment": "Malware payload (Mirai)", "value": "4086eda0e9f7e191fb373f74f19e05e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588728, "uuid": "cc753906-7303-45ad-a52a-ddf821946f25", "comment": "Malware payload (Mirai)", "value": "feb25d9fb8ba8d13338871d7ffcd04082c2ff65b7c9017f86760e2347f82c08a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588728, "uuid": "34f4611e-1ec8-4c7a-95fd-bcbd03cc7886", "comment": "Malware payload (Mirai)", "value": "2e17986e542e9f5028c4f2cd3ab9bee0c2de28b3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763588728, "uuid": "e7654079-3fb6-4336-9cb8-1c64cd8459eb", "comment": "Malware payload (Mirai)", "value": "959bfca99ff82843ab92d9ee252c243b7214166c2cacbd60fa453a917cf31293f7022320a96fd4d1f280157c47abd408", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588728, "uuid": "e156ac5d-0339-496f-a9e8-58b3ec89fbee", "value": "T1F8833A52FD41DA13C6C0217BFB1E828C772753ACD2EB33068E265FA1638A56A0E7B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588728, "uuid": "7843c086-d82b-4178-aaa9-c79cb409ac93", "value": "1536:b7nDDbawpsB2Qj19LFS0fGDZywQBs5AvnWemg:b7HbHK2cFdfGwv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763588728, "uuid": "9a1db558-2768-48fd-a028-4ea3d54951b2", "value": 87252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763588728, "uuid": "d1a232d1-6e69-4a03-9001-768e26601101", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763588728, "uuid": "70e7b899-29ce-47a7-b50d-224679927d90", "value": "arm.uhavenobotsxd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa497f1d-c5a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763596288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763596288, "uuid": "e52c56a4-7822-454a-bb21-6ac93be75d06", "comment": "Malware payload (Mirai)", "value": "38d5bf8eb63afea4e570245a451867ac", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763596288, "uuid": "880219e3-c125-43cd-9715-5ec365bcc829", "comment": "Malware payload (Mirai)", "value": "feee7969edf434b8419202577238c7749422818926d3ed60df5b52fb9d6550d4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763596288, "uuid": "7286cc6f-9d0e-41e9-9e4f-bda07c22b981", "comment": "Malware payload (Mirai)", "value": "180253817342b51ec28c076fbb1523687bf81caa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763596288, "uuid": "5ffc225c-ef56-43d7-a245-26289b874a8c", "comment": "Malware payload (Mirai)", "value": "074cfb63fbcd2c7afeddff6d259833bc58a36f1d43c10ef37e4f3ae5ff90a93bd6a5095a5cc2f291301f7d8349673ab0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "UPX", "colour": "#67320E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763596288, "uuid": "7ad6ffd7-24d6-4525-98fc-f9f4170ec4fc", "value": "T1F15312BE95002BC0C82DB2BD1C0A57B76C02B5BB21B8E64D47154F47D3658EABE6E478", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763596288, "uuid": "368799f3-951f-4313-a6ff-eb4cb145f2b8", "value": "1536:BhD5ywPgcSo7fV2jV7kS/+ObzukNbuWfUnIOFn53Eg:QQSoTYZ7FXzPbaIOFn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763596288, "uuid": "4dfe4bbe-bae7-431f-9316-fa7fb546f077", "value": 62560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763596288, "uuid": "ebe593ea-66c4-443f-ba17-e824bca17b89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763596288, "uuid": "c875c4f3-83ee-4733-a929-842629a15c2f", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4340147a-c514-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763535126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535126, "uuid": "c8677ae3-ae50-4114-89ca-1386304a0ff7", "comment": "Malware payload (Mirai)", "value": "1126401d2c3efab630549e19c4d6b2a3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535126, "uuid": "ae788483-d394-4efb-8700-e7de4acd39c0", "comment": "Malware payload (Mirai)", "value": "ff00296360ab5fe114f42e9ac47d9cb1b7b5f76a376fbf29f1634ef7c84b03bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535126, "uuid": "1adeca0f-820b-4111-b52e-666df22f9275", "comment": "Malware payload (Mirai)", "value": "ae6030b274d45dbb90c997450c0e881d66c5a0c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763535126, "uuid": "c3d6b855-cdb9-433d-92d0-25258cc16245", "comment": "Malware payload (Mirai)", "value": "c4fc40efd44ca45f3989b7dfaee1b13def250d171a7dc51e5197e52ce1482f645b840d0b8db129dec3793f70dbeb594b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535126, "uuid": "0c65000b-fa52-4bfa-bc63-6898c622dcae", "value": "T124E32AC7F900DEFAF80AE33748570905B630BBE115921B372257797BED3A1991863E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535126, "uuid": "80765a52-1ecd-48b9-a2b9-becb00242f08", "value": "3072:GmzTDH86Jl78HenJljAX0Gidw+w9EEVvjbiQLZrEyqKYSf:G2TDH86JRHjAX03dC9EMLmyqlSf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763535126, "uuid": "fd959645-c865-4d66-9725-7d32e39bd017", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763535126, "uuid": "c6abeb14-ea76-46fb-a002-dace551cddae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763535126, "uuid": "db49c260-dcfb-45f2-b535-66e315930501", "value": "main_m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24347e5-c558-11f0-a129-42010a9c0007", "comment": "Malware payload", "timestamp": 1763564545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564545, "uuid": "4be2de8d-ed98-447f-83aa-d02d1c68d5a3", "comment": "Malware payload", "value": "42580441ca9599c18c823e3e5490db68", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564545, "uuid": "79835860-f997-4388-9c1d-3ee921167384", "comment": "Malware payload", "value": "ff2e46babb66a7a24b36960e20b26e2b6b329d5db1499dba3aebc4c95f5fb5e2", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564545, "uuid": "fe064eef-3560-4c60-989f-ac4d2298a70f", "comment": "Malware payload", "value": "6868200630f45bdddece19a96483a068bb9843a9", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763564545, "uuid": "cbf479b4-e643-48a5-b997-6b71958801b5", "comment": "Malware payload", "value": "9714103cf5f1d537d24c18c61f1824135875f436a1d707111769336cafc3007ad364df7a4bdfef046ca0b7eac47e08fb", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "herodotus", "colour": "#7B29FB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564545, "uuid": "9af14d44-faeb-4fb0-a503-29bc4016aed4", "value": "T1BA361246B3D99E2FCCB399361F856331024A8C22CB47D34B6458776D6CBBAE80E857D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564545, "uuid": "4cb29bb1-f91d-4f3c-b16e-50a9853fe8bd", "value": "98304:CpbIrzHmR51h4mjmewbHpbIrzHmR51YM47ZjmdROqEhPfXL/kKufDim439odi:0bIrqvTmtJbIrqvaJA0X9Mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763564545, "uuid": "8a7dfa64-dd4e-41d0-94e5-8a96e59c0f1f", "value": 4978352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763564545, "uuid": "3ab8ec9d-ebf4-484e-8724-714d29010f1d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763564545, "uuid": "77bb8b3b-fd81-4cfd-ae4f-c20a190ba989", "value": "out.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1a5a5e-c550-11f0-a129-42010a9c0007", "comment": "Malware payload (RemcosRAT)", "timestamp": 1763560961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560961, "uuid": "13ade335-50b6-4d81-8cc1-e2191e7b0f6d", "comment": "Malware payload (RemcosRAT)", "value": "8ef6eb9482bb06e353f23ab1b4be9eac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560961, "uuid": "0da9266a-3c6a-431a-ad36-c7642c1cb03f", "comment": "Malware payload (RemcosRAT)", "value": "ff8ecf3ecfe38ebea5b18a0f16a1d89717d1e3eaef62f6cc9c7892de6c72a778", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560961, "uuid": "8a72f845-5f6e-4b0f-877f-b4f087749b99", "comment": "Malware payload (RemcosRAT)", "value": "b5638753d9a660546ad186ffb09274a120eace78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763560961, "uuid": "f8835231-8de0-46fa-ae33-6ec22defc26a", "comment": "Malware payload (RemcosRAT)", "value": "4a9c19558741e39fbb07d2743576d2a31c1b9f277f2f9b0ac61f12c861f3d3c9b12f10344ba92fadd8274422d2a62f40", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560961, "uuid": "6e5de6bc-70cf-4acc-a902-028767e2dfc2", "value": "T1D355D01273DEC361C7725273BA66B701AEBB7C2506B5F85B2FD4093DE920122521EA73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560961, "uuid": "a085ac44-67e9-4319-8a67-f28f876759f0", "value": "91d07a5e22681e70764519ae943a5883", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560961, "uuid": "7d2daeca-0b45-44ec-9996-8fc4d8c149d5", "value": "24576:etb20pkaCqT5TBWgNQ7asP7SIBWDYmDSsAVHaJi6A:LVg5tQ7asP7SIB4DjAMU5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763560961, "uuid": "80802eee-d446-43d1-9e3c-b14cd7662b66", "value": 1299968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763560961, "uuid": "7c4e51fd-5a3b-4513-a523-cbd01f43edd2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763560961, "uuid": "a3eb0cff-2279-408f-9a1c-f458891286be", "value": "New order 43550970351.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8c0c7ed-c5a2-11f0-a129-42010a9c0007", "comment": "Malware payload (Mirai)", "timestamp": 1763596339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1763596339, "uuid": "df78eb3d-0fc2-4aa5-9a43-3cbe36457ff4", "comment": "Malware payload (Mirai)", "value": "3adfd1f343547b234c0744721effc400", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1763596339, "uuid": "4854f115-e857-40fa-b4b1-15504807fb7b", "comment": "Malware payload (Mirai)", "value": "ffd8c7f16e06ac85c632ad393ad8dba31a021b72617d20e4bd037a55993b5834", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1763596339, "uuid": "5f52fd29-92ea-4c83-b93c-cdec0bb4a17f", "comment": "Malware payload (Mirai)", "value": "1bdd007ee5d5e7e97a312ed55efe403116691d63", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1763596339, "uuid": "dbdbe0c8-c0ec-42da-8e66-6795d10b85c7", "comment": "Malware payload (Mirai)", "value": "1786764d6bdd8c3ea7df1ada5ca85af96555b49e0f31a749114dbfa92540804d6d5a44e82e61872c86b3d94c651d0eb1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "upx-dec", "colour": "#6186F2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1763596339, "uuid": "415831b8-c819-420a-a567-553290060cf7", "value": "T1F514C70AAF510EFBDCABCD3706E9170529CC650B22A97B367674D928F50B60F49D3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1763596339, "uuid": "f8fcb726-a45f-4c19-aff0-46ee21a041ce", "value": "3072:VVvL+VVbW/L+chv5FupRKu8ERGon/23jXDcx:jvgWx5F0DKyk/c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1763596339, "uuid": "17bfb4c0-c2a0-45cb-8255-64ced1293dd5", "value": 205996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1763596339, "uuid": "ed1f165b-2af1-4180-bf93-8e300a36a7ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1763596339, "uuid": "20cc7feb-3d24-40dd-9290-3d8555548646", "value": "mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }